Bug 2256881 (CVE-2024-22049) - CVE-2024-22049 httparty: multipart/form-data request vulnerable to tampering
Summary: CVE-2024-22049 httparty: multipart/form-data request vulnerable to tampering
Keywords:
Status: NEW
Alias: CVE-2024-22049
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2256883 2256882
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-01-04 23:53 UTC by Robb Gatica
Modified: 2024-01-04 23:54 UTC (History)
0 users

Fixed In Version: httparty 0.21.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Robb Gatica 2024-01-04 23:53:33 UTC 
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written. 

References:
https://github.com/advisories/GHSA-5pq7-52mg-hr42 	
https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43 	
https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e 	
https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42 	
https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42
Comment 1 Robb Gatica 2024-01-04 23:53:47 UTC 
Created rubygem-httparty tracking bugs for this issue:

Affects: fedora-all [bug 2256882]
Comment 2 Robb Gatica 2024-01-04 23:54:57 UTC 
Created rubygem-httparty tracking bugs for this issue:

Affects: epel-all [bug 2256883]
Note You need to log in before you can comment on or make changes to this bug.