Quick answers
- Is CVE-2024-31453 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-31453 being exploited in the wild.
- How severe is CVE-2024-31453?
- Low severity, with a CVSS score of 3.1, published 5 April 2024.
- Which products and versions are affected?
- psitransfer (npm) SEMVER:introduced=0,fixed=2.2.0.
- Is there a fix for CVE-2024-31453?
- Yes. psitransfer (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-31453 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2024-31453?
- Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- psitransfer (npm): upgrade to 2.2.0 or later
npm install psitransfer@2.2.0
Technical details
The vulnerability exists in the POST /files endpoint due to insufficient access control on the file upload mechanism. An attacker can exploit this by first creating or identifying a file distribution, then using the Upload-Metadata header to reference the target distribution's session ID (sid), allowing them to upload new files without proper authorization. The attack requires user interaction (the victim must visit and download from the compromised distribution), but no authentication is required from the attacker. Once exploited, attackers can inject files with malicious or phishing payloads into legitimate distributions, compromising integrity. The vulnerability was patched in version 2.2.0.
Affected products
- psi-4ward PsiTransfer before 2.2.0
Identifiers
- CVE-2024-31453
- GHSA-xg8v-m2mh-45m6
Timeline
- 2024-04-05: disclosed
- 2024-04-05: patched: Fixed in version 2.2.0