httparty Multipart/Form-Data Request Tampering Vulnerability

HTTParty, a popular Ruby library for making HTTP requests, has a vulnerability where attackers can manipulate uploaded filenames during file uploads. By crafting a malicious filename in multipart requests, an attacker could cause files to be saved with names they control, potentially overwriting important files or executing malicious code.

HTTParty versions prior to 0.21.0 fail to properly validate and sanitize filename parameters in multipart/form-data requests, allowing unauthenticated remote attackers to inject arbitrary filenames. An attacker can craft a multipart upload request with a malicious filename parameter that gets written to the filesystem as-is, potentially leading to arbitrary file write or path traversal impacts depending on server-side handling.