Snowy 3.6.5 Hard-coded Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download Vulnerability Overview In Snowy version 3.6.5, a hard-coded download signature key allows unauthorized file downloads. Scope of Impact Snowy version 3.6.5 Remediation Upgrade to the latest version. Modify the hard-coded download signature key. POC Code ```java package com.snowy.common.utils; import com.snowy.common.constant.SnowyConstants; import com.snowy.common.utils.DateUtils; import com.snowy.common.utils.StringUtils; import com.snowy.common.utils.file.FileUploadUtils; import com.snowy.common.utils.file.FileUploadUtils.ExcType; import com.snowy.common.utils.file.MimeTypeUtils; import com.snowy.framework.config.SnowyConfig; import com.snowy.framework.web.service.TokenService; import com.snowy.system.domain.SysConfig; import com.snowy.system.service.ISysConfigService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Component; import org.springframework.web.multipart.MultipartFile; import javax.servlet.http.HttpServletRequest; import java.io.File; import java.io.IOException; import java.util.Arrays; import java.util.HashMap; import java.util.List; import java.util.Map; / File processing utility class @author Snowy / @Component public class FileUploadUtils { / Default size 50M / public static final long DEFAULT_MAX_SIZE = 50 1024 1024L; / Default maximum filename length 100 / public static final int DEFAULT_FILE_NAME_LENGTH = 100; / Default upload address / private static String defaultBaseDir = SnowyConfig.getProfile(); @Autowired private ISysConfigService configService; / Upload file using default configuration @param file File to upload @return Filename @throws Exception / public final static String upload(MultipartFile file) throws IOException { try { return upload(getDefaultBaseDir(), file, MimeTypeUtils.DEFAULT_ALLOWED_EXTENSION); } catch (Exception e) { throw new IOException(e.getMessage(), e); } } / Upload based on file path @param baseDir Relative base directory of the application @param file File to upload @return Filename @throws IOException / public final static String upload(String baseDir, MultipartFile file) throws IOException { try { return upload(baseDir, file, MimeTypeUtils.DEFAULT_ALLOWED_EXTENSION); } catch (Exception e) { throw new IOException(e.getMessage(), e); } } / File upload @param baseDir Relative base directory of the application @param file File to upload @param allowedExtension Allowed file types @return Returns the filename of the successfully uploaded file @throws IOException For example, when there is an error reading/writing files / public final static String upload(String baseDir, MultipartFile file, String[] allowedExtension) throws FileUploadException, IOException { int fileNamelength = file.getOriginalFilename().length(); if (fileNamelength > SnowyConstants.FILE_NAME_MAX_LENGTH) { throw new FileUploadException("Filename cannot exceed " + SnowyConstants.FILE_NAME_MAX_LENGTH + " characters."); } assertAllowed(file, allowedExtension); String fileName = extractFilename(file); String absPath = getAbsoluteFile(baseDir, fileName).getAbsolutePath(); file.transferTo(new File(absPath)); return getPathFileName(baseDir, fileName); } / Encode filename / public final static String extractFilename(MultipartFile file) { return StringUtils.format("{}/{}_{}.{}", DateUtils.datePath(), FilenameUtils.getBaseName(file.getOriginalFilename()), Seq.getId(Seq.uploadSeqType), getExtension(file)); } public static String getPathFileName(String baseDir, String fileName) throws Exception { int dirLastIndex = SnowyConfig.getProfile().length() + 1; String currentDir = StringUtils.substring(baseDir, dirLastIndex); return SnowyConfig.getDownloadPath() + currentDir + "/" + fileName; } / File size validation @param file File to upload @return @throws FileUploadException / public final static void assertAllowed(MultipartFile file, String[] allowedExtension) throws FileUploadException { long size = file.getSize(); if (size > DEFAULT_MAX_SIZE) { throw new FileUploadException("File size cannot exceed " + DEFAULT_MAX_SIZE / 1024 / 1024 + "M."); } String fileName = file.getOriginalFilename(); String extension = getExtension(file); if (allowedExtension != null && !isAllowedExtension(extension, allowedExtension)) { if (allowedExtension == MimeTypeUtils.IMAGE_EXTENSION) { throw new FileUploadException("Uploading file type " + extension + " is not allowed."); } if (allowedExtension == MimeTypeUtils.VIDEO_EXTENSION) { throw new FileUploadException("Uploading file type " + extension + " is not allowed."); } if (allowedExtension == MimeTypeUtils.AUDIO_EXTENSION) { throw new FileUploadException("Uploading file type " + extension + " is not allowed."); } throw new FileUploadException("Uploading file type " + extension + " is not allowed."); } } / Determine if the MIME type is an allowed MIME type @param extension @param allowedExtension @return / public final static boolean isAllowedExt

Goal Reached Thanks to every supporter — we hit 100%!

Snowy 3.6.5 Hard-coded Signature Key Allows Unauthenticated File Download

More from this source