httparty has multipart/form-data request tampering vulnerability
Date: 2023-01
Affected: rubygems/httparty
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-22049
CWE: CWE-472
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

### Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty. `httparty/lib/httparty/request` > `body.rb` > `def generate_multipart` https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43 By exploiting this problem, the following attacks are possible * An attack that rewrites the "name" field according to the crafted file name, impersonating (overwriting) another field. * Attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename For example, this vulnerability can be exploited to generate the following Content-Disposition. > Normal Request example: > normal input filename: `abc.txt` > > generated normal header in multipart/form-data > `Content-Disposition: form-data; name="avatar"; filename="abc.txt"` > Malicious Request example > malicious input filename: `overwrite_name_field_and_extension.sh"; name="foo"; dummy=".txt` > > generated malicious header in multipart/form-data: > `Content-Disposition: form-data; name="avatar"; filename="overwrite_name_field_and_extension.sh"; name="foo"; dummy=".txt"` The Abused Header has multiple name ( `avatar` & `foo` ) fields and the "filename" has been rewritten from `*.txt` to `*.sh` . These problems can result in successful or unsuccessful attacks, depending on the behavior of the parser receiving the request. I have confi


Mitigations:

Architectural layers (MAESTRO):