PT-2022-12197 · Xerte · Xerte

Rik Lutz · Published 2022-02-24 · Updated 2022-07-12 · CVE-2021-44664

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerte versions through 3.9

Description An Authenticated Remote Code Execution (RCE) issue exists in the website code/php/import/fileupload.php file. This is due to the ability to upload a maliciously crafted PHP file disguised as a language file, which bypasses the upload filters. Attackers can manipulate the file's destination by exploiting path traversal in the mediapath variable.

Recommendations For versions through 3.9, consider disabling the file upload feature in the project interface until a patch is available. Restrict access to the fileupload.php file to minimize the risk of exploitation. Avoid using the mediapath variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2021-44664

Affected Products

Xerte

References · 10

• 🔥 https://riklutz.nl/2021/11/03/authenticated-file-upload-to-remote-code-execution-in-xerte · Exploit
• 🔥 http://packetstormsecurity.com/files/166182/Xerte-3.9-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50795 · Exploit
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/1672d6f46bbd6f6d42f0903ce9a313927ae2836b#diff-27433bb0be90e431d40986f9afebe9ee2f8d1025a7f9e55c3cd7a86f1f8e3fdc · Patch
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/6daeb81d089d4a561e22f931fff1327660a7d1b5 · Patch
• https://osv.dev/vulnerability/CVE-2021-44664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44664 · Security Note
• https://t.me/cvenotify/27313 · Telegram Post
• https://t.me/cibsecurity/38060 · Telegram Post
• https://t.me/cvenotify/27616 · Telegram Post