| 제목 | moxi159753 mogu_blog_v2 <=v5.2 Unrestricted Upload of File with Dangerous Type |
|---|
| 설명 | mogu_blog_v2, a microservice-based blog system, contains a critical unauthenticated arbitrary file upload vulnerability in the /file/pictures endpoint. The Spring Security configuration permits unauthenticated access to /file/** endpoints, and the uploadPics controller method does not perform authentication checks. When the source parameter is set to picture, the application accepts client-provided userUid, adminUid, projectName, and sortName values from request parameters without validation. The code only verifies these fields are non-empty (not null) but does not authenticate users or validate UIDs against the database. The FileUtils.isSafe() method permits dangerous file types including HTML, JavaScript, CSS, SQL, Java, and Vue files. Attackers can upload malicious HTML files containing JavaScript to conduct stored XSS attacks, phishing pages, malware distribution, and website defacement. Files are stored in predictable, publicly accessible directories and can be executed in victims' browsers. The complete absence of authentication combined with permissive file type validation allows attackers to host arbitrary malicious content on the legitimate domain without any credentials. |
|---|
| 원천 | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-unrestricted_upload-1/report.md |
|---|
| 사용자 | sh7err04 (UID 92493) |
|---|
| 제출 | 2025. 11. 10. PM 02:33 (11 개월 ago) |
|---|
| 모더레이션 | 2025. 11. 30. PM 08:51 (20 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 333824 [moxi159753 Mogu Blog v2 까지 5.2 /file/pictures filedatas 권한 상승] |
|---|
| 포인트들 | 20 |
|---|