CyberRota Analysis
AI-GeneratedThe Avo framework for Ruby on Rails applications is vulnerable in versions 2.28.0 to 3.31.9 due to a lack of server-side upload authorization at the attachment upload endpoint, allowing authenticated users to bypass field-level upload policies. This could enable unauthorized modifications to attachment content, including binary data and metadata, particularly impacting deployments with multiple user roles where strict access controls are expected. Organizations using affected versions, especially those with non-administrator users, should prioritize upgrading to version 3.32.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.