CVE-2019-14751

HIGH

nltk < 3.4.5 - Arbitrary File Write via Directory Traversal in Package Extraction

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-14751. PoCs published by mssalvatore.

AI-analyzed exploit summary This repository provides a detailed technical description and reproduction steps for CVE-2019-14751, a directory traversal vulnerability in NLTK Downloader. It explains how attackers can write arbitrary files via a ../ in a ZIP archive during extraction.

Description

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

Exploits (1)

nomisec WRITEUP 4 stars

by mssalvatore · poc

https://github.com/mssalvatore/CVE-2019-14751_PoC

View Code ZIP pw:eip

This repository provides a detailed technical description and reproduction steps for CVE-2019-14751, a directory traversal vulnerability in NLTK Downloader. It explains how attackers can write arbitrary files via a ../ in a ZIP archive during extraction.

Classification

Writeup 90%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: NLTK Downloader before version 3.5

No auth needed

Prerequisites: Access to a web server to host malicious files · Victim interaction to trigger the download

MITRE ATT&CK