So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I cannot figure out a way to demonstrate this as a vulnerability. The general question is: what files, by their nature of knowing their name, represent a vulnerability (if any)?
In my specific scenario, the operating system is Windows, and I can make a request like this.
The server will return a page which indicates that it cannot load this file, whereas if I make a request like this:
http://example.com?site=file://C:\Users\namethatwouldneverexist, it will tell me that the file cannot be found.
Essentially, the server checks if the file exists before checking if I have permissions to read it.
Here are some things I tried:
../../../(etc) This just results in a valid directory, which means it will tell me it is forbidden. Not helpful.
%appdata%This results in a different kind of error, the application does not like percent signs in the path, so it does not expand it for me.
C:\Windows\system32\ping.exe 188.8.131.52This will result in a "not found" error, as it does not pass parameters (or execute the file).
file://xthis will expose the pwd to me, but this is not particularly interesting in my scenario.
I was able to enumerate what network drives are mapped, but this is not particularly useful. I can also essentially port scan the server from the local network to expose private ports, but I am more interested in the filesystem for now.
Essentially, my question boils down to: does the ability to positively identify a file exists on a server constitute a vulnerability, and if so, how? Obviously, if you have an idea for turning this into RCE, then that's fine too!