mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2024-10-19 05:40:16 -04:00
dc29a286e6
This patch fixes a security issue with all existing CodiMD and HedgeDoc installation which allows arbitary file uploads to instances that expose the `/uploadimage` API endpoint. With the patch it implies the same restrictions on the MIME-types as the frontend does. Means only images are allowed unless configured differently. This issue was reported by Thomas Lambertz. To verify if you are vulnerable or not, create two files `test.html` and `test.png` and try to upload them to your hedgedoc installation. ``` curl -X POST -F "image=@$(pwd)/test.html" http://localhost:3000/uploadimage curl -X POST -F "image=@$(pwd)/test.png" http://localhost:3000/uploadimage ``` Note: Not all backends are affected. Imgur and lutim should prevent this by their own upload API. But S3, minio, filesystem and azure, will be at risk. Addition Note: When using filesystem instead of an external uploads providers, there is a higher risk of code injections as the default CSP do not block JS from the main domain. References: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc Signed-off-by: Christoph Kern <sheogorath@shivering-isles.com> |
||
|---|---|---|
| .. | ||
| config | ||
| migrations | ||
| models | ||
| ot | ||
| web | ||
| workers | ||
| csp.js | ||
| errors.js | ||
| history.js | ||
| letter-avatars.js | ||
| logger.js | ||
| realtime.js | ||
| response.js | ||
| utils.js | ||