Add Local File Inclusion Vulnerability #293
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,170 @@ | ||
| package org.sasanlabs.service.vulnerability.lfi; | ||
|
|
||
| import static org.sasanlabs.vulnerability.utils.Constants.NULL_BYTE_CHARACTER; | ||
|
|
||
| import java.io.File; | ||
| import java.io.IOException; | ||
| import java.util.*; | ||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.sasanlabs.internal.utility.LevelConstants; | ||
| import org.sasanlabs.internal.utility.Variant; | ||
| import org.sasanlabs.internal.utility.annotations.AttackVector; | ||
| import org.sasanlabs.internal.utility.annotations.VulnerableAppRequestMapping; | ||
| import org.sasanlabs.internal.utility.annotations.VulnerableAppRestController; | ||
| import org.sasanlabs.service.vulnerability.pathTraversal.PathTraversalVulnerability; | ||
| import org.sasanlabs.vulnerability.types.VulnerabilitySubType; | ||
| import org.sasanlabs.vulnerability.types.VulnerabilityType; | ||
| import org.springframework.http.HttpStatus; | ||
| import org.springframework.http.ResponseEntity; | ||
| import org.springframework.web.bind.annotation.RequestParam; | ||
|
|
||
| @VulnerableAppRestController( | ||
| descriptionLabel = "URL_BASED_LFI_INJECTION", | ||
| value = "LocalFileInclusion", | ||
| type = {VulnerabilityType.LFI}) | ||
| public class LFIVulnerability { | ||
|
|
||
| private static final transient Logger LOGGER = | ||
| LogManager.getLogger(PathTraversalVulnerability.class); | ||
|
|
||
| private static final String URL_PARAM_KEY = "file"; | ||
|
|
||
| @AttackVector( | ||
| vulnerabilityExposed = VulnerabilitySubType.LFI, | ||
| description = "LFI_URL_DIRECT_INJECTION") | ||
| @VulnerableAppRequestMapping( | ||
| value = LevelConstants.LEVEL_1, | ||
| descriptionLabel = "LFI_URL_PARAM_BASED_DIRECT_INJECTION", | ||
| htmlTemplate = "LEVEL_1/LFI") | ||
| public ResponseEntity<String> getVulnerablePayloadLevelUnsecure( | ||
| @RequestParam Map<String, String> queryParams) { | ||
| StringBuilder payload = new StringBuilder(); | ||
| String queryParameterURL = queryParams.get(URL_PARAM_KEY); | ||
| if (queryParameterURL != null) { | ||
| try { | ||
| File file = | ||
| new File( | ||
| "src/main/java/org/sasanlabs/service/vulnerability/lfi/" | ||
| + queryParameterURL); | ||
| Scanner reader = new Scanner(file); | ||
| String data = ""; | ||
| while (reader.hasNextLine()) { | ||
| data = data + reader.nextLine(); | ||
| } | ||
| payload.append(data); | ||
| reader.close(); | ||
|
There was a problem hiding this comment. Please close the reader in finally block or better use try with resourcr |
||
| } catch (IOException e) { | ||
| LOGGER.error("Following error occurred:", e); | ||
| } | ||
| } | ||
|
|
||
| return new ResponseEntity<String>(payload.toString(), HttpStatus.OK); | ||
| } | ||
|
|
||
| @AttackVector( | ||
| vulnerabilityExposed = VulnerabilitySubType.LFI, | ||
| description = "LFI_URL_DIRECT_INJECTION_WITH_VALIDATION_ON_FILE") | ||
| @VulnerableAppRequestMapping( | ||
| value = LevelConstants.LEVEL_2, | ||
| descriptionLabel = "LFI_URL_PARAM_BASED_INJECTION_WITH_VALIDATION_ON_FILE", | ||
| htmlTemplate = "LEVEL_1/LFI") | ||
| public ResponseEntity<String> getVulnerablePayloadLevelUnsecureLevel2( | ||
|
There was a problem hiding this comment. Please try queryparam by name injection instead of map. |
||
| @RequestParam Map<String, String> queryParams) { | ||
| StringBuilder payload = new StringBuilder(); | ||
