PT-2020-13076 · Rconfig · Rconfig

Farid007 · Published 2020-05-18 · Updated 2020-05-19 · CVE-2020-12255

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rConfig version 3.9.4

Description The issue is related to remote code execution due to improper validation in the file upload functionality. Specifically, vendor.crud.php accepts file uploads by checking the content-type without considering the file extension and header. This allows an attacker to exploit the vulnerability by uploading a .php file to vendor.php that contains arbitrary PHP code and changing the content-type to image/gif.

Recommendations For rConfig version 3.9.4, consider disabling the file upload functionality in vendor.crud.php until a patch is available to prevent exploitation. Restrict access to vendor.php to minimize the risk of uploading malicious files. Avoid using the file upload feature with arbitrary content-type headers until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-12255

Affected Products

Rconfig

References · 5

• https://osv.dev/vulnerability/CVE-2020-12255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12255 · Security Note
• https://t.me/cvenotify/3885 · Telegram Post
• https://t.me/freedomf0x/7938 · Telegram Post
• https://gist.github.com/farid007/9f6ad063645d5b1550298c8b9ae953ff · Note