CVE-2024-45398: Contao Core Bundle Remote Command Execution via File Upload
Summary
CVE-2024-45398: Contao affected by remote command execution through file upload. Affects contao/core-bundle across 3 version ranges.
>= 4.0.0, < 4.13.49
>= 5.0.0, < 5.3.15
>= 5.4.0, < 5.4.3
Fixed in 4.13.49, 5.3.15 or 5.4.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface and a flexible framework that allows developers to create custom applications. However, it has been found vulnerable to a remote command execution issue, particularly affecting the file upload functionality, which can be exploited by malicious users with backend access.
Vulnerability Detail
The vulnerability arises from improper handling of file uploads in the Contao Core Bundle, allowing authenticated backend users to upload malicious files. Once uploaded, these files can be executed on the server, leading to potential remote command execution. This vulnerability is classified under CWE-434, which pertains to the unrestricted upload of a file type that can be executed. The ramifications include unauthorized access to server resources, data breaches, and complete system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.13.494.13.49composer require contao/core-bundle:4.13.49 -
>= 5.0.0, < 5.3.155.3.15composer require contao/core-bundle:5.3.15 -
>= 5.4.0, < 5.4.35.4.3composer require contao/core-bundle:5.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, configure your web server to prevent the execution of PHP files and other scripts in the Contao file upload directory. This can typically be done by adding the following lines to your web server configuration:
For Apache:
<Directory /path/to/contao/uploads>
Options -ExecCGI
AddHandler cgi-script .php
</Directory>
For Nginx:
location /path/to/contao/uploads {
location ~ \.php$ {
deny all;
}
}
Conclusion
The vulnerability identified as CVE-2024-45398 in the Contao Core Bundle poses a significant risk due to its potential for remote command execution through file uploads. It is crucial for users to update to the latest versions or implement workarounds to protect their systems from exploitation.
See every vulnerability recorded for contao/core-bundle →
FAQ
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
Authenticated backend users with access to the file manager can exploit this vulnerability.
Exploitation can lead to unauthorized command execution on the server, data breaches, and system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updating is not possible, implement the suggested workaround to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
