GHSA-rgxm-54cf-whf7: Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update
Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.8.0
Event History
Frequently Asked Questions
Which deployments are affected?
Zipline versions 4.6.2 through versions before 4.8.0 are affected. Deployments are exposed when administrators have disabled MIME types but users can upload files and update their file metadata.
What access does an attacker need?
An attacker needs an authenticated user account. They can upload a file with a permitted type and then use PATCH /api/user/files/:id to change its metadata to a disabled MIME type.
What is the practical impact of exploitation?
The affected file can be served from /raw/:id with the attacker-selected disabled Content-Type, such as text/html. This bypasses the administrator's MIME-type restriction.
What can be done if upgrading is not immediately possible?
The provided information identifies the metadata update endpoint as the bypass path. Restricting authenticated users' ability to update file metadata through PATCH /api/user/files/:id can reduce exposure until an upgrade is possible.