Unrestricted file upload

2023-11-2100:15:00

PRIOn knowledge base

www.prio-n.com

unrestricted file upload

exploit

xss

bad entropy

filenames

attacker

malicious html

potential victim

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim.