CVE-2024-5278

Unrestricted file upload vulnerability allows arbitrary file types, risking RCE.

• CVSS 6.1
• CWE-434
• Input Validation and Sanitization
• Remote

gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` endpoint. Specifically, the `handle_file_upload` function does not sanitize or validate the file extension or content type of uploaded files, allowing attackers to upload files with arbitrary extensions, including HTML files containing XSS payloads and Python files. This vulnerability, present in the latest version as of 20240310, could lead to stored XSS attacks and potentially result in remote code execution (RCE) on the server hosting the application.

CVE

CVE-2024-5278

CWE

CWE-434

CVSS base score

6.1

Published

2024-06-06

OWASP

A06 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

gaizhenbiao/

Solution

Implement strict validation and sanitization of file uploads by checking file extensions and content types, and upgrade to version 20240311 or later if a patch is available.

from flask import Flask, request

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def handle_file_upload():
    if 'file' not in request.files:
        return 'No file part', 400
    file = request.files['file']
    if file.filename == '':
        return 'No selected file', 400
    file.save('/path/to/save/' + file.filename)
    return 'File uploaded successfully', 200

if __name__ == '__main__':
    app.run()

import os
from flask import Flask, request, abort
from werkzeug.utils import secure_filename

app = Flask(__name__)

UPLOAD_FOLDER = '/path/to/save'
ALLOWED_EXTENSIONS = {'txt', 'pdf', 'png', 'jpg', 'jpeg', 'gif'}

app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024

def allowed_file(filename):
    return (
        '.' in filename and
        filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
    )

@app.route('/upload', methods=['POST'])
def handle_file_upload():
    if 'file' not in request.files:
        abort(400, 'No file part')

    file = request.files['file']

    if file.filename == '':
        abort(400, 'No selected file')

    if file and allowed_file(file.filename):
        filename = secure_filename(file.filename)

        os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)

        file_path = os.path.join(app.config['UPLOAD_FOLDER'], filename)
        file.save(file_path)

        return 'File uploaded successfully', 200
    else:
        abort(400, 'File type not allowed')

if __name__ == '__main__':
    app.run()

<script>alert('XSS Attack');</script>

@misc{vaitp:cve20245278,
  title        = {{Unrestricted file upload vulnerability allows arbitrary file types, risking RCE.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-5278},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-5278/}}
}