CVE-2024-46054
📋 TL;DR
OpenVidReview 1.0 has an authentication bypass vulnerability that allows unauthenticated users to upload files via the /upload route. This affects all deployments of OpenVidReview 1.0 where the application is exposed to untrusted users. Attackers can upload malicious files without any credentials.
💻 Affected Systems
- OpenVidReview
📦 What is this software?
Openvidreview by Davidguva
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via malicious file upload leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file upload leading to storage exhaustion, malware hosting, or defacement of the application.
If Mitigated
Limited impact with proper file validation and authentication controls in place.
🎯 Exploit Status
Exploitation requires only HTTP POST requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement authentication middleware for the /upload route or apply workarounds.
🔧 Temporary Workarounds
Add authentication middleware
allModify the upload.js route to require authentication before processing uploads.
Edit routes/upload.js to add authentication checks before file handling logic
Web server access control
linuxConfigure web server (e.g., nginx, Apache) to block unauthenticated access to /upload path.
# nginx example: location /upload { deny all; } or require authentication
🧯 If You Can't Patch
- Restrict network access to the application to trusted users only.
- Implement WAF rules to block unauthenticated POST requests to /upload.
🔍 How to Verify
Check if Vulnerable:
Send a POST request to /upload without authentication. If it accepts files, the system is vulnerable.Check Version:
Check package.json or application metadata for version information.Verify Fix Applied:
Attempt the same POST request; it should return an authentication error or be blocked.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated POST requests to /upload endpoint
- File uploads from unexpected IP addresses
Network Indicators:
- HTTP POST to /upload without preceding authentication requests
SIEM Query:
source="web_logs" AND uri_path="/upload" AND http_method="POST" AND NOT user_agent="*bot*"