LFI bug in /api/get_file
Closed this issue · 1 comments
adrgs commented
verify_jwt does not check that the subdomain contains only characters from SUBDOMAIN_ALPHABET. This allows an attacker that gets the JWT key to set a subdomain like ../../../../etc/passwd and read internal files in the Docker container.