Zrlog Backup SQL File Plugin Directory Traversal Vulnerability

A directory traversal vulnerability has been identified in the Zrlog backup-sql-file plugin, version 3.0.31. This vulnerability allows remote attackers to access sensitive information by exploiting the BackupController.java file. The issue arises because the file parameter is not properly sanitized, enabling arbitrary file downloads.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, potentially including environment variables or other critical information.

Reproduction

To reproduce this vulnerability, send a request to the '/admin/plugins/backup-sql-file/downfile' endpoint with a crafted file parameter that includes directory traversal sequences. The server will respond with the contents of the specified file, bypassing normal file access restrictions.

Remediation

Users are advised to update to version 3.0.32 of the Zrlog backup-sql-file plugin, which addresses the directory traversal vulnerability by sanitizing user input to prevent unauthorized file access.