Affected: httparty

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

Affected: RubyGems: httparty

### Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty.

`httparty/lib/httparty/request` > `body.rb` > `def generate_multipart`

https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43

By exploiting this problem, the following attacks are possible

* An attack that rewrites the "name" field according to the crafted file name, impersonating (overwriting) another field. * Attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename

For example, this vulnerability can be exploited to generate the following Content-Disposition.

> Normal Request example: > normal input filename: `abc.txt` > > generated normal header in multipart/form-data > `Content-Disposition: form-data; name="avatar"; filename="abc.txt"` > Malicious Request example > malicious input filename: `overwrite_name_field_and_extension.sh"; name="foo"; dummy=".txt` > > generated malicious header in multipart/form-data: > `Content-Disposition: form-data; name="avatar"; filename="overwrite_name_field_and_extension.sh"; name="foo"; dummy=".txt"`

The Abused Header has multiple name ( `avatar` & `foo` ) fields and the "filename" has been rewritten from `*.txt` to `*.sh` .

These problems can result in successful or unsuccessful attacks, depending on the behavior of the parser receiving the request. I have conf…