Unauthenticated LFI Exposed Files and Credentials on a Travel Company’s Server
Summary
CloudSEK says its BeVigil scanner found unauthenticated LFI endpoints on a travel-industry subdomain that could expose server files, source code, credentials, and configuration data.
Key points
- The vulnerable application exposed unauthenticated `readfile?path=` and `loaddata?path=` endpoints without adequate input validation.
- The endpoints reportedly enabled recursive directory listings and arbitrary file reads across the server.
- Exposed files could include SSH authorization data, source code, deployment scripts, configuration files, credentials, API tokens, and internal service URLs.
- CloudSEK says the findings could enable credential theft, privilege escalation, and further unauthorized access.
- Recommended mitigations include removing or refactoring the endpoints, validating paths, restricting file-system permissions, disabling directory listings, rotating exposed credentials, and monitoring access.
Article Details
- Attack Vectors
- Unauthenticated manipulation of the readfile?path= and loaddata?path= endpoints could enable directory listing and arbitrary file reads across the server.
- Exposed files could contain source code, configuration data, deployment scripts, hardcoded credentials, API tokens, and internal service URLs.
- Defensive Notes
- Remove or refactor dynamic file-access endpoints and strictly validate inputs and permitted paths.
- Apply least-privilege file-system permissions and disable directory listing.
- Rotate and revoke exposed credentials, use secure secret management, and enable logging and monitoring.
MITRE ATT&CK
T1005 · Data from Local SystemThe loaddata endpoint could expose local files, including source code, configuration files, and other sensitive server data.T1083 · File and Directory DiscoveryThe vulnerable readfile endpoint could provide recursive directory listings, allowing attackers to browse the server's directory structure.T1552.001 · Credentials In FilesFiles accessible through the vulnerable endpoints could contain hardcoded credentials, database connection strings, and API tokens.