CodiMD <2.5.4 - Insecure Filename Randomization

mediumseverity

5.3CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased.

Impact

An attacker can gain unauthorised access to images uploaded to CodiMD.

Fix

Update CodiMD to version 2.5.4 or later

How to confirm it

Send: POST /uploadimage
Positive when: matches /"link":"/uploads/[a-z0-9]{25,25}.gif"/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-38353 -u <target>

The full check

id: CVE-2024-38353

info:
  name: CodiMD <2.5.4 - Insecure Filename Randomization
  author: denandz,PulseSecurity.co.nz
  severity: medium
  description: |
    CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased.
  impact: |
    An attacker can gain unauthorised access to images uploaded to CodiMD.
  remediation: |
    Update CodiMD to version 2.5.4 or later
  reference:
    - https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
    - https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38353
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-38353
    cwe-id: CWE-338
    epss-score: 0.01149
    epss-percentile: 0.67114
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"CodiMD"
  tags: cve,cve2024,file-upload,intrusive,codimd,vuln

variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /uploadimage HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------92633278134516118923780781161

        -----------------------------92633278134516118923780781161
        Content-Disposition: form-data; name="image"; filename="{{filename}}.gif"
        Content-Type: image/gif

        {{base64_decode("R0lGODlhAQABAIABAP///wAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==")}}
        -----------------------------92633278134516118923780781161--

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '"link":"/uploads/[a-z0-9]{25,25}.gif"'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"link":"(/uploads/[a-z0-9]{25,25}.gif)"'

References

Use this check only on systems you are authorised to test. Where the data comes from