PT-2020-8613 · Jaba · Jaba Xpress Online Shop

Published 2020-03-02 · Updated 2020-03-04 · CVE-2018-17058

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: JABA XPress Online Shop versions through 2018-09-14

Description: An issue was discovered in the picture-upload feature of ProductEdit.aspx, allowing an arbitrary file upload vulnerability. An authenticated attacker can bypass frontend filename validation and upload an arbitrary file via FileUploader.aspx.cs in FileUploader.aspx by using empty w and h parameters. The uploaded file may contain arbitrary aspx code that can be executed by accessing "/Jec/ProductImages//". Notably, accessing the file once uploaded does not require authentication.

Recommendations: For JABA XPress Online Shop versions through 2018-09-14, consider disabling the picture-upload feature in ProductEdit.aspx until a patch is available. Restrict access to the FileUploader.aspx.cs file to minimize the risk of exploitation. Avoid using empty w and h parameters in the FileUploader.aspx file to prevent arbitrary file uploads.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-17058

Affected Products

Jaba Xpress Online Shop

References · 4

• https://osv.dev/vulnerability/CVE-2018-17058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17058 · Security Note
• https://t.me/cibsecurity/10208 · Telegram Post
• http://cyber-crime.ru/cve/CVE-2018-17058.html · Note