GitHub Advisoryadvisory · npm

GHSA-vgxq-6rcf-qwrw angular-base64-upload vulnerable to unauthenticated remote code execution

CRITICAL Published 2024-10-11 Modified 2024-10-11 Official page ↗
Aliases
CVE-2024-42640
Ecosystem
npm
Packages
angular-base64-upload
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-10-11

Affected packages

• npm angular-base64-upload: < 0.1.21 → fixed in 0.1.21

Description

angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the `angular-base64-upload/demo/server.php` endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the `angular-base64-upload/demo/uploads` endpoint. This leads to the execution of previously uploaded content which enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2024-42640 angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References