Gin-Vue-Admin Arbitrary File Deletion Vulnerability

An arbitrary file deletion vulnerability exists in Gin-Vue-Admin versions prior to 2.8.7. This issue allows attackers to delete any file or folder on the server by manipulating the 'FileMd5' parameter, leading to potential damage or disruption of server resources.

Impact

Exploitation of this vulnerability allows for the arbitrary deletion of files and directories on the server, which can cause damage to the system or disrupt the availability of server resources.

Reproduction

To reproduce this vulnerability, send a request to the '/api/fileUploadAndDownload/removeChunk' endpoint with a payload that includes the 'FileMd5' parameter set to the path of the file or directory to be deleted. The request must include a valid user token in the 'x-token' header.

Remediation

Users are advised to update to Gin-Vue-Admin version 2.8.7 or later, where this vulnerability has been patched.