PsiTransfer: File integrity violation

Description

The absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution.

Recommendation

Update the psitransfer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-2p2x-p7wj-j5h2
• CVE-2024-31454
• CWE-434
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• PsiTransfer: Violation of the integrity of file distribution - CVE-2024-31453
• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
• VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
• react-native-mmkv Insertion of Sensitive Information into Log File vulnerability - CVE-2024-21668

Tags:

npm

psitransfer