Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0ycDJ4LXA3d2otajVoMs4AA6qU
PsiTransfer: File integrity violation
Summary
The absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution.
Details
Vulnerable endpoint: PATCH /files/{{id}}
PoC
-
Create a file distribution.
-
Go to the link address for downloading files and download the file (in this case, the attacker receives the file id from the download request).
-
Send a PATCH /files/{{id}} request with arbitrary content in the request body.
Thus, the file with the specified id will be changed. What the attacker specifies in the body of the request will be added to the end of the original content. In the future, users will download the modified file.
Impact
The vulnerability allows an attacker to influence those users who come to the file distribution after him and slip the victim files with a malicious or phishing signature.
Permalink: https://github.com/advisories/GHSA-2p2x-p7wj-j5h2JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ycDJ4LXA3d2otajVoMs4AA6qU
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 26 days ago
Updated: 22 days ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Identifiers: GHSA-2p2x-p7wj-j5h2, CVE-2024-31454
References:
- https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-2p2x-p7wj-j5h2
- https://github.com/psi-4ward/psitransfer/commit/0014d81141e0f1664ccb6841970ef1ea0237cca3
- https://nvd.nist.gov/vuln/detail/CVE-2024-31454
- https://github.com/advisories/GHSA-2p2x-p7wj-j5h2
Blast Radius: 1.0
Affected Packages
npm:psitransfer
Dependent packages: 1Dependent repositories: 0
Downloads: 100 last month
Affected Version Ranges: < 2.2.0
Fixed in: 2.2.0
All affected versions: 1.3.4, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2
All unaffected versions: 2.2.0