Description

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a presigned S3 `PUT` URL for that exact key. Because the endpoint only checks that the referenced typebot is public and that the referenced block is a file input block, an unauthenticated attacker who knows a valid public `typebotId` and `blockId` can request presigned upload URLs for arbitrary objects in the shared bucket, including `private/...` and other tenants' `public/...` paths. Version 3.17.0 fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-11T21:17:36.810Z",
  "pubdate": "2026-08-11T21:17:36.810Z",
  "executiveSummary": "TypeBot versions prior to 3.17.0 suffer from an authorization bypass vulnerability residing in a deprecated public upload endpoint, specifically GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url. This flaw allows unauthenticated attackers to generate presigned Amazon S3 PUT URLs for arbitrary object keys within a shared storage bucket.\nThe vulnerability directly impacts TypeBot installations utilizing affected versions by compromising object storage confidentiality and integrity. Risk implications include unauthorized data injection, overwriting of critical tenant files, and potential data exfiltration vectors via unauthorized write operations to private storage paths such as private/... and isolated tenant directories.\nAttacker capabilities are constrained only by the requirement to possess a valid public typebotId and a corresponding blockId belonging to a file input block. Exploitation requires no prior authentication or administrative privileges, leveraging the application's failure to adequately validate the filePath parameter against the requesting context before interacting with the cloud storage provider.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control validation and improper input sanitization within the deprecated endpoint GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url. The vulnerable component accepts an attacker-controlled filePath parameter and directly uses it to generate a cryptographic presigned Amazon S3 PUT URL.\nDuring normal application execution, this endpoint is intended to provide scoped upload capabilities for legitimate users interacting with a file input block. However, the security checks performed by the backend are critically flawed. The application merely verifies that the targeted typebot is marked as public and that the referenced blockId corresponds to a valid file input block. It fails to validate whether the supplied filePath parameter resolves within the expected scope or boundary of the specific typebot or tenant.\nThe attack flow proceeds as follows. First, an unauthenticated attacker identifies or enumerates a valid public typebotId and a matching blockId for a file input block. Second, the attacker issues an HTTP GET request to the vulnerable endpoint while supplying a manipulated filePath query parameter containing arbitrary object keys, such as paths targeting private/... or other tenants' public/... directories. Third, the application generates and returns a valid presigned Amazon S3 PUT URL mapped to the attacker's specified arbitrary object key. Fourth, the attacker utilizes the obtained presigned URL to execute direct HTTP PUT requests against the cloud storage provider, enabling the upload, modification, or overwriting of arbitrary files within the shared bucket without holding elevated privileges.\nThe affected versions comprise all TypeBot deployments prior to version 3.17.0. The attack vector is exposed over the network via standard HTTP protocols, requiring zero authentication and minimal reconnaissance to exploit."
}