Access Restriction Bypass Affecting paperclip package, versions < 4.0.0


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Access Restriction Bypass vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RUBY-PAPERCLIP-20144
  • published30 Jan 2014
  • disclosed30 Jan 2014
  • creditUnknown

Introduced: 30 Jan 2014

CVE NOT AVAILABLE CWE-284  (opens in a new tab)

Overview

paperclip is an upload management for ActiveRecord. Affected versions of this gem are vulnerable to Restriction Bypass By Spoofing Content-Type Header.

Details

Paperclip Gem for Ruby contains a flaw that is due to the application failing to properly validate the file extension, instead only validating the Content-Type header during file uploads. This may allow a remote attacker to bypass restrictions on file types for uploaded files by spoofing the content-type.

CVSS Scores

version 3.1