PsiTransfer: Violation of the integrity of file distribution

Description

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution.

Details Vulnerable endpoint: POST /files

PoC

1. Create a file distribution.

Recommendation

Update the psitransfer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-xg8v-m2mh-45m6
• CVE-2024-31453
• CWE-434
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• PsiTransfer: File integrity violation - CVE-2024-31454
• VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
• webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373
• jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation) - CVE-2026-24043

Tags:

npm

psitransfer