Tóm tắt nhanh
- CVE-2021-23814 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng unisharp/laravel-filemanager, laravel-filemanager (unisharp).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.8%, cao hơn 79.0% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.6.2 hoặc mới hơn.
Mô tả
This affects the package unisharp/laravel-filemanager prior to version 2.6.2. The upload() function does not sufficiently validate the file type when uploading.
An attacker may be able to reproduce the following steps:
- Install a package with a web Laravel application.
- Navigate to the Upload window
- Upload an image file, then capture the request
- Edit the request contents with a malicious file (webshell)
- Enter the path of file uploaded on URL
- Remote Code Execution
**Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the here.
Mô tả của NVD
This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading.
An attacker may be able to reproduce the following steps:
1. Install a package with a web Laravel application.
2. Navigate to the Upload window
3. Upload an image file, then capture the request
4. Edit the request contents with a malicious file (webshell)
5. Enter the path of file uploaded on URL - Remote Code Execution
**Note:** Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí