KnowAgent is vulnerable to Information Disclosure, and it results to attackers can read arbitrary files.
Open
- Dominant language
- Java
- Stars
- 279
- Forks
- 76
- PR merge metrics
- No merged PRs in 30d
Description
1) When I study the source code of KnowAgent, the file-content route in NormalLogCollectTaskController.java gets my attention. It seems to be a file read function.
2）Then I access the route via http request. It is a vulnerability which leads to an arbitrary file reading.
The request URL is http://116.85.4.122:9010/api/v1/normal/collect-task/file-content?hostName=127.0.0.1&path=/etc/passwd
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.