Executive brief
Uppy Companion is a file upload service component used by web applications to handle file transfers from various sources. Versions before 3.3.1 allowed attackers with URL upload access to enumerate internal networks, exfiltrate files from local servers, and download them if the filenames were predictable. This could expose sensitive data hosted on internal systems not intended to be publicly accessible.
Technical details
The vulnerability is an authorization bypass (CWE-863) and server-side request forgery (CWE-918) in the URL upload functionality. The root cause was a debug flag that allowed access to local URLs without proper authorization checks, combined with missing validation on metadata endpoints that could be abused for information disclosure (CWE-200). An unauthenticated or low-privileged user with URL upload capability could craft requests to access internal network resources, upload files from localhost or private network services, and retrieve them via predictable naming patterns. The fix, released in version 3.3.1, introduces an explicit COMPANION_ALLOW_LOCAL_URLS configuration variable (defaulting to false) and disallows localhost access in provider metadata operations.
Affected products
- Transloadit Uppy Companion prior to 3.3.1
Timeline
- 2022-03-04: disclosed
- 2022-03-02: patched: Fix commit authored 2022-02-26, committed 2022-03-02