PT-2020-15839 · Node.Js · Socket.Io-File

Published 2020-10-02 · Updated 2024-08-04 · CVE-2020-24807

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions socket.io-file versions through 2.0.31

Description The socket.io-file package for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. This issue only affects products that are no longer supported by the maintainer.

Recommendations For versions through 2.0.31, consider using an alternative package until a fix is made available. As a temporary workaround, restrict access to the vulnerable socket.io-file package to minimize the risk of exploitation. Avoid using the name field in the affected JSON payload until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-24807

GHSA-6495-8JVH-F28X

GHSA-R2GR-FHMR-66C5

Affected Products

Socket.Io-File

References · 11

• https://osv.dev/vulnerability/GHSA-6495-8jvh-f28x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24807 · Security Note
• https://osv.dev/vulnerability/GHSA-r2gr-fhmr-66c5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24807 · Vendor Advisory
• https://github.com/rico345100/socket.io-file · Note
• https://t.me/cvenotify/89024 · Telegram Post
• https://twitter.com/PenTestMag/status/1750942525676786095 · Twitter Post
• https://github.com/advisories/GHSA-6495-8jvh-f28x · Note
• https://npmjs.com/package/socket.io-file · Note
• https://npmjs.com/advisories/1564 · Note
• https://twitter.com/PenTestMag/status/1758856374627299806 · Twitter Post