Executive brief
@uppy/companion is a backend service that handles file uploads and downloads in the Uppy file upload framework. A Server-Side Request Forgery (SSRF) vulnerability allows attackers to make the server issue requests to arbitrary URLs, potentially scanning internal networks, accessing private services, or interacting with infrastructure systems that should not be directly reachable from the internet.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in the URL handling logic of @uppy/companion, specifically in how it processes redirects during file download operations. An attacker can craft requests that cause the companion server to make HTTP requests to arbitrary network targets, including internal IP addresses, localhost services, or external systems. The vulnerability is remotely exploitable over the network without authentication (network vector, no auth required). An attacker can exploit this to enumerate internal services, bypass firewalls, or exfiltrate data from internal systems. The fix involves validating and blocking redirects to URLs with different protocols, implemented in versions 1.13.2 and 2.0.0-alpha.5.
Affected products
- Transloadit @uppy/companion before 1.13.2 and 2.0.0-alpha.0 through 2.0.0-alpha.4
Timeline
- 2020-08-13: disclosed
- 2020-06-18: patched: Fix committed to master; releases 1.13.2 and 2.0.0-alpha.5