Read Time:24 Second
Posted by RedTeam Pentesting GmbH on May 30
Advisory: Pydio Cells: Cross-Site Scripting via File Download
Pydio Cells implements the download of files using presigned URLs which
are generated using the Amazon AWS SDK for JavaScript [1]. The secrets
used to sign these URLs are hardcoded and exposed through the JavaScript
files of the web application. Therefore, it is possible to generate
valid signatures for arbitrary download URLs. By uploading an HTML file
and modifying the download URL…