FirstBlood-#502Enumerating files/directories and tools/binaries installed on FirstBlood server
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-25, newrouge Level 3 reported:

Hey, while uploading vaccine certificate i noticed that endpoint https://4322a93f810b-newrouge.a.firstbloodhackers.com/api/checkproof.php?proof=/app/firstblood/upload/1d45306b7dadba6757e845c47e92fa2016d2ac2e.png .

  • Here proof parameter is seems to check if file exist on server or not.
  • But it can be abused to enumerate which binaries ,files or tools are installed or which directories are present on server.

e.g

?proof.php=/etc/hostname => returns true ,file exist

?proof.php=/bin/bash => return true, binary exist

?proof.php=/var/www/html => return true , directory exist

?proof.php=/etc/apache2/httpd. conf => returns false, makes sense server is using NGINX so why would apache files be there.

?proof.php=/etc/nginx => return true, right.

POC

Thank you

newrouge

P4 Low

Endpoint: /api/checkproof.php

Parameter: ?proof=

Payload: /etc/hosts /bin/bash


FirstBlood ID: 42
Vulnerability Type: Information leak/disclosure

The endpoint /api/checkproof.php can be used to check if an arbitrary file path exists on the server. There is no real impact from this and it's not something we intentionally added as an issue so this won't count towards a unique finding.