CyberRota Analysis
AI-GeneratedVersions of TypeBot prior to 3.17.0 are vulnerable due to a public upload endpoint that allows unauthenticated attackers to request presigned S3 URLs for arbitrary objects in a shared bucket, potentially exposing sensitive data from other tenants. This vulnerability can lead to unauthorized access and data leakage, making it critical for organizations using TypeBot to upgrade to version 3.17.0 or later immediately. All users of the affected versions should prioritize remediation to mitigate the risk of data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a presigned S3 `PUT` URL for that exact key. Because the endpoint only checks that the referenced typebot is public and that the referenced block is a file input block, an unauthenticated attacker who knows a valid public `typebotId` and `blockId` can request presigned upload URLs for arbitrary objects in the shared bucket, including `private/...` and other tenants' `public/...` paths. Version 3.17.0 fixes this issue.