.. / CVE-2024-7340

• Info Disclosure
• Nuclei
• Web

Exploit for W&B Weave Server - Remote Arbitrary File Leak (CVE-2024-7340)

Description:

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

Nuclei Template

View the template here CVE-2024-7340.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-7340.yaml

References: