Executive brief
Strapi's media upload plugin crashes the entire server when a specially crafted file upload request is sent with a null byte in the filename. This affects all users and dependent systems until the server is manually restarted. Any authenticated user with access to the file upload functionality can trigger the crash, impacting both development and production deployments.
Technical details
The vulnerability is an uncaught exception (CWE-248) in the file upload handler caused by improper input validation. When a null byte (\x00) is injected into the filename extension via the Content-Disposition header, the local file provider attempts to create a write stream with an invalid path containing the null byte, causing Node.js to throw an ERR_INVALID_ARG_VALUE error. This exception is not caught at the application level, causing the entire server process to crash rather than gracefully handling the error. Authentication is required (user must be logged in with upload access), and the attack is triggered via a network POST request with low attack complexity. The issue is resolved by validating and whitelisting acceptable characters in file extensions. A patch is available in version 4.22.0.
Affected products
- Strapi @strapi/plugin-upload before 4.22.0
Timeline
- 2024-06-12: disclosed