fix: Patch for Arbitrary file read vulnerability

[junorouse]

Arbitrary file read vulnerability (Only working on Windows os)

Date: 26 September 2019 .
Author: Woowon Kang (@wooeong2) / Juno Im (@junorouse) from Theori

Summary

Attacker can read arbitrary files on webpagetest servers running on Windows OS.

Trigger / Exploit

• https://github.com/WPO-Foundation/webpagetest/blob/master/www/getfile.php#L9

    $file = $_REQUEST['file'];
    if (preg_match('/[a-zA-Z0-9_\-]+\.(?P<ext>png|jpg|txt|zip|csv|mp4)/i', $file, $matches)) {

Rules does not have $ symbol, attacker can bypass with a.jpg\..\..\..\..\..\..\..\{Arbitrary File}.
Windows OS ignores not existing folder

Recommendation / Patch

- if (preg_match('/[a-zA-Z0-9_\-]+\.(?P<ext>png|jpg|txt|zip|csv|mp4)/i', $file, $matches)) {
+ if (preg_match('/[a-zA-Z0-9_\-]+\.(?P<ext>png|jpg|txt|zip|csv|mp4)$/i', $file, $matches)) {

[pmeenan]

Thanks for the fix!