CVE-2024-45962: October Package Vulnerability Allows Malicious PDF Uploads
Summary
CVE-2024-45962: October allows an admin account to upload PDF containing malicious JavaScript. Affects october/october versions < 3.6.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October is an open-source content management system (CMS) built on the Laravel framework, designed for developers to create and manage websites easily. It offers a range of features including a modular architecture, customizable themes, and a user-friendly interface. However, version 3.6.30 has a vulnerability that allows authenticated admin accounts to upload PDF files containing malicious JavaScript, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the improper handling of file uploads in October version 3.6.30. An authenticated admin can upload a PDF file that includes malicious JavaScript code. If this file is accessed through the website, it can lead to Cross-Site Scripting (XSS) attacks or allow the execution of arbitrary code, potentially compromising the entire system. This vulnerability is classified under CWE-434 (Unrestricted File Upload) and CWE-79 (Improper Neutralization of Input During Web Page Generation), with a CVSS score of 4.8 indicating a low severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict file uploads to only allow specific file types that do not include PDF uploads. You can implement this by modifying the file upload validation rules in your October CMS configuration. For example, you can add the following code to your upload handling logic: if (!
in_array($file->getClientOriginalExtension(), ['jpg', 'png', 'gif'])) { return response()->json(['error' => 'Invalid file type.']);
}
Conclusion
In summary, CVE-2024-45962 is a critical vulnerability in the October CMS that allows the upload of malicious PDF files by authenticated admin users. It is essential to update to the latest version to mitigate this risk and consider implementing temporary workarounds to restrict file uploads until the update is applied.
See every vulnerability recorded for october/october →
FAQ
CVE-2024-45962 is a vulnerability in the October CMS that allows authenticated admin users to upload malicious PDF files containing JavaScript.
If you are using October version 3.6.30 or earlier, your installation is vulnerable. You can check your version in the admin dashboard or by inspecting the composer.lock file.
The risks include potential XSS attacks and the execution of arbitrary code, which can lead to data breaches or full system compromise.
Yes, you can use Vulert to monitor and alert you in real-time for open-source vulnerabilities in your software. It requires only the composer.lock file for analysis.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for october/october.
