GoldPanKit Eva-Server Arbitrary File Download Vulnerability

An arbitrary file download vulnerability has been identified in GoldPanKit Eva-Server version 4.1.0. The issue arises in the '/api/resource/local/download' endpoint, where the 'path' parameter can be manipulated to download arbitrary files from the server.

Impact

Exploitation of this vulnerability allows for arbitrary file download, potentially leading to exposure of sensitive information.

Reproduction

To reproduce this vulnerability, log into the application and access the '/api/resource/local/download' endpoint. Include a crafted 'path' parameter that traverses directories, such as '../../../../etc/passwd', to download the targeted file.

Remediation

Ensure that the 'path' parameter is validated to prevent directory traversal attacks.