CVE-2019-19745: Unrestricted file uploads in Contao
Summary
CVE-2019-19745: Unrestricted file uploads in Contao. Affects contao/core-bundle across 2 version ranges.
>= 4.0.0, < 4.4.46
>= 4.5.0, < 4.8.6
Fixed in 4.4.46 or 4.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites. It provides a form generator feature that enables back end users to create forms for various purposes. However, a vulnerability in Contao allows an authenticated back end user to upload arbitrary files and execute them on the server.
Vulnerability Detail
The vulnerability arises from a lack of proper file upload validation and restriction in the form generator of Contao. This allows an attacker with access to the form generator to upload malicious files, such as PHP scripts, and execute them on the server. The impact of this vulnerability can be severe, as it enables remote code execution and potential compromise of the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.4.464.4.46composer require contao/core-bundle:4.4.46 -
>= 4.5.0, < 4.8.64.8.6composer require contao/core-bundle:4.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Contao is not immediately feasible, a temporary workaround is to configure the web server to prevent the execution of PHP files and other scripts in the Contao file upload directory. This can be achieved by modifying the server configuration to disallow the execution of certain file types in the specified directory.
Conclusion
The unrestricted file uploads vulnerability in Contao can have severe consequences, allowing an authenticated back end user to upload and execute arbitrary files on the server. It is crucial to update Contao to the recommended versions or apply the workaround to mitigate the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for contao/core-bundle →
FAQ
The vulnerability allows an authenticated back end user to upload arbitrary files and execute them on the server, potentially leading to remote code execution and compromise of the system.
Updating Contao to version 4.4.46 or 4.8.6 includes patches to address the unrestricted file upload issue. It is recommended to update the software as soon as possible.
A temporary workaround is to configure the web server to disallow the execution of PHP files and other scripts in the Contao file upload directory.
For more information, you can refer to the Contao security advisory at https://contao.org/en/security-advisories/unrestricted-file-uploads.
If you have any questions or comments about this advisory, you can open an issue in the Contao GitHub repository at https://github.com/contao/contao/issues/new/choose.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
