File restriction bypass in socket.io-file

Description

All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types.

No fix is currently available.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.0.31

References

• GHSA-6495-8jvh-f28x
• www.npmjs.com
• CVE-2020-24807
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Path Traversal in socket.io-file - CVE-2020-15779
• Validation bypass in jpv - CVE-2020-17479
• ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` - CVE-2020-28462
• LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read - CVE-2026-39859

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

socket.io-file