WS-2020-0173

Date: October 2, 2020

socket.io-file through 2.0.31 is vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the 'name' value to upload any file types.

Language: JS