This vulnerability allows you to violate the integrity of a file that is uploaded by another user. In this case, additional files are not loaded into the file bucket. Violation of integrity at the level of individual files. While the vulnerability with the number GHSA-xg8v-m2mh-45m6 allows you to violate the integrity of a file bucket without violating the integrity of files uploaded by other users. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic.
Summary
The absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution.
Details
Vulnerable endpoint: PATCH /files/{{id}}
PoC
-
Create a file distribution.
-
Go to the link address for downloading files and download the file (in this case, the attacker receives the file id from the download request).
-
Send a PATCH /files/{{id}} request with arbitrary content in the request body.
Thus, the file with the specified id will be changed. What the attacker specifies in the body of the request will be added to the end of the original content. In the future, users will download the modified file.
Impact
The vulnerability allows an attacker to influence those users who come to the file distribution after him and slip the victim files with a malicious or phishing signature.
onelovegg1 Reporter
Difference from vulnerability number GHSA-xg8v-m2mh-45m6
This vulnerability allows you to violate the integrity of a file that is uploaded by another user. In this case, additional files are not loaded into the file bucket. Violation of integrity at the level of individual files. While the vulnerability with the number GHSA-xg8v-m2mh-45m6 allows you to violate the integrity of a file bucket without violating the integrity of files uploaded by other users. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic.
Summary
The absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution.
Details
Vulnerable endpoint: PATCH /files/{{id}}
PoC
Create a file distribution.
Go to the link address for downloading files and download the file (in this case, the attacker receives the file id from the download request).
Send a PATCH /files/{{id}} request with arbitrary content in the request body.
Thus, the file with the specified id will be changed. What the attacker specifies in the body of the request will be added to the end of the original content. In the future, users will download the modified file.
Impact
The vulnerability allows an attacker to influence those users who come to the file distribution after him and slip the victim files with a malicious or phishing signature.