FirstBlood-#450 — [COLLAB with isitbug] Blind LFI on /api/checkproof.php
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-25, shreky reported:
On the endpoint /api/checkproof.php via the
proofparameter it's possible to enumerate files on the local machine such as /etc/passwd, /var/log/nginx/access.log,etc.
Steps to reproduce
- Notice it returns true
- If for example you do
/api/checkproof.php?proof=blablablait will return false
Blind LFI leading to enumeration of files on the local machine.
Existant file -->
Non-Existant file -->
FirstBlood ID: 42
Vulnerability Type: Information leak/disclosure
The endpoint /api/checkproof.php can be used to check if an arbitrary file path exists on the server. There is no real impact from this and it's not something we intentionally added as an issue so this won't count towards a unique finding.