akkoma/changelog.d/emoji-pack-sanitization.security at 385492577d11e9667064d7f7e0dacdc00457064a - limepotato/akkoma - Limbo Git

limepotato/akkoma

Mark Felder 18a0c923d0 Resolve information disclosure vulnerability through emoji pack archive download endpoint

The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org

2023-08-04 08:39:55 +02:00

1 line

39 B

Text

Raw Blame History

Emoji pack loader sanitizes pack names