Executive brief
PsiTransfer is a self-hosted file-sharing application used to distribute files to others. A security flaw allows an attacker to modify files that have already been uploaded by other users. This means a legitimate download link could be tampered with to deliver malicious software or phishing documents to unsuspecting recipients, damaging the integrity of the shared data and the reputation of the service.
Technical details
A vulnerability exists in PsiTransfer due to a lack of access controls on the file upload endpoint. An attacker who obtains the unique ID of a file (typically visible during the download process) can send a 'PATCH /files/{{id}}' request with arbitrary content. The application appends the attacker-supplied data to the end of the original file content without verifying if the requester is the original uploader or if the distribution should be locked. This allows for the injection of malicious payloads into existing shared files. The issue is resolved in version 2.2.0 by implementing bucket locking after an upload is completed.
Affected products
- psi-4ward psitransfer < 2.2.0
Timeline
- 2024-04-05: advisory: GitHub Security Advisory published
- 2024-04-05: patched: Fix committed to repository
- 2024-04-09: disclosed: CVE-2024-31454 assigned