Resourcehub Core

This is an arbitrary file upload due to unsanitized file names.

Fix (routes.js)

The vulnerability lies in /api/upload-resource as it fails to sanitize the file name first.

The fixed version:

router.post('/api/upload-resource', (req, res) => {
    const form = formidable({
      uploadDir: uploadsDir,
      keepExtensions: true
    });
  
    form.parse(req, (err, fields, files) => {
      if (err) {
        return res.status(500).json({
          success: false,
          error: 'Upload failed',
          details: err.message
        });
      }
  
      // Access the first file from the files object
      const file = Array.isArray(files.file) ? files.file[0] : files.file;
      
      if (!file) {
        return res.status(400).json({
          success: false,
          error: 'No file uploaded'
        });
      }
  
      try {
        // Sanitize filename - remove path traversal attempts
        const sanitizedFilename = path.basename(file.originalFilename);
        
        const targetPath = path.join(__dirname, '../resources', sanitizedFilename);
        
        fs.renameSync(file.filepath, targetPath);
        
        res.json({
          success: true,
          message: 'Resource uploaded successfully',
          category: fields.category,
          priority: fields.priority,
          filename: sanitizedFilename,
          path: targetPath
        });
      } catch (error) {
        res.status(500).json({
          success: false,
          error: 'Resource upload failed',
          details: error.message
        });
      }
    });
});

---