CVE-2020-24807

An attacker sends a crafted Socket.io upload request where the JSON `name` field contains a filename with an executable extension (e.g., `.exe`, `.sh`) while the actual file content is an executable payload. Because the server relies on client-side validation of file types [CWE-20] and does not re-validate the file extension or MIME type server-side, the attacker can bypass any client-side MIME checks and write an arbitrary executable file to the server's upload directory. The attacker then triggers execution of that file through a separate mechanism (e.g., direct HTTP access if the upload directory is web-accessible).

The vulnerability resides in the socket.io-file Node.js module (versions through 2.0.31). The server-side code trusts the file type information sent by the client in the JSON upload payload, specifically the `name` field, and does not independently validate the file extension or MIME type against the server-configured `accepts` list before writing the file to disk.

The advisory states that the vulnerability is inherent in the design: the module relies on client-side validation of file types and does not enforce server-side checks on the file extension or MIME type. No patch is provided in the bundle; the maintainer has not released a fix. The recommended remediation is to implement server-side validation of the file extension against an allowlist and to verify the actual MIME type of the uploaded content before writing it to disk.