Executive brief
Formidable is a popular Node.js library for handling file uploads. The library uses a non-cryptographic random number generator (hexoid) to create filenames for untrusted executable content, making it theoretically possible for attackers to predict and guess generated filenames. While typical exploitation is difficult, this weakness could enable attackers to upload and execute malicious files if they can predict the naming scheme.
Technical details
Formidable versions 2.1.0–2.1.2 and 3.1.1–3.5.2 use the hexoid library to generate random filenames for uploaded files, but hexoid is not cryptographically secure (CWE-338). The vulnerability allows an attacker with network access to potentially predict filenames, particularly in edge cases where only the last two characters need to be guessed. The attack requires the ability to upload files and predict the generated filename before execution. The issue is addressed by switching from hexoid to cuid2, a more secure random number generator, in versions 2.1.3 and 3.5.3 and later.
Affected products
- Formidable Formidable 2.1.0–2.1.2, 3.1.1–3.5.2
Timeline
- 2025-04-26: disclosed
- 2025-04-26: patched: Fixed in versions 2.1.3 and 3.5.3