Use subpar regex validation on LEAK_FILE
This commit is contained in:
@@ -91,7 +91,9 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||
[
|
||||
true,
|
||||
'Leak API key from this file (absolute path)',
|
||||
'/opt/infra/idaccessmgr/logfile.txt'
|
||||
'/opt/infra/idaccessmgr/logfile.txt',
|
||||
nil, # enums
|
||||
%r{^/.+$} # LEAK_FILE must be an absolute path
|
||||
]
|
||||
)
|
||||
])
|
||||
@@ -118,10 +120,6 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||
end
|
||||
|
||||
def exploit
|
||||
unless datastore['LEAK_FILE'].start_with?('/')
|
||||
fail_with(Failure::BadConfig, 'LEAK_FILE is not an absolute path')
|
||||
end
|
||||
|
||||
# Randomly named file is never written to the exports directory
|
||||
create_exports_dir(
|
||||
'/opt/infra/web_cloudmgr/apache-tomcat/webapps/app/cloudmgr/exports',
|
||||
|
||||
Reference in New Issue
Block a user