Arbitary file download vulnerability on a DoD website

Summary

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!

This website demonstrated a quite classic file disclosure vulnerability, the website contained a feature to download pdf's and documents off the website, this was quite similar to the events calendar file disclosure vulnerability. The website looked as followed, website.com/xxx/account/downloadfile?fileString=/pathtodocument/document.pdf. We could view the etc/shadow or other sensitive files by traversing the directory structure using ../ and access the files.