PT-2023-25180 · Webklex+1 · Webklex/Laravel-Imap+2
Angelej
·
Published
2023-06-21
·
Updated
2023-07-06
·
CVE-2023-35169
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP-IMAP versions prior to 5.3.0
Description
An unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with
Attachment::save() without providing a $filename or passing unsanitized user input is affected by this attack. An attacker can send an email with a malicious attachment to the inbox, which gets crawled with webklex/php-imap or webklex/laravel-imap. The attacker can upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g., get executed by the system via cron or requests.Recommendations
For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue.
As a temporary workaround, consider sanitizing the
$filename parameter in the Attachment::save() method to prevent directory traversal attacks.
Restrict access to the Attachment::save() method to minimize the risk of exploitation.
Avoid using the Attachment::save() method without providing a sanitized $filename value until the issue is resolved.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Php-Imap
Webklex/Laravel-Imap
Webklex/Php-Imap