CVE-2024-42640
angular-base64-upload vulnerable to unauthenticated remote code execution
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)2025-04-17 · webapps · multiple
- Angular-Base64-Upload Library 0.1.20 - Remote Code Execution (RCE)2025-04-04 · remote · multiple
Impact
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the `angular-base64-upload/demo/server.php` endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the `angular-base64-upload/demo/uploads` endpoint. This leads to the execution of previously uploaded content which enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | angular-base64-upload | < 0.1.21 | 0.1.21 |
Affected products
| Product | Affected versions |
|---|---|
| Angular-Base64-Upload | before 0.1.21 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/adonespitogo/angular-base64-upload
- https://www.zyenra.com/blog/unauthenticated-rce-in-angular-base64-upload.html
- https://github.com/advisories/GHSA-vgxq-6rcf-qwrw
- https://nvd.nist.gov/vuln/detail/CVE-2024-42640
- https://github.com/rvizx/CVE-2024-42640