Local File Disclosure in InnoShop via AI Core MCP

Executive Summary

InnoShop 0.9.2 has a local file disclosure vulnerability where authenticated administrators with files_create permission can read server files by abusing the AI Core MCP file_upload tool. The tool's source argument accepts file:// or php:// stream wrappers, which are passed to file_get_contents() without validation. This allows reading sensitive files like .env containing APP_KEY and database credentials, which are then stored on the public media disk for access.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file uploads in the media directory, especially files with unusual extensions or names. Inspect server logs for requests to the AI Core MCP file_upload tool with file:// or php:// stream wrappers in the source parameter. Look for files containing sensitive data like .env contents.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrative access and files_create permission could read sensitive server files, including configuration files with credentials. This could lead to data breaches, unauthorized database access, or further exploitation of the system. The vulnerability also introduces potential SSRF risks if the source parameter is misused to access internal services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of database credentials or configuration files may result in non-compliance, potential fines, and reputational damage due to data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict the source parameter in the file_upload tool to only accept http or https schemes. Remove files_create permission from non-admin users. Update to the latest InnoShop version if available. Monitor media directory for suspicious files and block external access to sensitive paths.

Useful 0 Not Useful 0