diced vulnerabilities and threats

Zipline versions up to 4.4.0 have a path traversal vulnerability that allows authenticated users to delete arbitrary files on the server. This occurs via the x-zipline-file-extension header, which can be manipulated to inject traversal sequences. Exploitation can lead to denial of service or data loss by deleting chosen files.

Zipline versions up to 4.4.0 have a path traversal vulnerability that allows authenticated users to read arbitrary files on the server. This occurs by exploiting a fallback mechanism that treats the :id parameter as a datasource key, enabling traversal outside the intended uploads directory via encoded sequences in the GET /api/user/files/:id/raw endpoint.

Zipline versions up to and including 4.4.0 have an authentication bypass vulnerability in the WebAuthn login endpoint. This flaw allows attackers who have obtained a registered credential ID to create sessions without proper assertion verification. Exploitation can lead to impersonation of accounts, including those with SUPERADMIN privileges, potentially granting full administrative control.

Zipline versions before 4.8.0 have a race condition vulnerability in the file view counting mechanism. This flaw allows remote attackers to bypass file maxViews limits by sending parallel requests that exploit non-atomic increments of the view count. The issue is fixed in version 4.8.0.

Zipline versions 4.3.2 through before 4.8.0 have a rate limit bypass vulnerability. This flaw allows unauthenticated attackers to evade throttling by spoofing the X-Forwarded-For header when the core.trustProxy setting is enabled. By sending different X-Forwarded-For values per request, attackers can obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords. The vulnerability is fixed in version 4.8.0.

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.