Listen to this Post
The CVE-2023-41993 vulnerability exists within the `download` method of the `HttpClient.Request` class in Dreampie Resty. This method is designed to download a file from a remote server and save it locally. It takes a `filename` parameter from the user without proper sanitization and uses it to construct a local file path. An attacker can exploit this by supplying a malicious filename containing path traversal sequences, such as ../../../../etc/passwd. The application does not neutralize these special elements, allowing the attacker to break out of the intended directory. Consequently, the downloaded file is written to an arbitrary filesystem location specified by the attacker, potentially overwriting critical system files or configuration, leading to a complete compromise of the server. The attack is performed remotely by manipulating the server’s response or the client’s request.
Platform: Dreampie Resty
Version: <= 1.3.1.SNAPSHOT
Vulnerability : Path Traversal
Severity: Critical
date: 2023-09-12
Prediction: Unpatched
What Undercode Say:
curl -X GET "http://target.com/download" -H "filename: ../../../../tmp/exploit.sh"
// Vulnerable code in HttpClient.java
public void download(String filename, InputStream inputStream) {
File file = new File(filename);
// ... writes inputStream to file without path validation
}
How Exploit:
Remote file overwrite.
Protection from this CVE
Input sanitization.
Path normalization.
Security patches.
Impact:
Arbitrary file creation.
System compromise.
Data loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
