CVE-2024-38353 Scanner
CVE-2024-38353 Scanner - Insecure Filename Randomization vulnerability in CodiMD
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
9 days 16 hours
Scan only one
Domain, IPv4, Subdomain
Toolbox
-
CodiMD is a collaborative markdown editor that allows users to create and share notes in real-time. It is widely used by teams and organizations for seamless collaboration and documentation purposes. Its features include image uploads, real-time editing, and extensive markdown support.
The vulnerability in question is related to insecure filename randomization for uploaded images. Due to insufficient randomness in the filename generation, attackers can predict and determine filenames of previously uploaded images, enabling unauthorized access.
Technical details reveal that the vulnerability is tied to the Formidable library used by CodiMD. This library generates predictable filenames for uploaded images. Attackers can exploit this flaw by guessing URLs of uploaded images and accessing sensitive content without proper authentication.
If exploited, this vulnerability could lead to unauthorized access to sensitive image data stored on the server. This exposure may compromise user privacy and lead to potential misuse of sensitive content.
REFERENCES
