PT-2019-19422 · Bolt · Bolt

Medu554 · Published 2019-03-07 · Updated 2022-05-13 · CVE-2019-9185

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bolt versions prior to 3.6.5

Description The issue allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension. This is possible due to a flaw in the Controller/Async/FilesystemManager.php file in the filemanager.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting file upload and rename capabilities to minimize the risk of exploitation. Avoid allowing users to upload files with .php extensions until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-9185

GHSA-GMG5-F2GM-P3H7

Affected Products

Bolt

References · 8

• 🔥 https://hacksecproject.com/?p=293 · Exploit
• https://github.com/bolt/bolt/releases/tag/v3.6.5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-9185 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9185 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmg5-f2gm-p3h7 · Vendor Advisory
• https://github.com/bolt/bolt/blob/v3.6.5/changelog.md · Note
• https://github.com/bolt/bolt/pull/7745 · Note
• https://github.com/bolt/bolt · Note