/CVE_2019_14234

漏洞demo

Primary LanguagePython

CVE_2019_14234

python 2.7.x CentOS7

  • install python 2.7

    curl "https://bootstrap.pypa.io/get-pip.py" -o "get-pip.py"
python get-pip.py
yum install gcc openssl-devel bzip2-devel python-devel -y

  • install postgres via docker

    curl -sSL https://get.docker.com/ | sudo sh
usermod -aG docker root
systemctl start docker

docker run --name some-postgres -e POSTGRES_USER=root -e POSTGRES_PASSWORD=minhkma -e POSTGRES_DB=test -p 5432:5432 -d postgres

  • Install and setup django to PoC

    pip install requirements.txt
    vim app/settings.py # update DATABASES
    python manage.py migrate
    python manage.py runserver 0.0.0.0:8000

  • PoC

    python PoC.py

  • output

    [root@grafana CVE_2019_14234]# python PoC.py 
/usr/lib/python2.7/site-packages/requests/__init__.py:91: RequestsDependencyWarning: urllib3 (1.25.3) or chardet (2.2.1) doesn't match a supported version!
RequestsDependencyWarning)
Vulnerability!