Is CVE-2022-0528 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0528 being exploited in the wild.

How severe is CVE-2022-0528?

Low severity, with a CVSS score of 3.1, published 4 March 2022.

Which products and versions are affected?

@uppy/companion (npm) SEMVER:introduced=0,fixed=3.3.1.

Is there a fix for CVE-2022-0528?

Yes. @uppy/companion (npm): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0528 attacked?

It is attacked over the network.

Am I affected by CVE-2022-0528?

Check whether you run @uppy/companion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0528: Uppy Companion incorrect authorization in URL upload

CVE-2022-0528 · Severity: low · CVSS 3.1 · Published 2022-03-04

Uppy Companion is a file upload service component used by web applications to handle file transfers from various sources. Versions before 3.3.1 allowed attackers with URL upload access to enumerate internal networks, exfiltrate files from local servers, and download them if the filenames were predictable. This could expose sensitive data hosted on internal systems not intended to be publicly accessible.

Technologies: @uppy/companion (npm). Vendors: npm.

Quick answers

Is CVE-2022-0528 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0528 being exploited in the wild.
How severe is CVE-2022-0528?: Low severity, with a CVSS score of 3.1, published 4 March 2022.
Which products and versions are affected?: @uppy/companion (npm) SEMVER:introduced=0,fixed=3.3.1.
Is there a fix for CVE-2022-0528?: Yes. @uppy/companion (npm): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0528 attacked?: It is attacked over the network.
Am I affected by CVE-2022-0528?: Check whether you run @uppy/companion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@uppy/companion (npm): upgrade to 3.3.1 or later
```
npm install @uppy/companion@3.3.1
```

Technical details

The vulnerability is an authorization bypass (CWE-863) and server-side request forgery (CWE-918) in the URL upload functionality. The root cause was a debug flag that allowed access to local URLs without proper authorization checks, combined with missing validation on metadata endpoints that could be abused for information disclosure (CWE-200). An unauthenticated or low-privileged user with URL upload capability could craft requests to access internal network resources, upload files from localhost or private network services, and retrieve them via predictable naming patterns. The fix, released in version 3.3.1, introduces an explicit COMPANION_ALLOW_LOCAL_URLS configuration variable (defaulting to false) and disallows localhost access in provider metadata operations.

Affected products

Transloadit Uppy Companion prior to 3.3.1

Identifiers

CVE-2022-0528
GHSA-q24h-5rq3-63j9

Timeline

2022-03-04: disclosed
2022-03-02: patched: Fix commit authored 2022-02-26, committed 2022-03-02

References

https://github.com/transloadit/uppy/commit/267c34045a1e62c98406d8c31261c604a11e544a

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.