elecV2 elecV2P Path Traversal Vulnerability in Wildcard Handler Log Function

A path traversal vulnerability has been identified in elecV2 elecV2P versions through 3.8.3. The issue arises in the Wildcard Handler component, specifically within the function that handles log file requests. The vulnerability allows for arbitrary file reading by exploiting the path.join function to escape the intended log directory. This issue can be exploited remotely without authentication, and has been publicly disclosed along with a proof-of-concept exploit.

Impact

Exploitation of this vulnerability allows for path traversal, enabling unauthorized access to the file system. This has been demonstrated by reading the /etc/passwd file.

Reproduction

The vulnerability can be reproduced by sending a GET request to the /log/ endpoint with a URL-encoded payload that includes ../ sequences. This payload escapes the logs directory and accesses arbitrary files on the server.