CVE-2023-29401

Summary

CVE-2023-29401 is a vulnerability affecting the Context.FileAttachment function, which fails to properly sanitize the filename parameter. Malicious filenames can be used to modify the Content-Disposition header, causing unexpected or altered filenames to be sent to the client. For instance, a filename like "setup.bat";x=.txt" would be served as "setup.bat", potentially leading to security risks if the FileAttachment function is used with untrusted sources. This issue may enable an attacker to manipulate the content that is downloaded or opened by the user.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.