CVE-2020-37041
HIGHOpenCTI 3.3.1 - Unauthenticated Directory Traversal via Static CSS Endpoint
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37041. PoCs published by Raif Berkay Dincel.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in OpenCTI 3.3.1, allowing unauthorized access to sensitive files like /etc/passwd via a crafted GET request. It also includes a proof-of-concept for a reflected XSS vulnerability in the GraphQL endpoint.
Description
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., '../') in the URL. For example, requesting /static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in OpenCTI 3.3.1, allowing unauthorized access to sensitive files like /etc/passwd via a crafted GET request. It also includes a proof-of-concept for a reflected XSS vulnerability in the GraphQL endpoint.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N