CVE-2018-1306
HIGHApache Pluto 3.0.0 - Exposure of Sensitive Information via File Upload Path Disclosure
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2018-1306. PoCs published by Che-Chun Kuo, dawetmaster, andikahilmy.
AI-analyzed exploit summary This exploit demonstrates an authentication bypass via HTTP verb tampering (HEAD method) and remote code execution through arbitrary file upload and directory traversal in Apache Portals Pluto 3.0.0. It uploads a JSP webshell to execute system commands.
Description
The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
Exploits (4)
This exploit demonstrates an authentication bypass via HTTP verb tampering (HEAD method) and remote code execution through arbitrary file upload and directory traversal in Apache Portals Pluto 3.0.0. It uploads a JSP webshell to execute system commands.
This repository contains a vulnerable version of the Apache Pluto portal demonstrating CVE-2018-1306, which involves improper handling of header dependencies in portlet applications. The code includes a header method that dynamically injects CSS dependencies, potentially allowing for XSS or other injection attacks.
This repository contains a vulnerable version of Apache Pluto's ChatRoomDemo and PortletHubDemo applications, which are affected by CVE-2018-1306. The code demonstrates the vulnerability in a functional context, allowing for exploitation of the issue.
This PoC exploits CVE-2018-1306 in Apache Pluto 3.0.0 by tampering with HTTP methods to bypass authorization and upload a malicious JSP file. The script uses the HEAD method to upload a webshell, which is then accessible at a predictable path.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N