Closed hun7err closed 8 years ago
Nice catch. Should be probably also fixed here: https://github.com/mushorg/glastopf/blob/master/glastopf/modules/classification/request.py#L84 Also check out SNARE and TANNER: https://github.com/mushorg/snare which succeed Glastopf
Thanks! I've just created a PR for request.py as well. Thank you for recommending snare, wouldn't have known about it otherwise :)
Hello, nice catch.
Can you please share a reproducer ? I am trying to accomplish path traversal in my glastopf.
Thanks and sorry for the late answer,
http://example.com/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd
was a url that worked for me.
@hun7err thank you very much. nice catch indeed
Unsanitized file path lead to a path traversal vulnerability in the file_server emulator allowing glastopf to read arbitrary files including configuration and the database file.