Executive brief
socket.io-file is a Node.js library for uploading files over WebSocket connections. The library validates file types only on the client side, allowing an attacker to intercept and modify upload requests to bypass these restrictions and upload arbitrary file types to a server.
Technical details
The vulnerability is a client-side validation bypass (CWE-20: Improper Input Validation). File type restrictions are enforced only in the browser client, not on the server side. An attacker can intercept WebSocket traffic after client-side validation passes and modify the filename parameter to upload files of forbidden types. This requires network access to the WebSocket connection and user interaction to initiate an upload, but the attacker can then alter the request to upload malicious files. No patch has been released as of the advisory publication date.
Affected products
- Rico socket.io-file 0–2.0.31
Timeline
- 2020-10-02: disclosed
- 2020-10-02: advisory