Unrestricted Upload of File with Dangerous Type Affecting psitransfer package, versions <2.2.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PSITRANSFER-6579635
- published 7 Apr 2024
- disclosed 5 Apr 2024
- credit onelovegg1
How to fix?
Upgrade psitransfer to version 2.2.0 or higher.
Overview
psitransfer is a Simple open source self-hosted file sharing solution
Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type due to the absence of restrictions on the endpoint, which allows the creation of a path for uploading a file in a file distribution. An attacker can add arbitrary files to the distribution by sending a POST request to /files with a specific Upload-Metadata header followed by a PATCH request to /files/{id} with arbitrary content.
References
CVSS Scores
version 3.1