CVE-2024-31453: 
JavaScript vulnerability analysis and mitigation

CVE-2024-31453 affects PsiTransfer, an open source, self-hosted file sharing solution. The vulnerability was discovered in versions prior to 2.2.0, where the absence of restrictions on the endpoint allows attackers to add arbitrary files to existing file distributions (GitHub Advisory, NVD).

The vulnerability stems from insufficient restrictions on the file upload endpoint, which enables unauthorized users to create paths for uploading files in existing file distributions. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (GitHub Advisory).

The vulnerability allows attackers to influence users who access the file distribution after the attack by adding files with malicious or phishing content to existing distributions. This compromises the integrity of file distributions and creates potential vectors for distributing malicious content (GitHub Advisory).

The vulnerability can be exploited by creating a file distribution, obtaining the distribution ID, and sending specific POST and PATCH requests to the /files endpoint. The attack requires no special privileges but does require user interaction (GitHub Advisory).

Users are advised to upgrade to PsiTransfer version 2.2.0 which contains a patch for this vulnerability. The fix implements restrictions on the upload endpoint to prevent unauthorized file additions to existing distributions (GitHub Commit).