| शीर्षक | macrozheng mall 10 Unrestricted Upload |
|---|
| विवरण | An unauthenticated file upload vulnerability exists in the mall-admin MinIO upload functionality.
The /minio/upload endpoint is included in the admin application's unauthenticated security ignore list. As a result, remote unauthenticated attackers can access the upload endpoint and submit arbitrary multipart files. The uploaded file is stored in MinIO and the application returns a public object URL.
Source-level chain:
mall-admin application.yml secure.ignored.urls includes /minio/upload
→ POST /minio/upload
→ MinioController.upload(MultipartFile file)
→ minioService.upload(file)
→ objectName is generated from yyyyMMdd/ + original filename
→ file is uploaded to MinIO
→ bucket policy may allow public read access
→ response returns a public object URL
Impact:
An unauthenticated attacker may be able to upload arbitrary files and obtain public URLs hosted by the target deployment. This can lead to public file hosting abuse, phishing content hosting, malware distribution, active-content hosting, or storage and bandwidth abuse, depending on deployment configuration.
The root cause is that a sensitive upload endpoint is excluded from authentication and lacks strict authorization and file validation. |
|---|
| स्रोत | ⚠️ https://github.com/macrozheng/mall |
|---|
| उपयोगकर्ता | feng123123 (UID 95215) |
|---|
| सबमिशन | 26/04/2026 07:37 AM (1 महीना पहले) |
|---|
| संयम | 23/05/2026 04:10 PM (27 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 319243 [macrozheng mall तक 1.0.3 Add Product Page /minio/upload Arquivo क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|