Godcheese Nimrod Unrestricted File Upload Vulnerability in FileRestController

A critical arbitrary file upload vulnerability has been identified in Godcheese's Nimrod framework version 0.8. The issue resides in the FileRestController.java, where the file upload functionality lacks proper validation, allowing for unrestricted file uploads. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which could lead to the execution of uploaded files if the server processes them as executable.

Reproduction

To reproduce this vulnerability, send a POST request to '/nimrod/api/system/file/upload_one' with a file named 'calc.jsp' containing a payload that executes a command, such as opening the calculator application. The request must include the appropriate headers to simulate a browser environment, such as 'User-Agent' and 'Cookie'.