javahongxi whatsmars Path Traversal Vulnerability in InitializrController

A path traversal vulnerability has been identified in javahongxi whatsmars version 2021.4.0. The issue arises in the InitializrController, specifically within the initialize function. The vulnerability allows for remote exploitation by manipulating the artifactId parameter, which can lead to unauthorized access to files on the server.

Impact

Exploitation of this vulnerability allows for path traversal, enabling attackers to access arbitrary files on the server, particularly those ending in .tar.

Reproduction

To reproduce this vulnerability, send a request to the /project endpoint of the whatsmars-initializr subproject. Include a crafted artifactId parameter that exploits the lack of proper path validation. This will trigger the path traversal vulnerability, allowing access to restricted files on the server.