From 24c80af482c6581ec0199b6c3ae31f9ae2ee098a Mon Sep 17 00:00:00 2001 From: wzglinieckisoldevelo Date: Tue, 15 Feb 2022 15:30:08 +0100 Subject: [PATCH 1/2] OS-80: Fixed LFI issue with report generating. --- IMIS/Registers.aspx.vb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/IMIS/Registers.aspx.vb b/IMIS/Registers.aspx.vb index 98027e8b..ef9dc3f9 100644 --- a/IMIS/Registers.aspx.vb +++ b/IMIS/Registers.aspx.vb @@ -26,7 +26,6 @@ ' ' - Partial Public Class UploadICD Inherits System.Web.UI.Page @@ -384,7 +383,11 @@ Partial Public Class UploadICD Private Sub DownloadFile(path As String, contentType As String) Dim strCommand As String = "" Dim file As System.IO.FileInfo = New System.IO.FileInfo(path) - If file.Exists Then + Dim settingsPath As String = System.Configuration.ConfigurationManager.AppSettings("ExportFolder").ToString() + Debug.WriteLine(settingsPath) + ' To prevent LFI exploit check if files comes from reports folder + ' To prevent cases such as "exports\..\..\secret_file.txt" use getfullpath + If file.Exists And System.IO.Path.GetFullPath(path).Contains(settingsPath) Then strCommand = "attachment;filename=" & System.IO.Path.GetFileName(path) Response.AppendHeader("Content-Disposition", strCommand) Response.ContentType = contentType From 9bba77e415a1fc6b508f8d2491b2e4b14b9d83fb Mon Sep 17 00:00:00 2001 From: wzglinieckisoldevelo Date: Tue, 15 Feb 2022 15:58:58 +0100 Subject: [PATCH 2/2] Removed redundant WriteLine. --- IMIS/Registers.aspx.vb | 1 - 1 file changed, 1 deletion(-) diff --git a/IMIS/Registers.aspx.vb b/IMIS/Registers.aspx.vb index ef9dc3f9..f4ce9ec0 100644 --- a/IMIS/Registers.aspx.vb +++ b/IMIS/Registers.aspx.vb @@ -384,7 +384,6 @@ Partial Public Class UploadICD Dim strCommand As String = "" Dim file As System.IO.FileInfo = New System.IO.FileInfo(path) Dim settingsPath As String = System.Configuration.ConfigurationManager.AppSettings("ExportFolder").ToString() - Debug.WriteLine(settingsPath) ' To prevent LFI exploit check if files comes from reports folder ' To prevent cases such as "exports\..\..\secret_file.txt" use getfullpath If file.Exists And System.IO.Path.GetFullPath(path).Contains(settingsPath) Then