Description
Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| izhaorui | Zr.Admin.NET | — | — |
References
- https://vul.yulun.ac.cn/20261114/zr-admin-net/ third-party-advisory
- https://github.com/izhaorui/Zr.Admin.NET/issues/27 issue-tracking
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/CommonController.cs#L220-L241 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/Infrastructure/Controllers/BaseController.cs#L110-L119 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/commit/0ee1ab8af5e3861766746d25acba1184111befcb technical-description patch
- VulnCheck Advisory: Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile third-party-advisory