The line response = urllib2.urlopen(request.getvalue("url")) can be used to access the content of files on the server. urllib2 accepts local URLs, so simply send a URL starting with file: to display the content of the file in question.
POC : executing JS code CodeBoot.prototype.urlGet('file:///etc/passwd').
The line
response = urllib2.urlopen(request.getvalue("url"))can be used to access the content of files on the server. urllib2 accepts local URLs, so simply send a URL starting withfile:to display the content of the file in question.POC : executing JS code
CodeBoot.prototype.urlGet('file:///etc/passwd').