Fix for unauthenticated S3 upload proxy and presigned credential leakage (SSRF/Auth)

Vulnerability Overview Vulnerability Type: Unauthenticated S3 Upload Proxy + Presigned Credential Leakage Vulnerability ID: Fixes #326 Commit Message: Committer: japrasad, committed on August 4 Change Scope: 5 files changed, +130 / -12 lines Affected Scope Affected Files (5): - - - - - Core Issues: 1. Unauthenticated Access: The upload proxy endpoints ( , , ) did not validate the API Key, allowing any request to trigger the S3 upload flow. 2. Presigned Credential Leakage: When forwarding requests, the proxy did not sanitize sensitive headers (such as , , ), and S3 presigned URLs could be exposed to unauthenticated users. 3. Missing File Type Validation: When uploading binary files, file types and extensions were not validated, posing a risk of dangerous file types (e.g., , , etc.) being uploaded. Fix Details 1. Add API Key Authentication: Added a function in to extract the key from the request header; if missing, it returns . 2. Sanitize Sensitive Request Headers: In , headers such as , , and are removed to prevent browser Cookies from being forwarded to MuDI and to avoid credential leakage. 3. File Type Allowlist Validation: Added and constants in to apply a blacklist filter to uploaded file extensions and MIME types, blocking dangerous types (e.g., , , , etc.). 4. S3 Target URL Validation: Added a function to validate the legitimacy of the S3 target URL, preventing SSRF or invalid targets. 5. FormData Handling: In the route, is parsed to extract the original S3 target URL for validation, while also filtering internal marker keys (e.g., ). POC / Key Code Snippets 1. API Key Authentication ( ) 2. Sensitive Header Sanitization ( ) 3. File Type Blocklist ( ) ```javascript const BLOCKED_EXT = new Set([ 'html', 'htm', 'shtml', 'xhtml', 'php', 'phtml', 'asp', 'aspx', 'cfm', 'jsp', 'jspx', 'cgi', 'pl', 'py', 'sh', 'bash', 'exe', 'bat', 'cmd', 'com', 'bat', 'sh', 'cgi', 'pl', 'py', 'sh', 'bash', 'exe', 'bat', 'cmd', 'com', 'sh', 'cgi', 'pl', 'py', 'sh', 'bash', 'exe', 'bat', 'cmd', 'com' ]); const BLOCKED_MIME_TYPES = new Set([ 'text/html', 'image/svg+xml', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'application/x-sh', 'application/x-msdownload', 'appl

Goal Reached Thanks to every supporter — we hit 100%!

Fix for unauthenticated S3 upload proxy and presigned credential leakage (SSRF/Auth)

More from this source