Vulnerability: Unauthorized Arbitrary File Read in lsFusion ≤ 6.1

[R1ckyZ]

BUG_Author: R1ckyZ

Affected Version: lsFusion ≤ 6.1

Vendor: lsfusion GitHub Repository

Software: lsfusion

Vulnerability Files:

• web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java

Description:

The API /file/static/noauth/** is used to download logos and icons without authentication. The handleRequest method in DownloadFileRequestHandler supports a version parameter. While the /** path component is validated, if an attacker directly accesses /file/static/noauth (without a trailing path), the filename is derived solely from the unvalidated version parameter. The generated fileName is then directly appended to FileUtils.APP_DOWNLOAD_FOLDER_PATH, leading to arbitrary file read vulnerabilities.

Proof of Concept:

1. Requesting the API /file/static/noauth and passing a directory traversal payload to the version parameter.