WS-2023-0001

Date: January 3, 2023

httparty prior to 0.21.0 has multipart/form-data request tampering vulnerability, which is caused by Content-Disposition "filename" lack of escaping in httparty. By exploiting this problem, an attack that rewrites the "name" field according to the crafted file name, impersonating (overwriting) another field, and attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename.

Language: Ruby