Gerapy Missing Authentication Vulnerability in Project Upload Endpoint

A vulnerability allowing unauthenticated file uploads has been identified in Gerapy versions through 0.9.13. The issue resides in the project upload endpoint, where the authentication requirement has been disabled. This flaw can be exploited remotely, allowing attackers to upload arbitrary ZIP files, which are then extracted into the projects directory on the server.

Impact

Exploitation of this vulnerability leads to unauthorized file uploads, with ZIP archives being extracted into the application's projects directory. This could be misused to inject malicious Scrapy projects that execute harmful code when deployed.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/api/project/upload' endpoint without any authentication. The request must include a ZIP file in the 'file' field. The server will respond with a success message, and the uploaded ZIP file will be extracted into the projects directory.

Remediation

The vulnerability has been addressed in Gerapy version 0.9.14, which is available on the GitHub repository.