A critical unrestricted file upload vulnerability in JawherKl node-api-postgres allows unauthenticated remote attackers to execute malicious scripts or achieve stored cross-site scripting.

The application fails to validate file types or MIME types within the profile picture upload endpoint, permitting the upload of dangerous file types (e.g., .html) that are served statically. This vulnerability is accessible to unauthenticated remote attackers.

The ability to upload arbitrary files poses a severe risk to the integrity and availability of the hosting environment. Successful exploitation can lead to stored cross-site scripting (XSS) or remote code execution, potentially resulting in full system compromise and unauthorized access to sensitive user data. While the CVSS score is 7.3, the potential for remote code execution and the presence of published exploit material elevate the urgency of this remediation.

Immediate Action: There is no official patch provided by the vendor. Administrators should immediately restrict access to the /uploads directory and disable the affected profile picture upload functionality until a secure update is released or custom code validation is implemented.

Proactive Monitoring: Review web server access logs for requests targeting the /uploads directory, specifically looking for uploads with non-image extensions such as .html, .js, or .php. Monitor for anomalous traffic patterns originating from unauthorized external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block file upload requests that do not match expected image MIME types. Ensure that the web server configuration is set to prevent the execution of scripts within the directory where user-uploaded files are stored.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up on HackMD.

Given the availability of a public proof-of-concept and the critical nature of the flaw, organizations using node-api-postgres must treat this as a high-priority risk. Immediately disable the affected upload endpoint and implement strict input validation to prevent further exploitation. Monitor the environment closely for any signs of unauthorized file access or execution until a permanent patch is available.