ChestnutCMS File Upload Vulnerability Allowing Unrestricted File Types

A file upload vulnerability has been identified in ChestnutCMS versions through 1.5.0. The issue arises in the /api/member/avatar API endpoint, which accepts a base64-encoded image string. This string is processed by the memberService.uploadAvatarByBase64 method, where the image is decoded and saved to a file without proper validation of the file extension. This vulnerability is particularly concerning because it is exposed to the frontend, allowing for potentially harmful files to be uploaded.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which could be used to upload malicious files such as web shells or executable scripts, depending on the server's file handling and execution policies.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the /api/member/avatar endpoint. Use a tool like Burp Suite to intercept the request and modify the 'image' parameter to include a base64-encoded string of an HTML file or an image file. After sending the request, the uploaded file can be accessed from the server.