View Issue Details

IDProjectCategoryView StatusLast Update
0033950FPCFCLpublic2018-07-07 16:17
Reporteralex256Assigned ToMichael Van Canneyt 
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Platformx86_64-LinuxOSDebian GNU/LinuxOS Version10
Product Version3.0.4Product Build 
Target Version3.2.0Fixed in Version3.1.1 
Summary0033950: [fcl-web] Can access any file on the server if RegisterFileLocation is used.
DescriptionTFPCustomFileModule doesn't check for ".." in the path, so it can lead to the access to the files outside of the mapped directory. So, we can download any file from the server if we know its path.
Steps To ReproduceSomewhere in the server code:

RegisterFileLocation('data', './data');

We will try to download /bin/zcat. So, we should send a GET request on http://localhost:8080/data/../../../../../../../../../../../../../bin/zcat

But browsers fold such paths client-side, so we will send a request using telnet:

$ telnet localhost 8080
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /data/../../../../../../../../../../../../../bin/zcat HTTP/1.1
Host: localhost:8080

HTTP/1.1 200 OK
Status: 200 OK
Content-Length: 1937
Content-Type: Application/octet-stream

#!/bin/sh
# Uncompress files to standard output.

# Copyright (C) 2007 Free Software Foundation
...
TagsNo tags attached.
Fixed in Revision39405
FPCOldBugId
FPCTarget
Attached Files

Activities

Michael Van Canneyt

2018-07-07 13:11

administrator   ~0109264

Fixed, thanks for reporting. Please test and close if OK.

alex256

2018-07-07 15:20

reporter   ~0109268

It seems to work, but there is still possibility to check whether a specified file exists on the server by examining HTTP code (403 or 404).

Michael Van Canneyt

2018-07-07 16:06

administrator   ~0109270

Last edited: 2018-07-07 16:09

View 2 revisions

Outside the base directory, no file existence check is performed. (inverted the check)

alex256

2018-07-07 16:17

reporter   ~0109272

Thanks for fixing the bug; closing it.

Issue History

Date Modified Username Field Change
2018-07-07 10:05 alex256 New Issue
2018-07-07 11:57 Michael Van Canneyt Assigned To => Michael Van Canneyt
2018-07-07 11:57 Michael Van Canneyt Status new => assigned
2018-07-07 13:11 Michael Van Canneyt Fixed in Revision => 39404
2018-07-07 13:11 Michael Van Canneyt Note Added: 0109264
2018-07-07 13:11 Michael Van Canneyt Status assigned => resolved
2018-07-07 13:11 Michael Van Canneyt Fixed in Version => 3.1.1
2018-07-07 13:11 Michael Van Canneyt Resolution open => fixed
2018-07-07 13:11 Michael Van Canneyt Target Version => 3.2.0
2018-07-07 15:20 alex256 Note Added: 0109268
2018-07-07 15:20 alex256 Status resolved => feedback
2018-07-07 15:20 alex256 Resolution fixed => reopened
2018-07-07 16:06 Michael Van Canneyt Note Added: 0109270
2018-07-07 16:06 Michael Van Canneyt Status feedback => resolved
2018-07-07 16:06 Michael Van Canneyt Resolution reopened => fixed
2018-07-07 16:09 Michael Van Canneyt Fixed in Revision 39404 => 39405
2018-07-07 16:09 Michael Van Canneyt Note Edited: 0109270 View Revisions
2018-07-07 16:17 alex256 Note Added: 0109272
2018-07-07 16:17 alex256 Status resolved => closed