CVE-2024-31453: PsiTransfer: Violation of the integrity of file distribution

April 5, 2024 (updated April 9, 2024)

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution.

Details Vulnerable endpoint: POST /files

References

github.com/advisories/GHSA-xg8v-m2mh-45m6
github.com/psi-4ward/psitransfer
github.com/psi-4ward/psitransfer/commit/b9853c97e6911e1c1c5341245ca1eb363fda5269
github.com/psi-4ward/psitransfer/security/advisories/GHSA-xg8v-m2mh-45m6
nvd.nist.gov/vuln/detail/CVE-2024-31453

Code Behaviors & Features

Detect and mitigate CVE-2024-31453 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →