GHSA-pj5h-5q6c-3pfx: Infoleak
Impact
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.
You are affected if:
- You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.
Patches
Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds It is recommended to update all Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
If you cannot, a valid workaround exists: - Disable external URL-based upload retrieval where practical. - If you cannot disable it, configure the upload header filter to remove authentication data from outbound file requests. - Restrict access to the affected upload functionality.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Configuration
Disable external URL-based upload retrieval where practical.
Payload external URL-based upload retrieval external URL-based upload retrieval = disabled - Configuration
Configure the upload header filter to remove authentication data from outbound file requests.
Payload upload header filter outbound authentication data = removed - Compensating control
Restrict access to the affected upload functionality.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are affected when external URL-based upload retrieval is enabled and authenticated requests can trigger that retrieval. The risk is greatest where those requests carry a valid session that could be forwarded to an untrusted destination.
What must an attacker be able to do to exploit it?
An attacker would need to cause or influence an external upload retrieval so that an authenticated request is sent to a destination that has not been verified as trusted. A valid session must be present in the affected request for session exposure to occur.
Are default deployments affected?
The issue depends on enabling external URL-based upload retrieval and allowing authenticated requests to trigger it. Deployments without that configuration are not identified as affected.
What can be done if an immediate upgrade is not possible?
Disable external URL-based upload retrieval where practical. If it must remain enabled, configure the upload header filter to strip authentication data from outbound file requests and restrict access to the affected upload functionality.
Which versions contain the fix?
Upgrade all Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.