Vulnerability Report:Unauthenticated LFI/SSRF via file_get_content() function

Description

Local File Inclusion is a web vulnerability that results from mistakes at the website or web application programmers’ end. A hacker can take advantage of this vulnerability to include malicious files which are then executed by the vulnerable website or web application.In an LFI vulnerability, the included file is already present on the local application server, targeted by the hacker. If successful, the attacker can read important files, access more sensitive information, or run arbitrary commands.

A Server-Side Request Forgery (SSRF) attack involves an attacker abusing server functionality to access or modify resources. The attacker targets an application that supports data imports from URLs or allows them to read data from URLs. URLs can be manipulated, either by replacing them with new ones or by tampering with URL path traversal.

Root Cause

The file at media/js/freeboard/plugins/datasources/getcontent/getcontent.php takes the input in URL parameter and passes it directly to file_get_content() which as a result causes this vulnerability allowing attacker to retrieve internal files (LFI), make requests to internal services via the server which leads to remote code execution on cloud instances via metadata retrieval (SSRF).

Severity: Critical

CVSS Score: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Steps to reproduce

1. Install Joomla 3 and install the JC Dashboards extension
2. Once done visit the following URL in private window http://192.168.1.21/media/com_jcdashboards/js/freeboard/plugins/datasources/getcontent/getcontent.php?url=file:///etc/passwd
3. Response will leak the passwd file of the server

I have attached the video/image proof of concepts (POCs) below

Thank you Vishal,

We will look into this and make the changes.

Regards
Paul
JoomCode Admin

Nice, Thanks and have a nice day ahead

Hi Vishal this has been resolved.
Many thanks for catching this.
The update can be found here
joomcode.com/index.php/download/category/7-jc-dashboards

Regards
Paul

Wow Cool, Thanks for the update. just confirming if this is eligible for any reward ?

Hi Vishal,
Once you are happy with the changes, it would be appreciated if you could confirm with JED so they can close your bug report and reinstate the listing on JED.
In exchange for all of this, we would be happy to give you a free PRO version as a thank you for your efforts.
Many thanks,
Regards
Paul