| 제목 | Gerapy 0.9.13 / master branch at commit 7c4eda875563f5d0342a3650959e0502bc279d77 CWE-862 Missing Authorization / CWE-434 Unrestricted Upload of F |
|---|
| 설명 | Gerapy 0.9.13 exposes the project upload endpoint `POST /api/project/upload` without authentication. The route is mapped in `gerapy/server/core/urls.py` and the corresponding `project_upload` view in `gerapy/server/core/views.py` has `@permission_classes([IsAuthenticated])` commented out, while the surrounding project and client management APIs explicitly require authentication. The same view accepts `request.FILES['file']`, saves it to `PROJECTS_FOLDER`, opens it as a ZIP archive, and extracts all entries into `PROJECTS_FOLDER`. An unauthenticated remote attacker can therefore upload a crafted ZIP archive to place a new Scrapy project or overwrite files in an existing project directory. This can result in persistent project tampering and a practical path to code execution when an administrator later builds, deploys, parses, schedules, or runs the attacker-controlled project through Gerapy/Scrapyd workflows. Remediation should restore authentication on the upload endpoint, validate the uploaded archive type and entry names, extract only into a newly created validated project directory, and prevent unintended overwrites. |
|---|
| 원천 | ⚠️ https://github.com/Gerapy/Gerapy/issues/317 |
|---|
| 사용자 | Galaxyn (UID 98388) |
|---|
| 제출 | 2026. 06. 13. PM 12:57 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 18. AM 10:29 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 380025 [Gerapy 까지 0.9.13 Project Upload Endpoint views.py 약한 인증] |
|---|
| 포인트들 | 20 |
|---|