Open Forms up to 1.0.8/1.1.0 File Name Extension Parser unrestricted upload

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Open Forms up to 1.0.8/1.1.0. This impacts an unknown function of the component File Name Extension Parser. This manipulation causes unrestricted upload. This vulnerability is tracked as CVE-2022-31041. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Open Forms up to 1.0.8/1.1.0. Affected by this vulnerability is an unknown functionality of the component File Name Extension Parser. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.

The weakness was disclosed 06/13/2022 as GHSA-h85r-xv4w-cg8g. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2022-31041 since 05/18/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 1.0.9 or 1.1.1 eliminates this vulnerability. Applying the patch 0978a29e821a7228c5d46c0527c3e925eb91b071 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Open Forms

Version

• 1.0
• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.1.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion