Listen to this Post
The vulnerability exists within the `MultipartFile.move()` method of the AdonisJS BodyParser. When handling file uploads, the method uses the client-supplied filename if no custom name is provided in the options object. This user-controlled input is not sanitized for directory traversal sequences (e.g., ../../). The method constructs the final destination path using path.join(location, name). Due to how `path.join()` works, a malicious filename like `../../../etc/passwd` allows an attacker to escape the intended upload directory. Furthermore, the default option `overwrite: true` enables the overwriting of existing files. By combining these flaws, an attacker can write arbitrary files to any location accessible by the server process, potentially leading to Remote Code Execution by overwriting critical application or system files.
Platform: AdonisJS BodyParser
Version: <=10.1.1, <11.0.0-next.6
Vulnerability : Path Traversal
Severity: Critical
date: 2024-03-14
Prediction: Patched 10.1.2
What Undercode Say:
// Vulnerable Code Pattern
const file = request.file('document')
await file.move(Application.tmpPath('uploads'))
// Exploitative Request
POST /upload
Content-Type: multipart/form-data
...
Content-Disposition: form-data; name="document"; filename="../../../index.js"
// Check installed version
npm list @adonisjs/bodyparser
// Safe usage with sanitization
const { sanitize } = require('@adonisjs/sanitizer/utils')
const safeName = sanitize(file.clientName, { escape: false })
await file.move(Application.tmpPath('uploads'), { name: safeName })
How Exploit:
Craft malicious filename.
Target upload endpoint.
Overwrite system files.
Protection from this CVE
Update @adonisjs/bodyparser.
Sanitize filenames manually.
Set `overwrite: false`.
Impact:
Arbitrary File Write.
Potential Remote Code Execution.
System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
