PT-2023-32945 · Unknown+3 · Ruby On Rails+3
Motoyasu-Saburi
·
Published
2023-01-03
·
Updated
2024-09-28
·
CVE-2024-22049
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
httparty versions prior to 0.21.0
Description
A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads, which could result in attacker-controlled filenames being written. This issue is caused by the lack of escaping of the
" (Double-Quote) character in Content-Disposition > filename. The vulnerability can be exploited to rewrite the "name" field and filename extension, potentially leading to successful or unsuccessful attacks depending on the behavior of the parser receiving the request. The issue has been confirmed to affect frameworks such as Spring, Ktor, and Ruby on Rails.Recommendations
To resolve the issue, update httparty to version 0.21.0 or later. As a temporary workaround, consider modifying the Content-Disposition header to properly escape the
" (Double-Quote) character in filenames, for example, by replacing " with %22. Additionally, URL encoding of r and characters in filenames can provide extra safety.Exploit
Fix
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ktor
Ruby On Rails
Spring
Httparty