--- title: "CVE-2024-31217" date: "2024-04-04T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-31217/" --- # CVE-2024-31217 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Mar 26, 2024 CVE-2024-31217 **Published:** Apr 4, 2024 CWE-248 Uncaught Exception 5.3 Medium Severity Denial dos js npm Service DT Davide Teixeira Reported by Checkmarx Zero Details Overview ## Summary A Denial-of-Service was found in NPM’s `@strapi/plugin-upload` package during the file upload process. This vulnerability allows an attacker to crash the node server, affecting either development and production environments. ## Product This vulnerability affects NPM’s package `@strapi/plugin-upload` in versions 4.x prior to 4.22.0, and 5.x prior to 5.0.0-beta2. ## Impact Denial-of-Service occurs when a service becomes unavailable for users or other services. By sending a specially crafted request, the server crashes instead of gracefully handling the exception. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. ## Steps to reproduce Due to a bug in what we believe to be Burp’s decoding system, we couldn’t produce a valid file to easily reproduce the vulnerability. Instead, the issue can be reproduced by following these steps: 1. Configure Burp’s proxy between a browser and a Strapi server. 2. Log in and upload an image through the Media Library page while having Burp’s interceptor turned on. 3. After capturing the upload `POST` request in Burp, add `%00` at the end of the file extension from the `Content-Disposition`, in the filename parameter. 4. Using the cursor, select the added `%00` and right-click it. Click in `Convert selection` > `URL` > `URL decode` to transform the selected text into a null byte. 5. Forward the modified request. ### Expected result The server should print an error and crash with the error `ERR_INVALID_ARG_VALUE`. ## Remediation A fix was released in PR [\#19913](https://github.com/strapi/strapi/pull/19913), where input validation and error handling were implemented to protect against Denial of Service issues. Users are recommended to upgrade to version 4.22.0, which includes this fix. ## Credit This issue was discovered and reported by Checkmarx SCA Security Analyst [Davide Teixeira](https://www.linkedin.com/in/davide-teixeira/). ## Resources 1. [Pull Request](https://github.com/strapi/strapi/pull/19913) 2. [Commit](https://github.com/strapi/strapi/commit/ae6b92318c0b56e4e2ec1825556b8088151316ed) 0 Medium Severity CVSS v3.1 Score 5.3 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High Advisory Timeline1. Discovered Dec 14, 2023 2. Disclosed Feb 14, 2024 The vulnerability was privately disclosed to the maintainer 3. Fixed Mar 26, 2024 A fix commit was released with the vulnerability fix ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)