https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:44:47 +0000 https://vulnerability.circl.lu/vuln/cve-2024-22049 <p><strong>Affected:</strong> httparty</p> <p>httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.</p> <p><strong>Affected:</strong> httparty</p> <p>httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.</p> https://vulnerability.circl.lu/vuln/cve-2024-22049 https://vulnerability.circl.lu/vuln/ghsa-5pq7-52mg-hr42 <p><strong>Affected:</strong> RubyGems: httparty</p> <p>### Impact I found &#34;multipart/form-data request tampering vulnerability&#34; caused by Content-Disposition &#34;filename&#34; lack of escaping in httparty.</p> <p>`httparty/lib/httparty/request` &gt; `body.rb` &gt; `def generate_multipart`</p> <p>https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43</p> <p>By exploiting this problem, the following attacks are possible</p> <p>* An attack that rewrites the &#34;name&#34; field according to the crafted file name, impersonating (overwriting) another field. * Attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename</p> <p>For example, this vulnerability can be exploited to generate the following Content-Disposition.</p> <p>&gt; Normal Request example: &gt; normal input filename: `abc.txt` &gt; &gt; generated normal header in multipart/form-data &gt; `Content-Disposition: form-data; name=&#34;avatar&#34;; filename=&#34;abc.txt&#34;` &gt; Malicious Request example &gt; malicious input filename: `overwrite_name_field_and_extension.sh&#34;; name=&#34;foo&#34;; dummy=&#34;.txt` &gt; &gt; generated malicious header in multipart/form-data: &gt; `Content-Disposition: form-data; name=&#34;avatar&#34;; filename=&#34;overwrite_name_field_and_extension.sh&#34;; name=&#34;foo&#34;; dummy=&#34;.txt&#34;`</p> <p>The Abused Header has multiple name ( `avatar` &amp; `foo` ) fields and the &#34;filename&#34; has been rewritten from `*.txt` to `*.sh` .</p> <p>These problems can result in successful or unsuccessful attacks, depending on the behavior of the parser receiving the request. I have conf…</p> <p><strong>Affected:</strong> RubyGems: httparty</p> <p>### Impact I found &#34;multipart/form-data request tampering vulnerability&#34; caused by Content-Disposition &#34;filename&#34; lack of escaping in httparty.</p> <p>`httparty/lib/httparty/request` &gt; `body.rb` &gt; `def generate_multipart`</p> <p>https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43</p> <p>By exploiting this problem, the following attacks are possible</p> <p>* An attack that rewrites the &#34;name&#34; field according to the crafted file name, impersonating (overwriting) another field. * Attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename</p> <p>For example, this vulnerability can be exploited to generate the following Content-Disposition.</p> <p>&gt; Normal Request example: &gt; normal input filename: `abc.txt` &gt; &gt; generated normal header in multipart/form-data &gt; `Content-Disposition: form-data; name=&#34;avatar&#34;; filename=&#34;abc.txt&#34;` &gt; Malicious Request example &gt; malicious input filename: `overwrite_name_field_and_extension.sh&#34;; name=&#34;foo&#34;; dummy=&#34;.txt` &gt; &gt; generated malicious header in multipart/form-data: &gt; `Content-Disposition: form-data; name=&#34;avatar&#34;; filename=&#34;overwrite_name_field_and_extension.sh&#34;; name=&#34;foo&#34;; dummy=&#34;.txt&#34;`</p> <p>The Abused Header has multiple name ( `avatar` &amp; `foo` ) fields and the &#34;filename&#34; has been rewritten from `*.txt` to `*.sh` .</p> <p>These problems can result in successful or unsuccessful attacks, depending on the behavior of the parser receiving the request. I have conf…</p> https://vulnerability.circl.lu/vuln/ghsa-5pq7-52mg-hr42