Listen to this Post
How the Vulnerability Works:
Formidable (node-formidable) versions 2.1.0 through 3.x before 3.5.3 use the hexoid library to generate random filenames for uploaded files. Hexoid is explicitly documented as not being cryptographically secure, making it potentially predictable. In some cases, attackers might only need to guess the last two characters of the generated filename to bypass protection mechanisms. While this doesn’t automatically enable arbitrary file uploads or code execution, it could facilitate attacks in specific scenarios where filename prediction is part of an exploit chain. The vulnerability primarily affects applications that rely on formidable’s filename generation for security-critical operations.
Platform: Node.js
Version: 2.1.0-3.5.2
Vulnerability: Filename Guessing
Severity: Low
date: Apr 29, 2025
What Undercode Say:
Analytics:
- Attack Vector: Predictable filename generation
- Impact: Potential file overwrite/upload
- Exploitability: Requires specific conditions
- Affected Installations: ~1.2M weekly downloads
Exploit Commands:
1. Brute-force last 2 chars:
`for i in {0..255}; do curl -F “[email protected]” http://target/upload/${prefix}${printf ‘%02x’ $i}; done`
2. Check hexoid predictability:
`const hexoid = require(‘hexoid’); console.log(hexoid(10)());`
Protection Code:
// Replace hexoid with crypto-secure alternative
const crypto = require('crypto');
function secureFilename(length) {
return crypto.randomBytes(length).toString('hex');
}
// Update formidable configuration
const formidable = require('formidable');
const form = formidable({
filename: (name, ext) => secureFilename(32) + ext
});
Mitigation Steps:
1. Upgrade to formidable 3.5.3+
2. Implement custom filename generator
3. Add server-side file validation
4. Restrict upload permissions
Detection Script:
const pkg = require('formidable/package.json');
if (semver.lt(pkg.version, '3.5.3')) {
console.warn('Vulnerable formidable version detected');
}
Server Hardening:
- Set proper file permissions
- Store uploads outside web root
- Validate file content signatures
- Implement rate limiting
Post-Exploit Actions:
- Review all uploaded files
- Monitor for suspicious activity
- Rotate storage credentials
- Audit server file system
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
