# CVE & Demo
Author: Sean 韋詠祥
Slide: <https://tg.pe/sdy>
----
## 講者介紹
- 陽交資工大三 Sean 韋詠祥
----
## 現任經歷
- 系計中 Net 組、Web 組助教
- SITCON 2022 議程組長
- 資訊之芽 Python 講師
- 行政院 技服中心 網路攻擊手
---
# Grafana
Path Traversal / CVE-2021-43798
CVSS Score: 7.5 (High)
----
## Fix Commit
Please refer to "`grafana/grafana@c798c0e`".
----
## Why?
It's not safe to use "`filepath.Join`" for user input.
----
## What is "`Rel`"?
```go
func Rel(basepath, targpath)
/* Join(basepath, Rel(basepath, targpath)) == targpath */
```
Returns a relative path that is equivalent to `targpath` when joined to `basepath` with an `/`.
Return error if `targpath` can't be made relative to `basepath`.
----
## How to fix it?
Check if it's relative path before
----
## Try it!
Get "`/flag`" using skill you learn.
Hint: Use "`curl --path-as-is`" to preserve "`../`" path.
---
# Apache 2.4.49
Path Traversal / CVE-2021-41773
CVSS Score: 7.5 (High)
----
## Fix Commit
----
## Looks familar?
We could use "`%2e`" or "`%2E`" to exploit it.
----
## Try it!
The flag is located in "`/flag`" file.
---
# Apache 2.4.50 <small>(Hum?)</small>
Path Traversal / CVE-2021-42013
CVSS Score: 9.8 (Critical)
----
## Why?
Let's review previous security patch.
----
## Fix Commit
Assert "`%`" will follow by two "`[0-9a-f]`" char.
----
## Try it!
Use "`%%32%65`" to double encode.
---
## elFinder (zip)
Command Injection / CVE-2021-32682
CVSS Score: 9.8 (Critical)
----
## How to use `zip` command
```shell
$ zip -r9 -q 'target.zip' './source.txt'
```
```text
-q, --quiet
Quiet mode; eliminate informational messages and
comment prompts. (Useful, for example, in shell
scripts and background tasks).
```
```text
-r, --recurse-paths
Travel the directory structure recursively;
for example: `zip -r archive.zip folder/`
```
```text
-# (-0, -1, -2, -3, -4, -5, -6, -7, -8, -9)
The speed of compression.
-0 means no compression.
-1 indicates the fastest compression speed.
-9 uses the optimal compression.
```
----
## There are more options...
```text
-v, --verbose
Verbose mode or print diagnostic version info.
```
```text
-T, --test
Test the integrity of the new zip file.
```
```text
-TT, --unzip-command
Use custom command to test an archive
when the -T option is used.
```
----
## Fix Commit
Add `./` before filename.
----
## How to run arbitrary code?
We could leverage `zip -TT` option.
```shell
$ zip -T -TT 'echo' file.zip
```
----
## Try it!
Hint: File name could be "`-v hello.zip`".
---
# Thanks
Any questions?
----
## Links
- 本次課程簡報、Lab 連結總整理：[HackMD](https://hackmd.io/@rwOHXl9KR8ug8MyhAVl6Wg/HkwrivUH5)
- 此投影片：<https://tg.pe/sdy>
- 課程共筆：<https://tg.pe/DGK>
----
## Log4j
JNDI Injection / CVE-2021-44228
CVSS Score: 10.0 (Critical)
Homework: <http://sqlab.nycu.dev:44228/>
Fix Commit: [apache/logging-log4j2@c77b3cb](https://github.com/apache/logging-log4j2/commit/c77b3cb)