Listen to this Post
The vulnerability resides in the `/api/file/getFile` endpoint, which employs case-sensitive string equality checks to prevent access to sensitive files such as configuration files (e.g., conf/conf.json). On case-insensitive file systems, notably Windows, the operating system treats filenames like `Conf/conf.json` and `conf/conf.json` as identical. However, the application’s protection logic performs a direct case-sensitive comparison between the user-supplied path and a blacklist of protected paths. An attacker can exploit this discrepancy by sending a HTTP POST request with a mixed-case path (e.g., cOnf/conf.json). The application’s check fails because `”cOnf/conf.json”` does not exactly match the blacklisted `”conf/conf.json”` string. The request is then processed, and the file system retrieves the file successfully due to case-insensitivity, allowing unauthorized reading. This bypass enables access to protected configuration files containing sensitive data like API tokens and access codes. The vulnerability is remotely exploitable when the service runs without authentication, such as when publishing is enabled. The root cause is the lack of path normalization or file-level comparison before access control decisions.
Platform: Web Service
Version: Not specified
Vulnerability: Case Sensitivity Bypass
Severity: Critical
date: Unknown
Prediction: Patched commit 399a3889
What Undercode Say:
Analytics
curl -X POST http://target/api/file/getFile -H "Content-Type: application/json" -d '{"path":"cOnf/conf.json"}'
// Vulnerable code check
if (requestedPath == "conf/conf.json") { blockAccess(); }
// Fixed code using normalization
if (requestedPath.toLowerCase() == "conf/conf.json") { blockAccess(); }
Exploit:
Craft HTTP POST request with mixed-case path to bypass checks.
Protection from this CVE
Normalize paths before comparison; use file-level checks.
Impact:
Unauthorized sensitive file read.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
