Lokale Datei-Inklusion in netease-youdao/qanything

The primary impact of CVE-2024-12866 is the unauthorized disclosure of sensitive data. An attacker exploiting this LFI vulnerability can read any file accessible to the web server process. This includes configuration files containing database credentials, private SSH keys used for authentication, and even the application's source code. Successful exploitation could lead to complete system compromise, allowing an attacker to gain remote code execution capabilities by leveraging the exposed files. The ability to read source code also provides attackers with valuable insights into the application's inner workings, facilitating further attacks.

Systems running qanything in production environments, particularly those with default configurations or inadequate access controls, are at significant risk. Development environments and testing servers also face exposure. Shared hosting environments where multiple users share the same server instance are particularly vulnerable, as a compromise of one user's qanything instance could lead to the compromise of the entire server.

• python / server:

import os
import requests

url = 'http://your-qanything-server/qanything?file='

# Attempt to read a sensitive file (replace with a known path)
try:
    response = requests.get(url + '/etc/passwd')
    if response.status_code == 200:
        print('Potential LFI detected: File content retrieved.')
    else:
        print('File access denied.')
except requests.exceptions.RequestException as e:
    print(f'Error: {e}')

• linux / server:

journalctl -u qanything -f | grep -i "file:"

• generic web:

curl -I http://your-qanything-server/qanything?file=/etc/passwd

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-12-20
2. Veröffentlicht2025-03-20
3. EPSS aktualisiert2026-04-02

Due to the lack of a specific fixed_in version, immediate mitigation focuses on limiting the potential impact. Implement strict file access controls to restrict the web server's access to sensitive files. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting file inclusion endpoints. Monitor system logs for unusual file access patterns. Regularly review and harden the application's configuration to minimize the attack surface. After a patched version is released, upgrade immediately and verify the fix by attempting to access restricted files through the vulnerable endpoint; access should be denied.