rConfig 3.9.4 File Upload vendor.crud.php Content-Type unrestricted upload

Summaryinfo

A vulnerability was found in rConfig 3.9.4. It has been declared as critical. The affected element is an unknown function of the file vendor.crud.php of the component File Upload. Executing a manipulation as part of Content-Type can lead to unrestricted upload. This vulnerability is tracked as CVE-2020-12255. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in rConfig 3.9.4. It has been declared as critical. This vulnerability affects some unknown processing of the file vendor.crud.php of the component File Upload. The manipulation as part of a Content-Type leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to vendor.php that contains arbitrary PHP code and changing the content-type to image/gif.

The weakness was disclosed 05/18/2020. This vulnerability was named CVE-2020-12255 since 04/26/2020. The exploitation appears to be easy. The attack can be initiated remotely. Required for exploitation is a single authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

By approaching the search of inurl:vendor.crud.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-155396, VDB-155395, VDB-155394 and VDB-155393 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• rConfig

Version

• 3.9.4

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion