PsiTransfer: Violation of the integrity of file distribution

Description

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution.

Details Vulnerable endpoint: POST /files

PoC

1. Create a file distribution.

Recommendation

Update the psitransfer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-xg8v-m2mh-45m6
• CVE-2024-31453
• CWE-434
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• PsiTransfer: File integrity violation - CVE-2024-31454
• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261
• VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
• react-native-mmkv Insertion of Sensitive Information into Log File vulnerability - CVE-2024-21668

Tags:

npm

psitransfer