LocalTapiola: Malicious file upload (secure.lahitapiola.fi)

2018-01-16T14:26:06
ID H1:305237
Type hackerone
Reporter muon4
Modified 2018-04-10T03:36:59

Description

Basic report information

Summary: Malicious file upload

Description: Hello!

I noticed that when a user sends new message you have restricted pretty strictly the files which is ok to upload. Like .svg: {F254353}

How ever if a user impersonate another user (just a one example) and start the conversation with localtapiola's employee and will get the message from localtapiola an attacker can upload malicious files which can be used against your employees like .svg and .exe: {F254354}

I sended one email to me with "malicious" svg file and it came through. This could obviously contain something much more badly than just a pop up window: {F254352}

I want to underline that I'm not 100% sure is this expected behaviour but in my opinion files like .exe should not be allowed. And why an (attacker) user should be allowed to upload anything at this point?

This is straight way to attack against your employees and/or bypass the original upload restrictions.

Domain: secure.lahitapiola.fi

Browsers / Apps Verified In:

  • Newest version of FF

Steps To Reproduce:

  1. Start conversation with secure service
  2. When you receive the first message via this service upload any file like .exe or .svg
  3. See that you can send these files

Impact

An attacker can bypass upload restrictions.