Listen to this Post
The vulnerability exists in the `/api/fileUploadAndDownload/removeChunk` endpoint of the gin-vue-admin application. This interface is intended for deleting temporary file chunks after upload. It accepts user-controlled JSON parameters, including fileMd5. The backend code uses the `fileMd5` value directly to construct a filesystem path without validation. By supplying a `fileMd5` parameter containing directory traversal sequences (e.g., ../config.yaml), an attacker can manipulate the path resolution. The application then passes this tainted path to a file deletion function. Due to missing authorization checks and improper path sanitization, the server will delete the specified file or directory. This allows unauthenticated or authenticated attackers, depending on the endpoint’s access controls, to delete arbitrary critical system files, leading to denial of service or complete server compromise.
Platform: gin-vue-admin
Version: All versions
Vulnerability: Arbitrary file deletion
Severity: Critical
Date: Unknown
Prediction: Patch pending
What Undercode Say:
Analytics
curl -X POST "http://127.0.0.1:8080/api/fileUploadAndDownload/removeChunk" -H "x-token: eyJhbGci..." -H "Content-Type: application/json" -d '{"fileName":"test.jpg","fileMd5":"../../etc/passwd","filePath":"./fileDir/test.jpg"}'
// Example vulnerable code pattern
func removeChunk(c gin.Context) {
var req FileRequest
c.BindJSON(&req)
filePath := filepath.Join("./uploads/", req.FileMd5) // Path traversal possible
os.Remove(filePath)
}
How Exploit
Craft HTTP POST request to `/api/fileUploadAndDownload/removeChunk` with a malicious `fileMd5` parameter containing path traversal sequences like `../` to target sensitive files.
Protection from this CVE
Implement input validation. Sanitize user input. Use filepath.Clean(). Apply proper authorization checks. Use absolute path baselines.
Impact
Arbitrary file deletion. Denial of service. System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
