CVE-2017-11715 in MetInfo
Summary
by MITRE
job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2019
The vulnerability identified as CVE-2017-11715 affects MetInfo content management system versions through 5.3.17 and represents a critical security flaw in the file upload validation mechanism. This issue stems from an incomplete blacklist implementation that specifically blocks .php file extensions while failing to address related file extensions that can execute PHP code. The vulnerability exists within the job/uploadfile_save.php component which handles file uploads but demonstrates a flawed security approach that allows attackers to bypass restrictions through the use of alternative PHP extensions.
The technical exploitation of this vulnerability occurs through a specific attack chain involving authenticated administrative access and the manipulation of file upload processes. Attackers can upload malicious files with .phtml extensions, which are not blocked by the security mechanism, allowing them to execute arbitrary PHP code on the target server. This vulnerability is particularly dangerous because it leverages the administrative privileges of legitimate users, making the attack more difficult to detect and prevent. The exploitation requires certain actions involving admin/system/safe.php and job/cv.php components, indicating that the vulnerability is not a simple upload bypass but rather a complex interaction between multiple system components that creates a security gap.
The operational impact of this vulnerability extends beyond simple code execution, as it provides attackers with a potential foothold for further system compromise. Once an attacker successfully uploads and executes malicious code through a .phtml file, they can gain full administrative control over the affected system, potentially leading to data breaches, system infiltration, and complete server compromise. This vulnerability directly relates to CWE-434 which addresses "Unrestricted Upload of File with Dangerous Type" and aligns with ATT&CK technique T1190 "Exploit Public-Facing Application" as it represents an authenticated vulnerability that can be exploited through web application interfaces. The attack vector requires administrative access, which places this vulnerability in the category of privilege escalation and lateral movement within attack frameworks.
Organizations using MetInfo versions through 5.3.17 should immediately implement multiple layers of mitigation strategies to address this vulnerability. The primary fix involves implementing a comprehensive file extension validation mechanism that blocks all potentially dangerous file extensions including .phtml, .php3, .php4, .php5, .pht, .phtml, and similar variations that can execute PHP code. Additionally, the system should implement proper file type validation based on content inspection rather than relying solely on extension filtering. The recommended approach includes deploying web application firewalls that can detect and block suspicious file upload patterns, implementing strict file upload restrictions that validate both file extensions and content, and ensuring that uploaded files are stored in non-executable directories. Security teams should also conduct regular vulnerability assessments and penetration testing to identify similar security gaps in other components of the system.
This vulnerability demonstrates the critical importance of comprehensive security testing and the dangers of incomplete security implementations. The flaw represents a classic example of security by obscurity where the system only blocks one specific extension while leaving others that serve the same malicious purpose unaddressed. The vulnerability also highlights the need for proper input validation and the principle of least privilege in web application security. Organizations should ensure that their security measures include comprehensive file upload validation, proper access controls, and regular security audits to prevent similar vulnerabilities from being exploited in the future. The remediation process should include not only patching the specific vulnerability but also implementing broader security improvements to prevent similar issues from occurring in other parts of the application.