Отправить #645419: Selleo Labs Sp. z o.o. Mentingo learn-v2025.08.27 File Upload Restriction Bypass

Vulnerability Type: File Upload Restriction Bypass
CWE Classification: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Attack Vector: HTTP Header Manipulation
Affected Components: User Avatar Upload, Course Image Upload
Required Privileges: Student (lowest privilege level)

Description
A critical file upload restriction bypass vulnerability in Mentingo's image upload functionality allows attackers to upload arbitrary file types by manipulating HTTP Content-Type headers. The vulnerability affects both user avatar and course image upload features, enabling unauthorized file storage with zero content validation.
Key Security Failure: The application performs only client-supplied MIME type validation, completely bypassing file content inspection, signature verification, or extension validation.
Critical Impact: Infrastructure Weaponization
This vulnerability enables weaponization of trusted educational infrastructure for malicious campaigns, creating severe downstream security risks:

Trusted Domain Exploitation

Malware Hosting on Educational Infrastructure: Attackers leverage legitimate educational platform domains to host and distribute malicious content
Corporate Firewall Bypass: Educational domains are commonly whitelisted by enterprise security solutions
Anti-virus Evasion: Security tools often maintain reduced scrutiny for educational platform domains
Enhanced Social Engineering: Victims exhibit significantly higher trust levels toward content served from educational institutions

Attack Chain Amplification

Phishing Campaign Enhancement: Malicious URLs appear to originate from legitimate educational platforms
Supply Chain Positioning: Uploaded malware can target educational sector users with elevated trust assumptions
Persistent Threat Hosting: Files remain accessible via presigned URLs for extended periods
Cross-Organizational Impact: Single compromised Mentingo instance affects trust ecosystem across multiple educational organizations

Exploitation Requirements

Technical Skill Level: Minimal (basic HTTP request manipulation)
Access Requirements: Standard student account registration

This vulnerability transforms Mentingo deployments into potential command and control infrastructure for threat actors, significantly amplifying the attack surface beyond the immediate application scope.

• Источник: ⚠️ https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b
• Пользователь: KhanMarshal (UID 89610)
• Представление: 01.09.2025 13:39 (9 месяцы назад)
• Модерация: 20.09.2025 08:20 (19 days later)
• Статус: принято
• Запись VulDB: 325069 [Selleo Mentingo 2025.08.27 Content-Type userAvatar эскалация привилегий]
• Баллы: 20