PT-2021-23967 · Sulu · Sulu

Alexander-Schranz · Published 2021-12-15 · Updated 2021-12-21 · CVE-2021-43836

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Sulu versions prior to 1.6.44 Sulu versions prior to 2.2.18 Sulu versions prior to 2.3.8 Sulu version prior to 2.4.0

Description: Sulu is an open-source PHP content management system based on the Symfony framework. An attacker can read arbitrary local files via a PHP file include. In a default configuration, this also leads to remote code execution. The compromised components include arbitrary file read on the server and potential remote code execution. Exploitation requires a user account on the backend.

Recommendations: For versions prior to 1.6.44, update to version 1.6.44 or later. For versions prior to 2.2.18, update to version 2.2.18 or later. For versions prior to 2.3.8, update to version 2.3.8 or later. For version prior to 2.4.0, update to version 2.4.0 or later. As a temporary workaround for users unable to upgrade, overwrite the service sulu route.generator.expression token provider and wrap the translator before passing it to the expression language.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-43836

GHSA-VX6J-PJRH-VGJH

Affected Products

Sulu

References · 7

• https://github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54 · Patch
• https://osv.dev/vulnerability/CVE-2021-43836 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vx6j-pjrh-vgjh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43836 · Security Note
• https://github.com/sulu/sulu · Note
• https://github.com/sulu/sulu/security/advisories/GHSA-vx6j-pjrh-vgjh · Note
• https://t.me/cibsecurity/34080 · Telegram Post