Executive brief
angular-base64-upload is a widely-used JavaScript library for converting file uploads into base64-encoded data. Versions prior to 0.1.21 allow attackers to upload arbitrary files and execute them on the server without any authentication, leading to complete compromise of the system hosting the vulnerable code.
Technical details
The vulnerability is a CWE-434 unrestricted file upload issue in the angular-base64-upload/demo/server.php endpoint. An unauthenticated attacker can upload arbitrary file content to the server via the demo endpoint, then access and execute the uploaded file through the angular-base64-upload/demo/uploads endpoint. This requires network access to the demo application; the vulnerability only affects unsupported versions prior to 0.1.21. Exploitation results in remote code execution with server privileges. The fix is available in version 0.1.21 and later.
Affected products
- npm angular-base64-upload prior to 0.1.21
Timeline
- 2024-10-11: disclosed
- 2024-10-11: patched: Version 0.1.21 released with fix