| String queryParameterURL = queryParams.get(URL_PARAM_KEY); | ||
| if (queryParameterURL != null && queryParameterURL.contains(NULL_BYTE_CHARACTER)) { | ||
| try { | ||
| queryParameterURL = queryParameterURL.replace(NULL_BYTE_CHARACTER, ""); | ||
| File file = | ||
| new File( | ||
| "src/main/java/org/" | ||
| + "sasanlabs/service/vulnerability/lfi/" | ||
| + queryParameterURL); | ||
| Scanner reader = new Scanner(file); | ||
| String data = ""; | ||
| while (reader.hasNextLine()) { | ||
| data = data + reader.nextLine(); | ||
| } | ||
| payload.append(data); | ||
| reader.close(); | ||
| } catch (IOException e) { | ||
| LOGGER.error("Following error occurred:", e); | ||
| } | ||
| } | ||
|
|
||
| return new ResponseEntity<String>(payload.toString(), HttpStatus.OK); | ||
| } | ||
|
|
||
| @AttackVector( | ||
| vulnerabilityExposed = VulnerabilitySubType.LFI, | ||
| description = "LFI_URL_DIRECT_INJECTION_DOT_DOT_SLASH") | ||
| @VulnerableAppRequestMapping( | ||
| value = LevelConstants.LEVEL_3, | ||
| descriptionLabel = "LFI_URL_PARAM_BASED_INJECTION_WITH_DOT_DOT_SLASH", | ||
| htmlTemplate = "LEVEL_1/LFI") | ||
| public ResponseEntity<String> getVulnerablePayloadLevelUnsecureLevel3( | ||
| @RequestParam Map<String, String> queryParams) { | ||
| StringBuilder payload = new StringBuilder(); | ||
| String queryParameterURL = queryParams.get(URL_PARAM_KEY); | ||
| if (queryParameterURL != null && queryParameterURL.equals("../passwords.txt")) { | ||
| try { | ||
| queryParameterURL = queryParameterURL.replace("..", "secretFiles"); | ||
| File file = | ||
| new File( | ||
| "src/main/java/org/" | ||
| + "sasanlabs/service/vulnerability/lfi/" | ||
| + queryParameterURL); | ||
| Scanner reader = new Scanner(file); | ||
| String data = ""; | ||
| while (reader.hasNextLine()) { | ||
| data = data + reader.nextLine(); | ||
| } | ||
| payload.append(data); | ||
| reader.close(); | ||
| } catch (IOException e) { | ||
| LOGGER.error("Following error occurred:", e); | ||
| } | ||
| } | ||
|
|
||
| return new ResponseEntity<String>(payload.toString(), HttpStatus.OK); | ||
| } | ||
|
|
||
| @AttackVector( | ||
| vulnerabilityExposed = VulnerabilitySubType.LFI, | ||
| description = "LFI_URL_DIRECT_INJECTION_WHITELISTING") | ||
| @VulnerableAppRequestMapping( | ||
| value = LevelConstants.LEVEL_4, | ||
| variant = Variant.SECURE, | ||
| descriptionLabel = "LFI_URL_PARAM_BASED_DIRECT_INJECTION", | ||
| htmlTemplate = "LEVEL_1/LFI") | ||
| public ResponseEntity<String> getVulnerablePayloadLevelUnsecureLevel4( | ||
| @RequestParam Map<String, String> queryParams) { | ||
| StringBuilder payload = new StringBuilder(); | ||
| String queryParameterURL = queryParams.get(URL_PARAM_KEY); | ||
| String[] files = new String[] {"secretFiles/passwords.txt"}; | ||
| List<String> protectedFiles = new ArrayList<>(Arrays.asList(files)); | ||
| if (queryParameterURL != null && protectedFiles.contains(queryParameterURL) == false) { | ||
| try { | ||
| File file = | ||
| new File( | ||
| "src/main/java/org/" | ||
| + "sasanlabs/service/vulnerability/lfi/" | ||
| + queryParameterURL); | ||
| Scanner reader = new Scanner(file); | ||
| String data = ""; | ||
| while (reader.hasNextLine()) { | ||
| data = data + reader.nextLine(); | ||
| } | ||
| payload.append(data); | ||
| reader.close(); | ||
| } catch (IOException e) { | ||
| LOGGER.error("Following error occurred:", e); | ||
| } | ||
| } else { | ||
| payload.append("You don't have access to this data"); | ||
| } | ||
|
|
||
