HeyForm Unauthenticated File Upload Vulnerability on /api/upload Endpoint

A critical vulnerability in HeyForm's file upload feature allows any anonymous user to upload files without authentication or proper validation. The issue exists in versions through 3.0.0-rc.8. The /api/upload endpoint lacks authentication guards, session checks, and form-context validation, enabling unrestricted file uploads of various types, including documents, images, and videos, up to 10 MB. Uploaded files receive a permanent public URL on the HeyForm domain, which can be exploited to distribute malicious content or phishing attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, potentially allowing the distribution of malicious files or exhaustion of server storage resources. According to the advisory, this vulnerability could be exploited to upload malware or phishing payloads, taking advantage of HeyForm's domain reputation.

Reproduction

To reproduce this vulnerability, send a POST request to the /api/upload endpoint without any authentication, session cookies, or form context. Include a file in the request. The server will respond with a 201 status and a URL to access the uploaded file, which can be fetched anonymously.

Remediation

Users are advised to update to HeyForm version 3.0.0-rc.9 or later, where this vulnerability has been patched.