MineAdmin Information Disclosure Vulnerability in getFileInfoById Function

A vulnerability allowing arbitrary file read has been identified in MineAdmin versions 1.x and 2.x. The issue arises in the file '/system/getFileInfoById', where manipulation of the 'id' parameter leads to unauthorized information disclosure. This vulnerability can be exploited remotely and involves a high level of complexity. Exploitation is considered difficult, but a public proof-of-concept is available.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive information, such as file hashes, which could be used to preview or download files through other system interfaces.

Reproduction

To reproduce this vulnerability, send a GET request to the '/system/getFileInfoById' endpoint with an 'id' parameter value that corresponds to an existing file ID. The response will include file information that can be used to access the file through the '/system/showFile' or '/system/downloadByHash' interfaces.

Remediation

It is recommended to strengthen permission validation on the '/system/getFileInfoById', '/system/showFile', and '/system/downloadByHash' interfaces.