| return new ResponseEntity<String>(payload.toString(), HttpStatus.OK); | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| <h2>TOP SECRET PASSWORDS</h2> | ||
|
|
||
|
There was a problem hiding this comment. I think we don't need a special file, use /etc/passwd and equivalent for windows. |
||
| <p>USER1:PQOAJ231</p> | ||
| <p>USER2:DKAO1020</p> | ||
| <p>USER3:CMVNP325</p> | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| #LFI_level_1 { | ||
| color: black; | ||
| text-align: left; | ||
| font-size: 18px; | ||
| font-weight: normal; | ||
| } | ||
|
|
||
| #verifyUrl { | ||
| background: blueviolet; | ||
| display: inline-block; | ||
| padding: 4px 4px; | ||
| margin: 10px; | ||
| border: 1px solid transparent; | ||
| border-radius: 2px; | ||
| transition: 0.2s opacity; | ||
| color: #FFF; | ||
| font-size: 12px; | ||
| } | ||
|
|
||
| #url { | ||
| width: 500px | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| <div id="LFI_level_1"> | ||
| <div> | ||
| Local file inclusion (also known as LFI) is the process of including files, | ||
| that are already locally present on the server, through the exploiting of | ||
| vulnerable inclusion procedures implemented in the application. | ||
| This vulnerability occurs, for example, when a page receives, as input, | ||
| the path to the file that has to be included and this input is not properly | ||
| sanitized, allowing directory traversal characters (such as dot-dot-slash) | ||
| to be injected. | ||
| <br /> <br /> | ||
| Try to find the password file inside the secretFiles folder using the URL param: <i>file</i> | ||
|
There was a problem hiding this comment. This line sounds like a challenge, which doesn't align with our vulnerable applications mission. Consider this application as a general application which has flaws and let scanners explore and find them. |
||
| </div> | ||
| <br /> <br /> | ||
| <div> | ||
| <b>please enter a URL:</b> | ||
| <input type="text" id="url"/> | ||
| <button id="verifyUrl">Verify URL</button> | ||
| <div id="verificationResponse"></div> | ||
| </div> | ||
| </div> | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| function addingEventListenerToVerifyUrl() { | ||
| document.getElementById("verifyUrl").addEventListener("click", function () { | ||
| let urlInput = document.getElementById("url").value; | ||
| let params = "?file=" + getParameterByName("file", urlInput); | ||
| let urlLevel = getUrlForVulnerabilityLevel() + params; | ||
| doGetAjaxCall(updateUIWithVerifyResponse, urlLevel, false); | ||
| }); | ||
| } | ||
| addingEventListenerToVerifyUrl(); | ||
|
|
||
| function updateUIWithVerifyResponse(data) { | ||
| if (data) { | ||
| document.getElementById("verificationResponse").innerHTML = data; | ||
| } else { | ||
| document.getElementById("verificationResponse").innerHTML = "Try again."; | ||
| } | ||
| } | ||
|
|
||
| function getParameterByName(name, url) { | ||
| name = name.replace(/[\[\]]/g, "\\$&"); | ||
| var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"), | ||
| results = regex.exec(url); | ||
| if (!results) return null; | ||
| if (!results[2]) return ""; | ||
| return results[2]; | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is scanner the best way to read file?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure, do you have a suggestion?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
May be buffered reader but not sure if there are any new libraries which can be more better. Please check.