Summary
A Denial-of-Service was found in NPM’s @strapi/plugin-upload package during the file upload process. This vulnerability allows an attacker to crash the node server, affecting either development and production environments.
Product
This vulnerability affects NPM’s package @strapi/plugin-upload in versions 4.x prior to 4.22.0, and 5.x prior to 5.0.0-beta2.
Impact
Denial-of-Service occurs when a service becomes unavailable for users or other services.
By sending a specially crafted request, the server crashes instead of gracefully handling the exception.
Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well.
Steps to reproduce
Due to a bug in what we believe to be Burp’s decoding system, we couldn’t produce a valid file to easily reproduce the vulnerability. Instead, the issue can be reproduced by following these steps:
- Configure Burp’s proxy between a browser and a Strapi server.
- Log in and upload an image through the Media Library page while having Burp’s interceptor turned on.
- After capturing the upload
POSTrequest in Burp, add%00at the end of the file extension from theContent-Disposition, in the filename parameter. - Using the cursor, select the added
%00and right-click it. Click inConvert selection>URL>URL decodeto transform the selected text into a null byte. - Forward the modified request.
Expected result
The server should print an error and crash with the error ERR_INVALID_ARG_VALUE.
Remediation
A fix was released in PR #19913, where input validation and error handling were implemented to protect against Denial of Service issues. Users are recommended to upgrade to version 4.22.0, which includes this fix.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Davide Teixeira.
