CVE-2024-33863

Vulnerability

A local file inclusion vulnerability exists in linqi for Windows versions prior to 1.4.0.1 in the /api/Cdn/GetFile endpoint. The endpoint does not properly validate user-supplied paths, allowing an attacker to include arbitrary files from the server's file system.

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the /api/Cdn/GetFile endpoint with a malicious path parameter containing directory traversal sequences (e.g., ../). No authentication is required, as the endpoint is publicly accessible. The attacker must have network access to the linqi server.

Impact

Successful exploitation allows an attacker to read arbitrary files on the server, including configuration files, application source code, and other sensitive data. This leads to information disclosure and could further compromise the server.

Mitigation

The vulnerability has been resolved in linqi version 1.4.0.1 [2]. Users should update to this version immediately. No workarounds are available.