Listen to this Post
The vulnerability exists in the breakpoint resume upload functionality of Gin-vue-admin versions up to v2.8.7. In the `breakpoint_continue.go` file, the `MakeFile` function handles requests to the `/fileUploadAndDownload/breakpointContinueFinish` API endpoint. This function takes a `fileName` parameter from user input and directly concatenates it with the base directory path `./fileDir/` using `os.OpenFile()` to create or open a file. Crucially, it fails to validate or sanitize the `fileName` for directory traversal sequences such as ../. This allows an attacker to break out of the intended directory. Notably, a related function `makeFileContent` in the same file does perform proper validation by checking for `..` sequences, highlighting an inconsistent security implementation. An attacker must first have file upload privileges, typically associated with the super administrator role (ID 888). They can initially upload file chunks via the `/fileUploadAndDownload/breakpointContinue` endpoint, which has proper validation. Then, by calling the `breakpointContinueFinish` endpoint with a manipulated `fileName` parameter containing path traversal sequences (e.g., ../../../tmp/malicious.txt), they can write arbitrary files to any location accessible by the application server. This path traversal flaw can lead to arbitrary file creation, overwriting of critical application or configuration files, and potentially remote code execution if a crafted file is executed by the system.
Platform: Gin-vue-admin
Version: <= v2.8.7
Vulnerability: Path Traversal
Severity: Critical
date: Not disclosed
Prediction: Patch TBA
What Undercode Say:
Analytics
curl -X POST http://<target>/fileUploadAndDownload/breakpointContinue -F "[email protected]" curl -X POST http://<target>/fileUploadAndDownload/breakpointContinueFinish -d "fileName=../../../etc/passwd"
// Vulnerable code in breakpoint_continue.go
func MakeFile(fileName string) error {
filePath := "./fileDir/" + fileName
file, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY, 0644)
// ... no validation for 'fileName'
}
How Exploit:
Upload chunks first.
Finish with malicious fileName.
Write arbitrary files.
Protection from this CVE
Implement input validation.
Sanitize file paths.
Use absolute path security.
Impact:
Arbitrary file creation.
Configuration overwriting.
Remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
