PT-2023-32945 · Unknown+3 · Ruby On Rails+3
Motoyasu-Saburi
·
Publicado
2023-01-03
·
Atualizado
2024-09-28
·
CVE-2024-22049
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
httparty versions prior to 0.21.0
Description
A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads, which could result in attacker-controlled filenames being written. This issue is caused by the lack of escaping of the
" (Double-Quote) character in Content-Disposition > filename. The vulnerability can be exploited to rewrite the "name" field and filename extension, potentially leading to successful or unsuccessful attacks depending on the behavior of the parser receiving the request. The issue has been confirmed to affect frameworks such as Spring, Ktor, and Ruby on Rails.Recommendations
To resolve the issue, update httparty to version 0.21.0 or later. As a temporary workaround, consider modifying the Content-Disposition header to properly escape the
" (Double-Quote) character in filenames, for example, by replacing " with %22. Additionally, URL encoding of r and characters in filenames can provide extra safety.Exploit
Correção
Exposure of Resource to Wrong Sphere
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Ktor
Ruby On Rails
Spring
Httparty