Authenticated S3 Object Overwrite in Payload CMS

Executive Summary

This vulnerability affects Payload, a headless CMS. It allows an authenticated user to overwrite existing S3 objects belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses access controls and prior file validation.

Useful 0 Not Useful 0

Detection Guidance

Check if your Payload CMS instance uses @payloadcms/storage-s3 versions before 3.90.0 or canary versions before 4.0.0-canary.34. Inspect S3 bucket configurations for multiple collections sharing a bucket with client uploads enabled and useCompositePrefixes set to false or unset.

Useful 0 Not Useful 0

Impact Analysis

An attacker could replace legitimate files with malicious ones, leading to data corruption, unauthorized access, or distribution of harmful content. This could disrupt services, compromise user data, or enable further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @payloadcms/storage-s3 to version 3.90.0 or later, or 4.0.0-canary.34 or later. Disable client uploads for multiple collections sharing a bucket or set useCompositePrefixes to true to enforce proper access controls.

Useful 0 Not Useful 0