| 제목 | Devika latest Local File Inclusion |
|---|
| 설명 | The function `browser_snapshot` is vulnerable to **Local File Inclusion (LFI)** due to improper input validation on the `snapshot_path` parameter. An attacker can exploit this vulnerability to read arbitrary files from the server by sending a crafted HTTP GET request to the `/api/get-browser-snapshot` endpoint.
### Exploitation Steps
1. **Request**: An attacker sends a GET request to the vulnerable endpoint with the `snapshot_path` parameter set to a file path on the server.
**Example Request:**
```vbnet
GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
Host: vulnerable-app.com
```
2. **Response**: The server responds with the contents of the specified file, potentially leaking sensitive data.
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
```
POC
### Impact
- **Information Disclosure**: An attacker can read sensitive system files like `/etc/passwd`, application configuration files, or other resources on the server, leading to **data leakage**.
- **Further Exploitation**: This can be used as a precursor for remote code execution (RCE) by including files containing sensitive environment variables or application secrets. |
|---|
| 원천 | ⚠️ https://torada.notion.site/Vulnerability-Report-Local-File-Inclusion-LFI-10de10af6a668056a532e55b4598ec36?pvs=4 |
|---|
| 사용자 | torada (UID 61170) |
|---|
| 제출 | 2024. 09. 26. PM 11:58 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 10. 06. AM 11:58 (9 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 272383 [stitionai devika get-browser-snapshot snapshot_path 디렉토리 순회] |
|---|
| 포인트들 | 0 |
|---|