Content-Disposition Parameter Smuggling in @hapi/content

Executive Summary

This vulnerability involves inconsistent handling of duplicate parameters in HTTP Content-Type and Content-Disposition headers by the @hapi/content library before version 6.0.2. The Content.disposition() function kept the last occurrence of duplicate parameters while Content.type() kept the first occurrence of certain parameters like charset and boundary. This inconsistency allows an attacker to smuggle malicious parameters through header parsing, potentially bypassing security filters such as filename allowlists.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses @hapi/content version prior to 6.0.2 by running: npm list @hapi/content. If version is below 6.0.2, the system is vulnerable. Inspect HTTP headers for duplicate parameters in Content-Type and Content-Disposition fields, such as filename appearing multiple times.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass upload filename filters by including duplicate parameters in headers. For example, a malicious file named shell.php could be disguised using duplicate filename parameters to trick systems into accepting it. This could lead to unauthorized file uploads, remote code execution, or other attacks depending on the application's functionality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @hapi/content to version 6.0.2 or later using: npm update @hapi/content. If immediate upgrade is not possible, implement input validation to detect and reject duplicate parameters in HTTP headers before processing.

Useful 0 Not Useful 0