search

didi / KnowAgent

基于日志模板构建，采集任务动态管控、数据质量精确度量，一站式日志采集平台
Apache License 2.0
255 stars 74 forks source link

KnowAgent is vulnerable to Information Disclosure, and it results to attackers can read arbitrary files. #40

Open gaogaostone opened 1 year ago

gaogaostone commented 1 year ago

1) When I study the source code of KnowAgent, the file-content route in NormalLogCollectTaskController.java gets my attention. It seems to be a file read function. image 2）Then I access the route via http request. It is a vulnerability which leads to an arbitrary file reading. The request URL is http://116.85.4.122:9010/api/v1/normal/collect-task/file-content?hostName=127.0.0.1&path=/etc/passwd image

huqidong commented 11 months ago

谢谢宝贵的建议，这的确是个漏洞，我们将修复.