PT-2021-3462 · Flysystem · Flysystem

Published 2021-06-24 · Updated 2021-09-20 · CVE-2021-32708

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flysystem versions 1.x through 1.1.3 Flysystem versions 2.x through 2.1.0

Description The issue arises from the whitespace normalisation in Flysystem, which removes any unicode whitespace. This could potentially allow a malicious user to execute code remotely under certain conditions. These conditions include: a user is allowed to supply the path or filename of an uploaded file, the supplied path or filename is not checked against unicode chars, the supplied pathname is checked against an extension deny-list (not an allow-list), the supplied path or filename contains a unicode whitespace char in the extension, and the uploaded file is stored in a directory that allows PHP code to be executed. Given these conditions are met, a user can upload and execute arbitrary code on the system under attack.

Recommendations For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2021-03326

CVE-2021-32708

GHSA-9F46-5R25-5WFM

Affected Products

Flysystem

References · 21

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/league/flysystem/CVE-2021-32708.yaml · Exploit
• https://github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfm · Patch
• https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32 · Patch
• https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74 · Patch
• https://bdu.fstec.ru/vul/2021-03326 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RNZSWK4GOMJOOHKLZEOE5AQSLC4DNCRZ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32708 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9f46-5r25-5wfm · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32708 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32708 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NWPTENBYKI2IG47GI4DHAACLNRLTWUR5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWPTENBYKI2IG47GI4DHAACLNRLTWUR5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32708 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32708 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32708 · Vendor Advisory