In short
- CVE-2020-24807 is a HIGH (CVSS 7.8) vulnerability affecting socket.io-file (socket.io-file project), socket.io-file.
- Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.7% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
Description
All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types.
No fix is currently available. Consider using an alternative package until a fix is made available.
NVD description
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
More vulnerabilities in socket.io-file
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free