Executive brief
save-server is a Node.js application for file storage and management with user authentication. A CSRF vulnerability in versions prior to 1.0.7 allows attackers to trick authenticated users into performing unauthorized actions—such as uploading or deleting files, creating/deleting user accounts, or changing passwords—by luring them to malicious websites. If an administrator is compromised, attackers gain full access to all stored files.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in save-server due to missing CSRF token validation. The flaw affects versions before 1.0.5, and although a fix was attempted in 1.0.5, it broke file upload functionality; the proper fix was released in version 1.0.7 using the double-submit cookie pattern. The attack requires an authenticated user to visit a malicious site while maintaining an active session (session cookie stored in browser); the attacker can then forge requests to perform actions including file upload/deletion, user creation, password changes, and account manipulation. Users with root privileges are at significantly higher risk, as password changes would grant full access to all system files. The vulnerability is patched in version 1.0.7 and later.
Affected products
- Neztore save-server < 1.0.7
Timeline
- 2020-08-04: disclosed
- 2020-08-04: patched: Fixed in version 1.0.7