N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-94g8-xv23-7656

GHSA-94g8-xv23-7656: Vaadin Flow Components possible file bypass via upload validation on the server-side

Description

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-94g8-xv23-7656

GHSA-94g8-xv23-7656:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.vaadin:vaadin-upload-flow	maven	>= 2.0.0, <= 14.13.0	14.13.1
com.vaadin:vaadin-upload-flow	maven	>= 23.0.0, <= 23.6.1	23.6.2
com.vaadin:vaadin-upload-flow	maven	>= 24.0.0, <= 24.7.6	24.7.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows bypassing server-side upload validation in Vaadin's Upload component. The root cause lies in the state management of multi-file uploads. When a developer uses a listener on the 'upload-start' event to validate a file and decides to reject it by calling interruptUpload(), the component should stop all subsequent uploads in that batch.

The analysis of the patch bfe9e507cdcc5d90a2312c8f0162f798a29ba635 reveals the flaw. The interrupted flag, which signals that the upload process should be aborted, was being reset incorrectly. The endUpload() method, which is called after each file upload completes (or fails), contained the line interrupted = false;. In a multi-file upload scenario, this meant that after the first (rejected) file was handled, the interruption state was cleared, allowing subsequent, potentially malicious, files to be uploaded without being subject to the same validation interruption.

The fix addresses this by modifying endUpload() to only reset the interrupted flag once all active uploads (activeUploads) have finished. This ensures that the interruption state persists for the entire duration of the multi-file upload batch, correctly preventing all files after the interruption is triggered.

The primary vulnerable function is com.vaadin.flow.component.upload.Upload.endUpload due to its flawed logic. During exploitation, a call to com.vaadin.flow.component.upload.Upload.interruptUpload() would initiate the process, and the faulty logic in endUpload would lead to the bypass.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.