PT-2022-20481 · Unknown · Open Forms

Sergei-Maertens · Published 2022-06-13 · Updated 2022-06-23 · CVE-2022-31041

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Open Forms versions prior to 1.0.9 Open Forms versions prior to 1.1.1

Description Open Forms is an application for creating and publishing smart forms, supporting file uploads with configurable allowed file extensions. The input validation of uploaded files is insufficient, allowing users to alter or strip file extensions and bypass validation. This results in files being uploaded to the server with different file types than indicated by the file name extension, potentially leading to malicious files entering internal networks.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue. For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider using an API gateway or intrusion detection solution in front of Open Forms to scan for and block malicious content before it reaches the application.

Exploit

Fix

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

CVE-2022-31041

GHSA-H85R-XV4W-CG8G

Affected Products

Open Forms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31041.json · Exploit
• https://github.com/open-formulieren/open-forms/commit/0978a29e821a7228c5d46c0527c3e925eb91b071 · Patch
• https://osv.dev/vulnerability/CVE-2022-31041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31041 · Security Note
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-h85r-xv4w-cg8g · Note
• https://t.me/cvenotify/32062 · Telegram Post
• https://t.me/cibsecurity/44284 · Telegram Post