Kajona CMS 4.7 Image /kajona/image.php __construct image path traversal

Summaryinfo

A vulnerability was found in Kajona CMS 4.7. It has been declared as critical. This affects the function __construct of the file /kajona/image.php of the component Image Handler. Such manipulation of the argument image with the input /files/images/upload/....//....//....//download.php leads to path traversal. In addition, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Kajona CMS 4.7 (Content Management System). Affected by this issue is the function __construct of the file /kajona/image.php of the component Image Handler. The manipulation of the argument image with the input value /files/images/upload/....//....//....//download.php leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality.

The weakness was presented 09/15/2016 with Curesec Research Team as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1006. The following code is the reason for this vulnerability:

//find the params to use
$this->strFilename = urldecode(getGet("image"));
//avoid directory traversing
$this->strFilename = str_replace("../", "", $this->strFilename);

After immediately, there has been an exploit disclosed. The exploit is available at seclists.org. It is declared as proof-of-concept. By approaching the search of inurl:kajona/image.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.0 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

See VDB-91744, VDB-91745, VDB-91746 and VDB-91747 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Kajona

Name

• CMS

Version

• 4.7

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion