Path Traversal Arbitrary File Read in FastBee

Arbitrary File Read via Path Traversal in FastBee 2.1.0

BUG_Author: Chengxin Xu

Affected Version: FastBee 1.2.1

Software: FastBee

Vulnerability Files:

•
springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java​

•
springboot/fastbee-framework/src/main/java/com/fastbee/framework/config/SecurityConfig.java​

Description

FastBee contains an arbitrary file read vulnerability in the file download functionality. The /iot/tool/download endpoint uses user-controlled fileName input to construct a local file path without canonicalization or boundary checks. Attackers can supply ../ path traversal sequences to escape the configured profile directory and read arbitrary files from the server filesystem.​

Path Traversal via File Download (/iot/tool/download)

The vulnerability starts from the ToolController.download() endpoint. The endpoint accepts a fileName parameter, strips the /profile prefix with a simple string replacement, concatenates the result to RuoYiConfig.getProfile(), and directly reads the resulting path.​

Entry Point (ToolController.java:350-367):

代码块

@GetMapping("/download")​
public void download(String fileName, HttpServletResponse response, HttpServletRequest request) {​
    try {​
//            if (!FileUtils.checkAllowDownload(fileName)) {​
//                throw new Exception(StringUtils.format("文件名称({})非法，不允许下载。 ", fileName));​
//            }​
        String filePath = RuoYiConfig.getProfile();​
        String downloadPath = filePath + fileName.replace("/profile", "");​
        String downloadName = StringUtils.substringAfterLast(downloadPath, "/");​
        response.setContentType(MediaType.APPLICATION_OCTET_STREAM_VALUE);​
        FileUtils.setAttachmentResponseHeader(response, downloadName);​
        FileUtils.writeBytes(downloadPath, response.getOutputStream());​
    } catch (Exception e) {​
        log.error("下载文件失败", e);​
    }​
}​

The endpoint is also exposed through the security configuration and can be reached from the deployed service path:​

Access Control (SecurityConfig.java:117):

代码块

.antMatchers(​
    "/login",​
    "/register",​
    "/captchaImage",​
    "/iot/tool/mqtt/auth",​
    "/iot/tool/mqtt/webhook",​
    "/auth/**/**",​
    "/wechat/mobileLogin",​
    "/wechat/miniLogin"​
).permitAll()​

Root Cause:​
The download implementation performs insecure path construction:​

•
fileName is attacker-controlled​

•
the original download allowlist check is commented out​

•
fileName.replace("/profile", "") is not a security control​

•
the code does not normalize the final path​

•
the code does not verify that the normalized path still resides under the configured profile directory​

•
the resulting path is passed directly to FileUtils.writeBytes() for file read and response output​

Because of this, payloads such as /profile/../../etc/passwd are resolved outside the intended upload directory and expose arbitrary readable files from the container or host filesystem.​

Proof of Concept:

Prerequisites:

•
Reachable FastBee deployment​

•
A valid Bearer token was used during verification in the local Docker environment​

Step 1: Send Traversal Request

Path Traversal Arbitrary File Read in FastBee​

Path Traversal Arbitrary File Read in FastBee