KnowAgent is vulnerable to Information Disclosure, and it results to attackers can read arbitrary files.

Open
#40 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
java
Domain
api, backend, security

Research direction

Start by reading NormalLogCollectTaskController.java and inspect the file-content route described in the issue. Reproduce the reported request only in a safe local environment, then trace how hostName and path are handled. Done means the route no longer permits arbitrary file disclosure, with a regression test covering the reported case.

Written by the indexing model from the issue text.

Description

  1. When I study the source code of KnowAgent, the file-content route in NormalLogCollectTaskController.java gets my attention. It seems to be a file read function.
    image
    2）Then I access the route via http request. It is a vulnerability which leads to an arbitrary file reading.
    The request URL is http://116.85.4.122:9010/api/v1/normal/collect-task/file-content?hostName=127.0.0.1&path=/etc/passwd
    image
Dominant language
Java
Stars
279
Forks
76
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from didi/KnowAgent

All issues in didi/KnowAgent

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.