Description
Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | 4.6.2 – < 4.8.0 | 4.8.0 |
References
- GitHub Security Advisory (GHSA-rgxm-54cf-whf7) vendor-advisory
- https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c patch
- zipline v4.8.0 Release Notes release-notes
- https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts#L96 technical-description
- VulnCheck Advisory: Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update third-party-advisory