PT-2017-3372 · Osticket · Osticket
R3J10R
+1
·
Published
2017-10-11
·
Updated
2019-03-26
·
CVE-2017-15580
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
osTicket version 1.10.1
Description
The issue is related to the upload functionality in osTicket, which fails to properly validate the contents of uploaded files. This allows an attacker to upload arbitrary files, including those with malicious content, by modifying the file extension. For example, a
tickets.php request can be modified to upload a file with a .exe extension, potentially allowing the upload of malicious files. The vulnerability can be exploited by a remote attacker to upload harmful files to the web application.Recommendations
For osTicket version 1.10.1, consider disabling the file upload functionality until a proper fix is available, or restrict the types of files that can be uploaded to prevent malicious content from being uploaded. As a temporary workaround, restrict access to the
tickets.php script to minimize the risk of exploitation.Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Osticket