CVE-2019-14315: SunHater KCFinder XSS Vulnerability in upload.php
Summary
CVE-2019-14315: SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php. Affects sunhater/kcfinder versions < 3.20-test2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SunHater KCFinder is an open-source file manager for web applications. It provides a user-friendly interface for uploading, browsing, and managing files on a server. The vulnerability affects versions 3.20-test1, 3.20-test2, 3.12, and earlier. The package is commonly used in web applications that utilize the CKEditorFuncNum parameter. This parameter is vulnerable to cross-site scripting (XSS) attacks, allowing remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The vulnerability arises from a lack of proper input sanitization in the upload.php file of SunHater KCFinder. By manipulating the CKEditorFuncNum parameter, an attacker can inject malicious code into the application. This can lead to various security risks, including session hijacking, defacement of web pages, and theft of sensitive user information. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can disable the affected functionality or implement input validation and sanitization measures to prevent the exploitation of the CKEditorFuncNum parameter. Here is an example of input validation using PHP:
$ckeditorFuncNum = $_GET['CKEditorFuncNum'];
if (!ctype_digit($ckeditorFuncNum)) {
// Handle invalid input
exit;
}
// Continue with the normal flow
This code snippet ensures that the CKEditorFuncNum parameter is a valid digit and rejects any input that does not meet this requirement.
Conclusion
The XSS vulnerability in SunHater KCFinder's upload.php file can have serious security implications for web applications utilizing the CKEditorFuncNum parameter. It is crucial to promptly update the package to a version that addresses this vulnerability and to implement proper input validation and sanitization measures. Regular security audits and code reviews are essential to identify and mitigate such vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for sunhater/kcfinder →
FAQ
The vulnerability allows remote attackers to inject malicious code into the application, potentially leading to various security risks such as session hijacking, defacement of web pages, and theft of sensitive user information.
Versions 3.20-test1, 3.20-test2, 3.12, and earlier are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file.
Yes, it is recommended to update SunHater KCFinder to the latest version that includes the necessary security patches.
To prevent XSS attacks, ensure that all user input is properly validated and sanitized before being displayed or processed. Implement input validation measures and use secure coding practices to mitigate the risk of XSS vulnerabilities.
