Configuration: CodiMD - File Upload¶

Identifier: codimd_unauth_file_upload

Scanner(s) Support¶

Description¶

CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data, or can create a denial of service condition by exhausting all available disk space.

Reference:

• https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
• https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls

Configuration¶

Example¶

Example configuration:

---
security_tests:
  codimd_unauth_file_upload:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.