PT-2019-12250 · Pluck · Pluck

Dk0N9O · Publicado 2019-04-19 · Atualizado 2019-04-22 · CVE-2019-11344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.8

Description The issue allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file. This is possible because only certain PHP-related filename extensions are blocked, leaving other extensions vulnerable to exploitation.

Recommendations For Pluck version 4.7.8, consider restricting the upload of .htaccess files or implementing additional checks to prevent the execution of arbitrary code through uploaded files. As a temporary workaround, restrict access to the data/inc/files.php file to minimize the risk of exploitation.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-11344

Produtos afetados

Pluck

Referências · 3

• 🔥 https://github.com/pluck-cms/pluck/issues/72 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11344 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11344 · Aviso do Fabricante