Description
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | 4.0.0 – < 4.8.0 | 4.8.0 |
References
- GitHub Security Advisory (GHSA-wwrw-gq56-7wpj) vendor-advisory
- https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f patch
- zipline v4.8.0 Release Notes release-notes
- https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170 technical-description
- https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294 technical-description
- VulnCheck Advisory: Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch third-party-advisory