| 标题 | Devika latest Local File Inclusion |
|---|
| 描述 | The function `browser_snapshot` is vulnerable to **Local File Inclusion (LFI)** due to improper input validation on the `snapshot_path` parameter. An attacker can exploit this vulnerability to read arbitrary files from the server by sending a crafted HTTP GET request to the `/api/get-browser-snapshot` endpoint.
### Exploitation Steps
1. **Request**: An attacker sends a GET request to the vulnerable endpoint with the `snapshot_path` parameter set to a file path on the server.
**Example Request:**
```vbnet
GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
Host: vulnerable-app.com
```
2. **Response**: The server responds with the contents of the specified file, potentially leaking sensitive data.
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
```
POC
### Impact
- **Information Disclosure**: An attacker can read sensitive system files like `/etc/passwd`, application configuration files, or other resources on the server, leading to **data leakage**.
- **Further Exploitation**: This can be used as a precursor for remote code execution (RCE) by including files containing sensitive environment variables or application secrets. |
|---|
| 来源 | ⚠️ https://torada.notion.site/Vulnerability-Report-Local-File-Inclusion-LFI-10de10af6a668056a532e55b4598ec36?pvs=4 |
|---|
| 用户 | torada (UID 61170) |
|---|
| 提交 | 2024-09-26 23時58分 (2 年前) |
|---|
| 管理 | 2024-10-06 11時58分 (9 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 272383 [stitionai devika get-browser-snapshot snapshot_path 目录遍历] |
|---|
| 积分 | 0 |
|---|