Summary:
Authenticated Remote Code Execution by copying files
Detailed Description:
Hello,
When a file is copied on the server via the file manager, the admin has to
specify the name and extension of the destination file. The issue is that
there's no proper validation on the file extension, allowing for copying the
information of say a .txt file into that of a .php extension, which leads to
code execution on the server.
Steps to reproduce:
1- With an administrator account navigate to the File Manager and upload a .txt
file that contains the following content:
<?php echo system("whoami");?>
2- Copy the file to another named rce.php and when the redirect to the main File
Manager page occurs, click on the newly created file's name
3- Notice that a php will be opened with the path /uploads/rce.php, and the user
who started the web server instance is shown in the page as a PoC.
Regards,
Back to List
