Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/

Summary

@iampuky — thank you for reporting the original vulnerability and for confirming the resolution.

While analyzing the Starbucks Korea mobile application, i noticed that it called an API at https://msr.istarbucks.co.kr:6443/appif/. It was found that the application running under that directory was vulnerable to path traversal, allowing an attacker to read arbitrary files from the server. As a proof-of-concept I was able to retrieve system files, application source code, and logs.

Thank you @starbucks @agedsumatra @still for the good work.