Summary
The chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit.
Impact
Any guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global MaxFileSizeMB. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.
References
Sijisu Reporter
aisafe-bot Finder
Forceu Remediation developer
Summary
The chunked upload completion path for file requests does not validate the total file size against the per-request
MaxSizelimit. An attacker with a public file request link can split an oversized file into chunks each underMaxSizeand upload them sequentially, bypassing the size restriction entirely. Files up to the server's globalMaxFileSizeMBare accepted regardless of the file request's configured limit.Impact
Any guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global
MaxFileSizeMB. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.References