Arbitrary File Upload Affecting unisharp/laravel-filemanager package, versions <2.6.2


0.0
medium

Snyk CVSS

    Attack Complexity High
    User Interaction Required
    Confidentiality High
    Integrity High

    Threat Intelligence

    EPSS 0.19% (57th percentile)
Expand this section
NVD
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199
  • published 16 Dec 2021
  • disclosed 18 Aug 2021
  • credit Huy Nguyen

How to fix?

Upgrade unisharp/laravel-filemanager to version 2.6.2 or higher.

Overview

unisharp/laravel-filemanager is an A file upload/editor intended for use with Laravel 5 to 6 and CKEditor / TinyMCE.

Affected versions of this package are vulnerable to Arbitrary File Upload. The upload() function does not sufficiently validate the file type when uploading.

An attacker may be able to reproduce the following steps:

  • Install a package with a web Laravel application.
  • Navigate to the Upload window
  • Upload an image file, then capture the request
  • Edit the request contents with a malicious file (webshell)
  • Enter the path of file uploaded on URL - Remote Code Execution

Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the here.