Open-source package vulnerability · npm

CVE-2024-42640: angular-base64-upload vulnerable to unauthenticated remote code execution

criticalCVSS 4.0 9.3 · 3.1 10.0GHSA-vgxq-6rcf-qwrw

angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the angular-base64-upload/demo/uploads endpoint.

Published Oct 11, 2024

Affected packages

angular-base64-upload

Ecosystem: npm
Affected: < 0.1.21
Fixed in: 0.1.21
Check: npm ls angular-base64-upload

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the angular-base64-upload/demo/uploads endpoint. This leads to the execution of previously uploaded content which enables the attacker to achieve code execution on the server.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Credited to rvzsec.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology