Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in Owlfiles File Manager version 12.0.1. It occurs because the application does not properly sanitize user input in the 'path' parameter of its HTTP server endpoints, specifically the 'download' and 'list' endpoints. Attackers can craft malicious URLs containing script tags in this parameter, which when accessed by users, execute arbitrary JavaScript code in their browsers. [1, 4]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser when they access a crafted URL. This can lead to malicious actions such as stealing session tokens, redirecting users to malicious sites, or performing actions on behalf of the user without their consent. Additionally, combined with other vulnerabilities in Owlfiles File Manager, attackers may access sensitive system files and directories, increasing the security risk on affected devices. [1, 4]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the HTTP server endpoints for reflected cross-site scripting (XSS) via the 'path' parameter. You can craft URLs targeting the download and list endpoints with embedded script tags, such as: http://<target>:<port>/download?path=<script>alert(1)</script> or http://<target>:<port>/list?path=<script>alert(1)</script>. If the script executes in the browser, the vulnerability is present. Additionally, you can check for path traversal and local file inclusion by sending HTTP GET requests like: GET /../../../../../../../../../../../../../../../etc/hosts HTTP/1.1 to see if sensitive files are accessible. For FTP, commands like 'cd ../../../../../../../../../' followed by 'ls' can reveal directory traversal issues. [1, 4]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Owlfiles File Manager HTTP and FTP servers to trusted networks or users, disabling the built-in HTTP and FTP servers if not needed, and avoiding clicking on or accessing URLs with suspicious or untrusted 'path' parameters. Applying input validation and sanitization on the 'path' parameter to prevent script injection is critical. If possible, update to a fixed version of the software once available or apply vendor-provided patches. Monitoring and blocking suspicious requests targeting the 'download' and 'list' endpoints can also help reduce risk. [1, 4]

Useful 0 Not Useful 0