C3R3Br4T3

**Name of the Vulnerable Software and Affected Versions** FOG versions prior to 1.5.10.41 **Description** The issue is related to an improperly restricted file upload feature in FOG, a cloning/imaging/rescue suite/inventory management system. This allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has specific checks on the client banner image, requiring it to be 650 pixels wide and 120 pixels high, but lacks checks on file extensions. This can be exploited by appending a PHP webshell to the end of an image and changing the extension to something the PHP web server can parse. **Recommendations** For versions prior to 1.5.10.41, update to version 1.5.10.41 to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature in the Rebranding module to minimize the risk of exploitation. Avoid using the file upload feature with untrusted users until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FOG versions prior to 1.5.10.41 **Description** The hostinfo page in FOG has missing or improper access control, allowing configuration information to be obtained using only the host's mac address, but only if a task is pending on that host. Otherwise, an error message containing "Invalid tasking!" is returned. The domainpassword in the hostinfo dump is hidden from authenticated users. **Recommendations** For versions prior to 1.5.10.41, update to version 1.5.10.41 to resolve the issue. As a temporary workaround, consider restricting access to the hostinfo page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FOG versions prior to 1.5.10.34 **Description** The issue is related to a command injection via the `filename` parameter to the "/fog/management/export.php" API endpoint. This allows for code execution. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For versions prior to 1.5.10.34, update to version 1.5.10.34 to resolve the issue. As a temporary workaround, consider restricting access to the "/fog/management/export.php" API endpoint to minimize the risk of exploitation. Avoid using the `filename` parameter in the affected API endpoint until the issue is resolved.