Executive brief
socket.io-file is a Node.js library for handling file uploads over WebSocket connections. An attacker can bypass file-type restrictions by intercepting and modifying WebSocket requests after client-side validation, allowing upload of arbitrary executable files. This could enable remote code execution on servers using the library.
Technical details
socket.io-file through version 2.0.31 performs file-type validation exclusively on the client side, a classic input validation bypass vulnerability (CWE-20). An attacker can intercept WebSocket traffic after client-side validation completes and modify the file name field in the JSON payload to upload files with arbitrary extensions and content. The attack requires local network access to the WebSocket connection and user interaction to trigger the upload, but results in arbitrary file upload capabilities. No patch has been released; the maintainer no longer supports this package.
Affected products
- Rico Gonçalves socket.io-file <= 2.0.31
Timeline
- 2020-10-06: disclosed
- 2021-05-10: advisory: GHSA-r2gr-fhmr-66c5 published as duplicate of GHSA-6495-8jvh-f28x
- 2026-01-22: other: Advisory withdrawn as duplicate