地图 / File access controls incorrectly enforced for files shared via QuickLink - Unshared files can be accessed

File access controls incorrectly enforced for files shared via QuickLink - Unshared files can be accessed

访问控制 / Unlabeled / #214001

厂商: Files.com
严重程度: 低危
赏金: $600
弱点: Unlabeled
研究员: @eboda
披露日期: 2017-04-16
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1709 字符中的一小部分）

Enter the support PIN from your test site (if applicable): **305056** Enter the name of your test site (if applicable): **pwn.brickftp.com** Enter the subdomain from your test site (if applicable): **pwn.brickftp.com**

原文中的代码

bar
foo
foobar/secret
footer.php

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Files.com 所有。

时间线

2017-03-16报告提交
2017-04-16公开披露

阅读 HackerOne 原文 ↗作者 @eboda · 版权归作者与 Files.com 所有

同类报告

Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · 2020-04-01 [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · 2020-04-01 Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointMTN Group · 2025-03-02 [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledgeMail.ru · —Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerGitHub · 2024-09-13 Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijackingSony · —

File access controls incorrectly enforced for files shared via QuickLink - Unshared files can be accessed · 破甲 POJIA