PT-2019-19770 · Pydio · Pydio

Published 2019-06-05 · Updated 2021-07-21 · CVE-2019-9642

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pydio versions through 8.2.2

Description An issue was discovered in Pydio where it is possible to evaluate malicious PHP code through an unauthenticated request. This can be achieved by placing the malicious code on the fourth line of a .php file. For example, a PoC.php file created by the guest account can be executed via a request to the "proxy.php?hash=../../../../../var/lib/pydio/data/personal/guest/PoC.php" endpoint. This issue is related to the plugins/action.share/src/Store/ShareStore.php file.

Recommendations For Pydio versions through 8.2.2, consider restricting access to the proxy.php endpoint until a patch is available. As a temporary workaround, avoid using the proxy.php endpoint with unauthenticated requests.

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2019-9642

Affected Products

Pydio

References · 7

• https://github.com/pydio/pydio-core/commits/develop/core/src/proxy.php · Patch
• https://ubuntu.com/security/CVE-2019-9642 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9642 · Vendor Advisory
• https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-823-security-release · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9642 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9642 · Security Note