From 96cb5ce917a28ce38e1e77ba5710bc08558de3ec Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Fri, 26 Apr 2019 06:57:57 -0500 Subject: [PATCH] Update documentation --- .../scanner/http/springcloud_traversal.md | 25 +++++++++---------- .../scanner/http/springcloud_traversal.rb | 6 ++--- 2 files changed, 15 insertions(+), 16 deletions(-) diff --git a/documentation/modules/auxiliary/scanner/http/springcloud_traversal.md b/documentation/modules/auxiliary/scanner/http/springcloud_traversal.md index 7b264a6188..248d9ae05b 100644 --- a/documentation/modules/auxiliary/scanner/http/springcloud_traversal.md +++ b/documentation/modules/auxiliary/scanner/http/springcloud_traversal.md @@ -1,20 +1,22 @@ ## Description -This module exploits an unauthenticated directory traversal vulnerability, which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2,versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, which is listening by default on port 8888. +This module exploits an unauthenticated directory traversal vulnerability, which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2,versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6. +Spring Cloud Config listens by default on port 8888. + +### Vulnerable Application + +* https://github.com/spring-cloud/spring-cloud-config/archive/v2.1.1.RELEASE.zip ## Verification -``` -Start msfconsole -use auxiliary/scanner/http/springcloud_traversal -set RHOSTS -run -``` +1. `./msfconsole` +2. `use auxiliary/scanner/http/springcloud_traversal` +3. `set rhosts ` +4. `run` ## Scenarios -### Tested against -`Linux zero 4.15.0-48-generic #51-Ubuntu SMP Wed Apr 3 08:28:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux` +### Tested against Linux zero 4.15.0-48-generic #51-Ubuntu SMP x86_64 GNU/Linux ``` msf > use auxiliary/scanner/http/springcloud_traversal @@ -28,9 +30,6 @@ msf auxiliary(scanner/http/springcloud_traversal) > run msf auxiliary(scanner/http/springcloud_traversal) > ``` -### Vulnerable software link -* https://github.com/spring-cloud/spring-cloud-config/archive/v2.1.1.RELEASE.zip - -### References +## References * https://pivotal.io/security/cve-2019-3799 diff --git a/modules/auxiliary/scanner/http/springcloud_traversal.rb b/modules/auxiliary/scanner/http/springcloud_traversal.rb index 5ab50291f6..2f2bc9fa1f 100644 --- a/modules/auxiliary/scanner/http/springcloud_traversal.rb +++ b/modules/auxiliary/scanner/http/springcloud_traversal.rb @@ -13,9 +13,9 @@ class MetasploitModule < Msf::Auxiliary 'Name' => 'Spring Cloud Config Server Directory Traversal', 'Description' => %q{ This module exploits an unauthenticated directory traversal vulnerability - which exists in spring cloud config, versions 2.1.x prior to 2.1.2, - versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, which is - listening by default on port 8888. + which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2, + versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6. Spring + Cloud Config listens by default on port 8888. }, 'References' => [