[HDDS-2110] Arbitrary file can be downloaded with the help of ProfilerServlet

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.5.0
• Component/s: Native
• Labels: pull-request-available
• Target Version/s: 0.4.1
• Flags: Patch, Important
• External issue URL: https://github.com/apache/hadoop/blob/217bdbd940a96986df3b96899b43caae2b5a9ed2/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/server/ProfileServlet.java
• Assignee: Marton Elek
• Reporter: Aayush
• Created: 11/Sep/19 12:18
• Updated: 24/Feb/20 20:51
• Resolved: 19/Sep/19 16:44

Description

The LOC 324 in the file ProfileServlet.java is prone to an arbitrary file download:-

protected void doGetDownload(String fileName, final HttpServletRequest req,      final HttpServletResponse resp) throws IOException {

File requestedFile = ProfileServlet.OUTPUT_DIR.resolve(fileName).toAbsolutePath().toFile();

As the String fileName is directly considered as the requested file.

 

Which is called at LOC 180 with HTTP request directly passed:-

if (req.getParameter("file") != null) {      doGetDownload(req.getParameter("file"), req, resp);      
return;    
}

 

Issue Links

• links to: GitHub Pull Request #1448