Unauthenticated path traversal / arbitrary file read via files/download?file=
/files/downloadAttack Path
Business Impact
An unauthenticated remote attacker can exfiltrate any file readable by the web server, including application source code, Apache configuration, and any credentials or secrets stored on disk, exposing business logic and enabling further attacks against the infrastructure. Combined with the demonstrated SSTI RCE on /templates/preview, this flaw accelerates full host compromise and potential lateral movement. Disclosure of customer-facing systems and sensitive configuration could result in data breaches, regulatory exposure, and loss of customer trust.
Description
The file GET parameter of /files/download is passed directly into a filesystem read used to stream the download attachment, with no path traversal sanitization or allowlist check. Because the value is only prepended to a base directory under /app/[REDACTED-PATH] an unauthenticated attacker can supply relative sequences like ../../../../etc/passwd to read any file accessible to the web server user. The read primitive is fully proven, and absolute paths or ....// filter-evasion variants fail only because no stripping or rewriting occurs - paths are read verbatim.
Proof of Concept
Setup
No authentication required - public GET endpoint normally serving catalog.pdf ("QuickShop Product Catalog 2024").
Exploit
GET /files/download?file=../../../../etc/passwd HTTP/1.1
Host: storefront.example
Verification
Response is 200 OK with Content-Disposition: attachment; filename="passwd" and the complete /etc/passwd contents:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
Baseline control: files/download?file=catalog.pdf returns Content-Disposition: attachment; filename="catalog.pdf" with "QuickShop Product Catalog 2024". Same traversal also read /etc/hostname (d72dde63f9db) and the full /etc/apache2/apache2.conf (3KB config disclosed, revealing ${APACHE_DOCUMENT_ROOT} = /app/[REDACTED-PATH] and the <FilesMatch "^\.ht"> block).
Observed Behavior
file=../../../../etc/passwd streamed the passwd file with status 200 and a Content-Disposition attachment header, and the same traversal also read /etc/hostname and the full Apache configuration. Path-evasion variants, absolute paths, command-injection probes, and SSRF URLs all failed, confirming this is a pure filesystem read sink reached only via relative traversal from the base directory.
Attack Scenarios
- 1
An unauthenticated attacker downloads any www-data-readable file on the host, including application PHP source code under /app/[REDACTED-PATH] Apache configuration files, and environment or credential files.
- 2
The attacker combines the arbitrary file read with the SSTI RCE on /templates/preview to achieve full host compromise.
Triage & Management
Validation Status
Exploitability
Asset Information
Anonymized staging evaluation. Explore the full detail view; management actions are available in your own workspace.
Find issues in your app