[GH-ISSUE #623] Security vulnerability in File Manager Download function #380

New issue

Closed

opened 2026-02-27 15:50:07 +03:00 by kerem · 2 comments

kerem commented

2026-02-27 15:50:07 +03:00

Owner

Originally created by @MaxXor on GitHub (Oct 9, 2017).
Original GitHub issue: https://github.com/quasar/Quasar/issues/623

Originally assigned to: @MaxXor on GitHub.

There exists a security vulnerability in the File Manager Download function which can be only exploited when the File Manager Window in the Server is opened (needs to be the Window on the malicious Client). If the File Manager Window is closed then it's not exploitable.

By modifying the Filename to a path like ..\..\file in DoDownloadFileResponse Client packet the Server will accept the file download and place the file outside of the download directory.

Affected versions: v1.0.0.0 - 1.3.0.0

Originally created by @MaxXor on GitHub (Oct 9, 2017). Original GitHub issue: https://github.com/quasar/Quasar/issues/623 Originally assigned to: @MaxXor on GitHub. There exists a security vulnerability in the File Manager Download function which can be **only** exploited when the File Manager Window in the Server is opened (needs to be the Window on the malicious Client). If the File Manager Window is closed then it's not exploitable. By modifying the Filename to a path like `..\..\file` in DoDownloadFileResponse Client packet the Server will accept the file download and place the file outside of the download directory. Affected versions: _v1.0.0.0 - 1.3.0.0_

kerem

2026-02-27 15:50:07 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-27 15:50:07 +03:00

Author

Owner

@ViCrack commented on GitHub (Apr 17, 2018):

对于这个目录回溯的漏洞，在HandleGetKeyloggerLogsResponse方法中也可能有类似的情况出现，
比如获取日志文件的名称04-17-2018中包含..\..\。

For loopholes in this directory, a similar situation may occur in the HandleGetKeyloggerLogsResponse method.For example, get the name of the log file 04-17-2018 contains ..\..\

@ViCrack commented on GitHub (Apr 17, 2018): 对于这个目录回溯的漏洞，在`HandleGetKeyloggerLogsResponse`方法中也可能有类似的情况出现，比如获取日志文件的名称04-17-2018中包含`..\..\`。 For loopholes in this directory, a similar situation may occur in the `HandleGetKeyloggerLogsResponse `method.For example, get the name of the log file 04-17-2018 contains `..\..\`

kerem commented

2026-02-27 15:50:07 +03:00

Author

Owner

@MaxXor commented on GitHub (Apr 17, 2018):

@ViCrack Thanks for reporting this, I'll check it.

edit: Fixed, thank you! 👍

@MaxXor commented on GitHub (Apr 17, 2018): @ViCrack Thanks for reporting this, I'll check it. edit: Fixed, thank you! :+1: