Motoyasu-Saburi

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The `filename` parameter of the `Context.FileAttachment` function is not properly sanitized. A maliciously crafted `filename` can cause the `Content-Disposition` header to be sent with an unexpected `filename` value or otherwise modify the `Content-Disposition` header. For example, a `filename` of "setup.bat;x=.txt" will be sent as a file named "setup.bat". If the `FileAttachment` function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the `Content-Disposition` header. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** httparty versions prior to 0.21.0 **Description** A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads, which could result in attacker-controlled filenames being written. This issue is caused by the lack of escaping of the `"` (Double-Quote) character in Content-Disposition > filename. The vulnerability can be exploited to rewrite the "name" field and filename extension, potentially leading to successful or unsuccessful attacks depending on the behavior of the parser receiving the request. The issue has been confirmed to affect frameworks such as Spring, Ktor, and Ruby on Rails. **Recommendations** To resolve the issue, update httparty to version 0.21.0 or later. As a temporary workaround, consider modifying the Content-Disposition header to properly escape the `"` (Double-Quote) character in filenames, for example, by replacing `"` with `%22`. Additionally, URL encoding of `r` and ` ` characters in filenames can provide extra safety.

**Nome do software vulnerável e versões afetadas** Versões do Sinatra 2.0 a 2.2.2 Versões do Sinatra 3.0 a 3.0.3 **Descrição** O problema está relacionado a um ataque de download de arquivo refletido (RFD) que define o cabeçalho Content-Disposition de uma resposta quando o nome do arquivo é derivado de uma entrada fornecida pelo usuário. Isso permite que um invasor execute código arbitrário. A vulnerabilidade está associada ao carregamento de código sem verificação de sua integridade. **Recomendações** Para as versões 2.0 a 2.2.2 do Sinatra, atualize para a versão 2.2.3 para resolver o problema. Para as versões 3.0 a 3.0.3 do Sinatra, atualize para a versão 3.0.4 para resolver o problema. Como solução temporária, considere restringir o uso de entradas fornecidas pelo usuário no nome do arquivo para minimizar o risco de exploração.