CVE-2017-10993: Contao Core directory traversal vulnerability
Summary
CVE-2017-10993: Contao Core directory traversal vulnerability. Affects contao/contao versions >= 4.0.0, < 4.4.1. Fixed in 4.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as a file manager, user management, and template system. The vulnerability in Contao Core allows a logged-in backend user to include arbitrary PHP files by manipulating an URL parameter. Although Contao does not allow the upload of PHP files in the file manager, this vulnerability enables an attacker to exploit existing PHP files on the server.
Vulnerability Detail
The directory traversal vulnerability in Contao Core allows an authenticated backend user to traverse the file system and include arbitrary PHP files. By manipulating the URL parameter, an attacker can specify the path to the desired PHP file, which will then be executed by the server. This can lead to various consequences, such as unauthorized access to sensitive information, remote code execution, or even a complete compromise of the server. The vulnerability affects versions 3.0.0 to 3.5.28 of Contao Core and versions 4.0.0 to 4.4.1 of the Contao package and core bundle.
How To Fix
Minimum fixed version
4.4.1
This is the first release that contains the fix.
composer require contao/contao:4.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general security measure, it is recommended to follow best practices for secure coding and server configuration. This includes sanitizing user input, implementing proper access controls, and regularly updating software to the latest versions.
Conclusion
The directory traversal vulnerability in Contao Core poses a significant risk to the security of websites using affected versions. It is crucial to promptly update Contao Core or the Contao package and core bundle to the recommended versions to mitigate the vulnerability. Regularly reviewing server configurations and following secure coding practices are essential for maintaining a secure web environment. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/contao →
FAQ
Contao is an open-source content management system (CMS) used for creating and managing websites.
The vulnerability allows an authenticated backend user to include arbitrary PHP files, potentially leading to unauthorized access, remote code execution, or server compromise.
Versions 3.0.0 to 3.5.28 of Contao Core and versions 4.0.0 to 4.4.1 of the Contao package and core bundle are affected.
To fix this vulnerability, update Contao Core to version 3.5.28 or later, or update the Contao package and core bundle to version 4.4.1 or later. Additionally, review server configuration to ensure PHP files are not accessible from the web root directory.
There are no specific workarounds provided for this vulnerability. However, following secure coding practices and regularly updating software can help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
