| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| activestorage | ≥ 5.0.0, < 5.2.4.3≥ 6.0.0, < 6.0.3.1 | 5.2.4.36.0.3.1 |
| rails | ≥ 6.0.0, < 6.0.3.1< 5.2.4.2 | 6.0.3.15.2.4.2 |
There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.
Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.
This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí