A file server that trusts the name
The app serves files at /app/download?file=NAME from a downloads folder. Grab the intended file:
curl -s 'http://127.0.0.1:8080/app/download?file=welcome.txt'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/download?file=welcome.txt' Public download: the quarterly report is not ready yet.
The app joins your file value onto its download directory and opens whatever that points to. It never checks that the result stays inside that directory.