SimStudioAI Sim Missing Authentication Vulnerability in File Upload API

A critical unauthorized file upload vulnerability has been identified in SimStudioAI Sim versions prior to 37786d371e17d35e0764e1b5cd519d873d90d97b. The issue resides in the Session Handler component, specifically within the POST function of the file 'apps/sim/app/api/files/upload/route.ts'. This vulnerability allows remote attackers to upload an unlimited number of files to the server, potentially filling up the server's storage capacity. The root cause of the vulnerability is a lack of authentication checks in the file upload API, which should require user authentication before allowing file operations.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition, where the server's storage is filled up with uploaded files, potentially causing legitimate operations to fail due to lack of available space.

Reproduction

To reproduce this vulnerability, upload files to the 'api/files/upload' endpoint without any authentication. The absence of authentication checks allows any user to access this API and upload files. Once uploaded, the files will be stored on the server, filling up its storage space.