.. / CVE-2021-3378

• File Upload
• Nuclei
• Web

Exploit for FortiLogger 4.4.2.2 - Arbitrary File Upload (CVE-2021-3378)

Description:

FortiLogger 4.4.2.2 is affected by arbitrary file upload issues. Attackers can send a “Content-Type: image/png” header to Config/SaveUploadedHotspotLogoFile and then Assets/temp/hotspot/img/logohotspot.asp.

Nuclei Template

View the template here CVE-2021-3378.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-3378.yaml

References: