BUG_Author: xuanSAMA

Affected Version: MoneyPrinterTurbo ≤ 1.2.6

Vendor: MoneyPrinterTurbo GitHub Repository

Software: MoneyPrinterTurbo

Vulnerability Files:

• app/controllers/v1/video.py

Description:

1. Path Traversal Vulnerability:

   • In the file app/controllers/v1/video.py, both the download_video and stream_video functions receive a file_path from the URL. This user-provided input is not properly sanitized before being used to construct a file path on the server.

2. Exploiting the Vulnerability:

   • By manipulating the file_path variable with "dot-dot-slash (../)" sequences or by providing an absolute file path, an attacker can access arbitrary files and directories stored outside the intended web root folder. This could include sensitive data such as application source code, configuration files, and critical system files like /etc/passwd.

3. Example Path Traversal Payload:

   • The following payload can be used to read the /etc/passwd file from the server:

     //etc/passwd
     
     

4. Requesting the Vulnerable Endpoints:

   • An attacker can make a direct request to the vulnerable endpoints with the malicious payload in the URL. Both of the following endpoints are affected:

     • Download Endpoint:

       http://<target-ip>:<port>/api/v1/download//etc/passwd
       
       

     • Stream Endpoint:

       http://<target-ip>:<port>/api/v1/stream//etc/passwd
       
       

5. Verifying the Exploit:

   • If the attack is successful, the server will respond with the contents of the requested file (e.g., /etc/passwd). Depending on the endpoint used, the user's browser will either prompt to download the file or attempt to stream its content. This confirms that an attacker can read arbitrary files from the filesystem.

Proof of Concept:

1. Ensure the vulnerable version of the MoneyPrinterTurbo application is running.

2. Open a web browser or use a command-line tool like curl to make requests to the vulnerable endpoints.

3. Use the following URLs, replacing <target-ip>:<port> with the actual address of the application:

   • To test the download endpoint:

     http://<target-ip>:<port>/api/v1/download//etc/passwd
     
     

   • To test the stream endpoint:

     http://<target-ip>:<port>/api/v1/stream//etc/passwd
     

4. If the vulnerability is present, the application will serve or stream the /etc/passwd file, confirming the path traversal flaw.