Bjã¶Rn Brala

An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default.

The JSON:API and REST modules allow image file uploads to image fields. The validation rules verify the file extension but fail to check the file MIME type (Multipurpose Internet Mail Extensions), which is a standard used to identify the nature and format of a document. This flaw allows a malicious user to upload non-image files. Depending on the web-server configuration, these files may be served using their actual MIME type, potentially leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites, or other unexpected behavior.