Configuration: CodiMD - File Upload¶

Identifier: codimd_unauth_file_upload

Scanner(s) Support¶

Description¶

CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data, or can create a denial of service condition by exhausting all available disk space.

Reference:

• https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
• https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls

Configuration¶

Example¶

Example configuration:

---
security_tests:
  codimd_unauth_file_upload:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.