CVE-2022-40734: UniSharp Laravel Filemanager directory traversal vulnerability
Summary
CVE-2022-40734: UniSharp Laravel Filemanager directory traversal vulnerability. Affects unisharp/laravel-filemanager versions < 2.6.4. Fixed in 2.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UniSharp Laravel Filemanager is a package available on Packagist that provides a file management system for Laravel applications. It allows users to upload, download, and manage files within the application. However, versions up to 2.5.1 are vulnerable to a directory traversal vulnerability that can be exploited to read arbitrary files. This vulnerability was discovered in June 2022 and has been observed being actively exploited in the wild.
Vulnerability Detail
The vulnerability in UniSharp Laravel Filemanager (aka Laravel Filemanager) allows an attacker to perform a directory traversal attack by manipulating the 'working_dir' parameter in the download functionality. By including '../' sequences in the 'working_dir' parameter, an attacker can bypass the intended file access restrictions and read arbitrary files on the server. This can lead to unauthorized access to sensitive information, such as configuration files or user data. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Minimum fixed version
2.6.4
This is the first release that contains the fix.
composer require unisharp/laravel-filemanager:2.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by modifying the affected code. In the 'DownloadController.php' file, locate the 'download' method and add input validation to prevent directory traversal attacks. Here is an example of how the code can be modified:
public function download(Request $request)
{
$workingDir = $request->input('working_dir');
$workingDir = str_replace('..', '', $workingDir);
// Rest of the code
}
Conclusion
UniSharp Laravel Filemanager versions up to 2.5.1 are vulnerable to a directory traversal attack that allows unauthorized access to arbitrary files on the server. It is crucial to upgrade to the latest patched version, 2.5.2, to mitigate this vulnerability. If immediate upgrade is not possible, implementing the provided workaround can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unisharp/laravel-filemanager →
FAQ
UniSharp Laravel Filemanager is a package for Laravel applications that provides a file management system. It allows users to upload, download, and manage files within the application.
A directory traversal vulnerability, also known as path traversal or directory climbing, is a security flaw that allows an attacker to access files and directories outside of the intended scope. By manipulating input parameters, an attacker can navigate to directories they should not have access to and read sensitive files.
This vulnerability can be exploited by sending a specially crafted request to the affected application. By manipulating the 'working_dir' parameter in the download functionality, an attacker can traverse directories and read arbitrary files on the server.
The directory traversal vulnerability in UniSharp Laravel Filemanager can lead to unauthorized access to sensitive information stored on the server. This includes configuration files, user data, or any other files that the web server has access to. This information can be used for further attacks or unauthorized disclosure.
Yes, this vulnerability has been observed being actively exploited in the wild since June 2022.
References
Related vulnerabilities
Recent vulnerabilities recorded for unisharp/laravel-filemanager.
