Skip to content

Vulnerability: Arbitrary file upload in lsFusion ≤ 6.1 #1544

@R1ckyZ

Description

@R1ckyZ

BUG_Author: R1ckyZ

Affected Version: lsFusion ≤ 6.1

Vendor: lsfusion GitHub Repository

Software: lsfusion

Vulnerability Files:

  • platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java

Description:

Accessing the /uploadFile API invokes the handleRequest method in UploadFileRequestHandler. This method accepts an unvalidated sid parameter, which is directly appended to FileUtils.APP_UPLOAD_FOLDER_PATH. Additionally, there are no restrictions on the uploaded filename. When combined with directory traversal, this allows an attacker to upload JSP files to a web-accessible directory, leading to client-side file upload–based remote code execution (RCE).

Image

Proof of Concept:

  1. Access the API /uploadFile, upload shell.jsp, and pass the sid to the directory you have traversed.
Image
  1. Access and exploit the generated file _shell.jsp.
Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions