File download vulnerability

1 cause of loophole

The reason for downloading arbitrary vulnerabilities is that general websites provide the function of downloading files, but there is no filtering when obtaining files to download files, which leads to vulnerabilities.

The site download address is similar to the https://www.test.com/upload/xiazai.php?file=/wenjian/123.doc format site may exist, because the file name is passed in as a parameter. If the download address is in http://www.test.com/upload/wenjian/123.doc format and the file name is passed in without parameters, there is no file download vulnerability.

2 vulnerability exploitation

You can't know what level of directory it is during the download process, so you can try it one by one with. /.. /. Download vulnerabilities to download some website source files for analysis, layer by layer analysis, and finally find relevant sensitive files through vulnerabilities to download, such as database connection files, phpinfo files, database files, server accounts and password files and so on.

3 vulnerability repair methods

1. Filter the parameters downloaded by the incoming file name. You can use whitelist or blacklist

2. Will. Filter, so that you cannot use the function of returning to the parent directory.. /

3. Access permissions can be set in open_basedir