TeamPass up to 2.1.27.8 File Upload upload.files.php Parameter unrestricted upload

Summaryinfo

A vulnerability described as critical has been identified in TeamPass up to 2.1.27.8. Affected is an unknown function of the file upload.files.php of the component File Upload. The manipulation as part of Parameter results in unrestricted upload. This vulnerability is known as CVE-2017-15054. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in TeamPass up to 2.1.27.8. Affected is an unknown code block of the file upload.files.php of the component File Upload. The manipulation as part of a Parameter leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in order to select the correct branch and be able to upload any arbitrary file. From there, it can simply access the file to execute code on the server.

The bug was discovered 11/17/2017. The weakness was published 11/27/2017 (Website). The advisory is available at blog.amossys.fr. This vulnerability is traded as CVE-2017-15054 since 10/06/2017. It is possible to launch the attack remotely. The requirement for exploitation is a authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 10 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:upload.files.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.1.27.9 eliminates this vulnerability.

Similar entries are available at VDB-110008, VDB-110009, VDB-110011 and VDB-110007. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• TeamPass

Version

• 2.1.27.0
• 2.1.27.1
• 2.1.27.2
• 2.1.27.3
• 2.1.27.4
• 2.1.27.5
• 2.1.27.6
• 2.1.27.7
• 2.1.27.8

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion