Listen to this Post
This vulnerability allows any authenticated user of DPanel’s administrative backend to delete arbitrary files on the server. The flaw is in the `Delete` function within app/common/http/controller/attach.go. When a user submits a request to the `/api/common/attach/delete` endpoint, the `path` parameter from the request is taken directly and passed to a helper function storage.Local{}.GetSaveRealPath. This function, located in common/service/storage/local.go, uses `filepath.Join` to construct a full system path. While `filepath.Join` technically resolves path traversal sequences like ../, it does not enforce that the final path remains within a safe, intended directory (a chroot/jail). The resulting path is then passed directly to `os.Remove()` without any prior validation to check if the user is attempting to navigate outside the permitted file area. Consequently, by submitting a `path` parameter containing a sequence like ../../../../../../tmp/1.txt, an attacker can traverse up and out of the intended directory and specify the full path to any file the application process has permission to delete.
dailycve form
Platform: DPanel
Version: Pre-commit cbda0d9
Vulnerability: Arbitrary File Deletion
Severity: Medium
date: 2024-12-26
Prediction: 2024-12-30
What Undercode Say:
Curl command for exploitation attempt
curl -X POST 'http://target:8807/dpanel/api/common/attach/delete' -H 'Authorization: Bearer <TOKEN>' -d 'path=../../../../etc/passwd'
Vulnerable code snippet (simplified)
path := storage.Local{}.GetSaveRealPath(params.Path)
os.Remove(path)
Fixed code validation check
if !filepath.IsLocal(params.Path) { return error }
params.Path = filepath.Clean(params.Path)
How Exploit:
- Authenticate to get JWT token.
- Craft POST request with path traversal.
- Target critical system files.
Protection from this CVE
- Apply GitHub commit cbda0d9.
- Use `filepath.IsLocal()` validation.
- Sanitize all user input paths.
- Implement strict file permission policies.
Impact:
- Unauthorized system file deletion.
- Service disruption and data loss.
- Potential denial of service.
- Integrity compromise of server.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
