Enumerating files/directories and tools/binaries installed on FirstBlood server

FirstBlood-#502 — Enumerating files/directories and tools/binaries installed on FirstBlood server
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-25, newrouge Level 3 reported:


Hey, while uploading vaccine certificate i noticed that endpoint https://4322a93f810b-newrouge.a.firstbloodhackers.com/api/checkproof.php?proof=/app/firstblood/upload/1d45306b7dadba6757e845c47e92fa2016d2ac2e.png . 

Here proof parameter is seems to check if file exist on server or not.
But it can be abused to enumerate which binaries ,files or tools are installed or which directories are present on server.

e.g 
?proof.php=/etc/hostname => returns true ,file exist
?proof.php=/bin/bash => return true, binary exist
?proof.php=/var/www/html => return true , directory exist
?proof.php=/etc/apache2/httpd. conf => returns false, makes sense server is using NGINX so why would apache files be there.
?proof.php=/etc/nginx => return true, right.
POC

Thank you
newrouge

This report has been publicly disclosed for everyone to view

P4 Low

Endpoint: /api/checkproof.php

Parameter: ?proof=

Payload: /etc/hosts /bin/bash

FirstBlood ID: 42
Vulnerability Type: Information leak/disclosure

The endpoint /api/checkproof.php can be used to check if an arbitrary file path exists on the server. There is no real impact from this and it's not something we intentionally added as an issue so this won't count towards a unique finding.

BugBountyHunter