PT-2022-3660 · Unknown+1 · Formidable+1

Kolbma · Published 2022-05-16 · Updated 2024-08-03 · CVE-2022-29622

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions formidable version 3.1.4 formidable version 3.2.4

Description An arbitrary file upload vulnerability in formidable allows attackers to execute arbitrary code via a crafted filename. Some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled.

Recommendations For version 3.1.4, consider disabling the file upload functionality until a patch is available. For version 3.2.4, consider restricting access to the file upload feature to minimize the risk of exploitation. As a temporary workaround, consider changing the configuration options to alter the default behavior of how files are handled. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-04446

CVE-2022-29622

GHSA-8CP3-66VR-3R4C

Affected Products

Debian

Formidable

References · 31

• 🔥 https://github.com/node-formidable/formidable/issues/862 · Exploit
• 🔥 https://github.com/keymandll/CVE-2022-29622 · Exploit
• 🔥 https://medium.com/@zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022 · Exploit
• 🔥 https://youtube.com/watch?v=C6QPKooxhAo · Exploit
• https://cve.org/CVERecord?id=CVE-2022-29622 · Security Note
• https://ubuntu.com/security/CVE-2022-29622 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-29622 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8cp3-66vr-3r4c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29622 · Security Note
• https://bdu.fstec.ru/vul/2022-04446 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29622 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29622 · Vendor Advisory
• https://github.com/strapi/strapi/issues/20189 · Note
• https://github.com/node-formidable/formidable/issues/856 · Note