CVE-2024-21546: UniSharp Laravel Filemanager Remote Code Execution Vulnerability

Background

UniSharp Laravel Filemanager is a popular package used in Laravel applications for managing files and images. It provides a user-friendly interface for file uploads, image cropping, and other file management functionalities. However, certain versions of this package are susceptible to a critical vulnerability that allows attackers to execute arbitrary code remotely, posing significant security risks to applications using it.

Vulnerability Detail

The vulnerability arises from improper handling of file uploads, specifically through the manipulation of file extensions. Attackers can exploit this flaw by uploading a PHP file with a valid mimetype and appending a '.' character after the '.php' extension. This allows the execution of malicious code on the server, leading to potential data breaches, unauthorized access, and complete system compromise.

composer require unisharp/laravel-filemanager:2.9.1

Workaround

As a temporary workaround, you can implement stricter validation on file uploads to prevent the execution of PHP files. For example, you can restrict the allowed file types to only images and disallow any PHP files entirely. Here is a sample code snippet to enforce this restriction:

public function upload(Request $request) {
    $request->validate([
        'file' => 'required|mimes:jpg,jpeg,png,gif|max:2048',
    ]);
    // Proceed with file upload
}

Conclusion

The UniSharp Laravel Filemanager package has a critical vulnerability (CVE-2024-21546) that allows remote code execution through improper file handling. It is crucial for developers using this package to update to version 2.9.1 or later to mitigate the risks associated with this vulnerability. Implementing additional file validation can also help protect applications in the interim.

See every vulnerability recorded for unisharp/laravel-filemanager →

FAQ