PT-2021-3489 · Machform · Machform

Published 2021-06-28 · Updated 2021-07-02 · CVE-2021-20104

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Machform versions prior to 16

Description The issue is related to insufficient sanitization of file attachments uploaded with forms through the upload.php endpoint. This allows for unauthenticated remote code execution. The vulnerability is associated with a lack of restrictions on file uploads in the Machform form creation editor. Exploitation of the vulnerability can enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to 16, update to version 16 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload.php endpoint to minimize the risk of exploitation.

Exploit

Fix

Memory Leak

Unrestricted File Upload

Weakness Enumeration

CWE-401

CWE-434

Related Identifiers

BDU:2021-03519

CVE-2021-20104

Affected Products

Machform

References · 7

• 🔥 https://tenable.com/security/research/tra-2021-25,https://machform.com/blog-machform-16-released · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20104 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20104 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03519 · Security Note
• https://tenable.com/security/research/tra-2021-25%2Chttps://machform.com/blog-machform-16-released · Note
• https://tenable.com/security/research/tra-2021-25%2Chttps%3A//www.machform.com/blog-machform-16-released · Note
• https://t.me/cibsecurity/25790 · Telegram Post