Описание
Whistle vulnerable to path traversal
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.
Vulnerability detail:
In service.js, inside
app.get('/cgi-bin/temp/get', ...): var filename = req.query.filename; if (TEMP_FILE_RE.test(filename)) { filename = path.join(TEMP_FILES_PATH, filename); } getFile(filename, ...);
Only when filename matches the temp/ pattern does it get joined to the safe directory TEMP_FILES_PATH.
If it does not match that pattern, the code does not block the request. Instead, it directly uses the user-supplied filename for file reading.
In other words: if you pass passwd, it will read passwd.
POC: curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd"
response:
Пакеты
whistle
< 2.10.3
2.10.3
Связанные уязвимости
Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename directly to getFile, allowing a remote attacker to read arbitrary files such as /etc/passwd. This issue is reported as fixed in version 2.10.3.