CVE-2024-51991: October CMS Media Manager SVG Rename Vulnerability
Summary
CVE-2024-51991: October CMS Allows Unprotected SVG Rename in Media Manager. Affects october/system versions < 3.7.5. Fixed in 3.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October CMS is a popular open-source content management system built on the Laravel PHP framework. It is designed for developers and designers to create and manage websites easily. The system features a robust media manager that allows users to upload and manage various file types, including images and SVG files. However, a configuration option, media.clean_vectors, intended to sanitize SVG uploads, can be bypassed, leading to potential security risks.
Vulnerability Detail
The vulnerability allows authenticated administrators to upload SVG files by initially using a permitted file extension such as .jpg or .png. Once uploaded, the file extension can be modified to .svg, bypassing the sanitization intended to protect against malicious SVG content. This poses a risk as it assumes a trusted user may exploit another trusted user's environment, making it a low-severity issue but still a potential vector for attacks if exploited.
How To Fix
Minimum fixed version
3.7.5
This is the first release that contains the fix.
composer require october/system:3.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the media.clean_vectors configuration in your October CMS settings. However, this is not recommended as it may expose your site to other risks. Instead, ensure that all users with administrative access are trusted and monitor file uploads closely.
Conclusion
In summary, CVE-2024-51991 presents a vulnerability in October CMS that allows for the unsafe handling of SVG files through a bypass of the sanitization process. It is crucial for administrators to update their systems to the patched version to mitigate this risk.
See every vulnerability recorded for october/system →
FAQ
CVE-2024-51991 is a vulnerability in October CMS that allows authenticated users to bypass SVG file sanitization by renaming uploaded files.
Authenticated administrators of October CMS sites with the media.clean_vectors configuration enabled are affected.
The main risk is that a trusted user could upload malicious SVG files, potentially compromising the security of the site.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, ensure that all users with administrative access are trusted and monitor any file uploads closely.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/system.
