[
https://issues.apache.org/jira/browse/OFBIZ-11196?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jacques Le Roux closed OFBIZ-11196.
-----------------------------------
Resolution: Fixed
Fixed in
trunk r1866986
R18 r1866987
R17 r1866988
R16 r1866989
> Path Traversal in webtools/control/FetchLogs and ViewFile
> ---------------------------------------------------------
>
> Key: OFBIZ-11196
> URL: https://issues.apache.org/jira/browse/OFBIZ-11196
> Project: OFBiz
> Issue Type: Sub-task
> Components: framework/webtools
> Affects Versions: Trunk
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Major
> Fix For: 17.12.01, 16.11.07, 18.12.01
>
>
> This was reported to the OFBiz security team by Jason Nordenstam from
> offensive-security.com. We did not consider it as a real security issue
> because it requires authentication.
> {quote}
> Authenticated users can use the Fetch Logs functionality to view arbitrary
> files on the host OS by modifying the "logFileName" parameter.
> While the web application submits the affected URL as a POST request, it can
> be converted to a GET for ease of use.
> Affected URLs:
> /webtools/control/FetchLogs?logFileName
> /webtools/control/ViewFile?fileName
> Screenshots:
> see attachments ofbiz_path_traversal_1.png and ofbiz_path_traversal_2.png
> {quote}
> That can indeed be easily reproduced at
> https://demo-trunk.ofbiz.apache.org/webtools/control/FetchLogs?logFileName=../../../../../../etc/passwd
> https://demo-trunk.ofbiz.apache.org/webtools/control/ViewFile?fileName=../../../../../../etc/passwd
--
This message was sent by Atlassian Jira
(v8.3.2#803003)
