FirstBlood-#450 — [COLLAB with isitbug] Blind LFI on /api/checkproof.php
This issue was discovered on FirstBlood v2
On 2021-10-25, shreky Level 5 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Summary
On the endpoint /api/checkproof.php via the proof parameter it's possible to enumerate files on the local machine such as /etc/passwd, /var/log/nginx/access.log,etc.
Steps to reproduce
- Access
/api/checkproof.php?proof=/etc/passwd
- Notice it returns true
- If for example you do
/api/checkproof.php?proof=blablabla it will return false
Impact
Blind LFI leading to enumeration of files on the local machine.
Existant file -->
Non-Existant file -->
P4 Low
Endpoint: /api/checkproof.php
Parameter: proof
Payload: /etc/passwd
FirstBlood ID: 42
Vulnerability Type: Information leak/disclosure
The endpoint /api/checkproof.php can be used to check if an arbitrary file path exists on the server. There is no real impact from this and it's not something we intentionally added as an issue so this won't count towards a unique finding.