MineAdmin Information Disclosure Vulnerability in downloadById Function

A vulnerability allowing arbitrary file download has been identified in MineAdmin versions 1.x and 2.x. This issue arises in the downloadById function, where manipulating the ID parameter can lead to unauthorized access to sensitive information. The vulnerability can be exploited remotely, and while the exploitation is considered complex, a public proof-of-concept is available.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive information, as the vulnerability involves arbitrary file download.

Reproduction

To reproduce this vulnerability, send a GET request to the /system/downloadById endpoint with an ID parameter. The ID should be an auto-incrementing number, which can be enumerated to download multiple files in bulk.

Remediation

It is recommended to strengthen permission validation at the system/downloadById interface.