GHSA-7xv9-wr46-j578: Zipline before 4.8.0 maxViews Limit Bypass via Race Condition
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker only needs to hold a link to the file. No privileges or user interaction are required, but exploitation requires sending parallel requests to the file endpoint.
Are all Zipline deployments affected?
Zipline versions before 4.8.0 are affected where files use maxViews limits, including files configured to be deleted when their maximum view count is reached. Files without a view limit are not described as affected.
What is the practical impact of exploitation?
An attacker can view a view-limited file more times than its configured maximum. They can also continue viewing files intended to be deleted after reaching the maximum view count.
What should be done if upgrading cannot happen immediately?
The provided information does not specify a workaround. Until an upgrade is possible, avoid relying on maxViews or delete-on-max-views settings to protect sensitive files shared by link.