CVE-2019-17352: Unrestricted Upload of File with Dangerous Type

October 8, 2019 (updated October 15, 2019)

In JFinal cos before, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.

References

gitee.com/jfinal/cos/commit/5eb23d6e384abaad19faa7600d14c9a2f525946a
gitee.com/jfinal/cos/commit/8d26eec61f0d072a68bf7393cf3a8544a1112130
nvd.nist.gov/vuln/detail/CVE-2019-17352

Code Behaviors & Features

Detect and mitigate CVE-2019-17352 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →