Summary

The "resources" widget, enabled by default in the configuration, contains an API endpoint /api/widgets/resources with the query parameter ?type=disk that is vulnerable to Arbitrary Path Existence Disclosure. An unauthenticated user can determine whether any file or directory exists on the server's filesystem. This information leak may aid further attacks.

Details

The endpoint /api/widgets/resources accepts requests with the query parameter ?type=disk&target=<path>. When the specified path exists, the server responds with disk information associated with that path. If the path does not exist, the server responds with:

{"error":"Target not found"}

This discrepancy in responses allows an attacker to probe the server and infer the existence of arbitrary files and directories anywhere in the filesystem.

PoC

1. Send a request to the vulnerable endpoint for a known existing path:

GET /api/widgets/resources?type=disk&target=/etc/passwd

Response shows disk information.

2. Send a request to the same endpoint for a non-existing path:

GET /api/widgets/resources?type=disk&target=/nonexistent/path

Response: {"error":"Target not found"}

Impact

This is an Arbitrary Path Existence Disclosure vulnerability. Any unauthenticated user can probe the filesystem and learn whether specific files or directories exist, which could facilitate targeted attacks, reconnaissance, or exploitation of other vulnerabilities.