Uncaught Exception Affecting @strapi/plugin-upload package, versions <4.22.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-STRAPIPLUGINUPLOAD-7251014
- published 13 Jun 2024
- disclosed 12 Jun 2024
- credit CxDavidepaalte
Introduced: 12 Jun 2024
CVE-2024-31217 Open this link in a new tabHow to fix?
Upgrade @strapi/plugin-upload to version 4.22.0 or higher.
Overview
@strapi/plugin-upload is a Makes it easy to upload images and files to your Strapi Application.
Affected versions of this package are vulnerable to Uncaught Exception in the media upload process. An attacker can cause the server to crash without restarting, affecting either development and production environments. Notes:
By sending a specially-crafted request, the entire server crashes with the thrown error instead of crashing only the single request and returning error 500 to the user.
Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well.
PoC
The issue can be reproduced by following these steps:
Configure Burp’s proxy between a browser and a Strapi server
Log in and upload an image through the Media Library page while having Burp’s interceptor turned on
After capturing the upload POST request in Burp, add %00 at the end of the file extension from the Content-Disposition, in the filename parameter (See reference image 1 below)
Using the cursor, select the added %00 and right-click it. Click in Convert selection > URL > URL decode to transform the selected text into a null byte
Forward the modified request. The server should print an error and crash with the error ERR_INVALID_ARG_VALUE (See reference log 1 below)