CVE-2024-48514: Remote Code Execution Vulnerability in php-heic-to-jpg
Summary
CVE-2024-48514: Remote code execution in php-heic-to-jpg. Affects maestroerror/php-heic-to-jpg versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php-heic-to-jpg package is a PHP library designed to convert HEIC images to JPG format. It is commonly used in applications that require image processing, particularly for handling images from Apple devices that use the HEIC format. The package simplifies the conversion process, making it accessible for developers. However, versions 1.0.5 and below are vulnerable to a critical security flaw that allows remote code execution.
Vulnerability Detail
The vulnerability arises from improper handling of file names in the php-heic-to-jpg package. An attacker can exploit this flaw by uploading a specially crafted HEIC image with a malicious file name. This can lead to remote code execution on the server, compromising the confidentiality, integrity, and availability of the system. The vulnerability is classified under CWE-94, which pertains to code injection issues. If exploited, it could allow attackers to execute arbitrary code, potentially leading to severe consequences for the affected system.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
composer require maestroerror/php-heic-to-jpg:1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement server-side validation to restrict the types of files that can be uploaded. Ensure that only valid HEIC files are accepted and sanitize file names to prevent code execution. Additionally, consider disabling file uploads until the package is updated.
Conclusion
CVE-2024-48514 is a critical remote code execution vulnerability in the php-heic-to-jpg package that affects versions 1.0.5 and below. It is crucial for developers using this package to update to version 1.0.6 or later to mitigate the risk. Implementing workarounds can provide temporary relief, but updating the package is the best long-term solution.
See every vulnerability recorded for maestroerror/php-heic-to-jpg →
FAQ
The impact includes potential remote code execution, which can lead to unauthorized access and control over the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions 1.0.5 and below of php-heic-to-jpg are affected by this vulnerability.
Yes, the patch is available in version 1.0.6 and later of the php-heic-to-jpg package.
If you cannot update immediately, implement server-side validation and restrict file uploads as a temporary measure.
