CVE-2024-52306: Backpack FileManager Remote Code Execution Vulnerability
Summary
CVE-2024-52306: FileManager Deserialization of Untrusted Data vulnerability. Affects backpack/filemanager across 2 version ranges.
< 2.0.2
>= 3.0.0, < 3.0.9
Fixed in 2.0.2 or 3.0.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Backpack FileManager is a popular package used in PHP applications for managing files and directories. It provides a user-friendly interface for file uploads, downloads, and management tasks. However, due to its reliance on user input for file handling, it is susceptible to security vulnerabilities, particularly those involving deserialization of untrusted data.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted data from the 'mimes' parameter in Backpack FileManager. This flaw can lead to remote code execution, allowing an attacker to execute arbitrary code on the server. The issue is classified under CWE-502, which pertains to deserialization of untrusted data. If exploited, this vulnerability could compromise the integrity and confidentiality of the application, potentially leading to unauthorized access and data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.22.0.2composer require backpack/filemanager:2.0.2 -
>= 3.0.0, < 3.0.93.0.9composer require backpack/filemanager:3.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workarounds are needed as the recommended solution is to perform a composer update to the patched version.
Conclusion
In summary, the Backpack FileManager package has a critical vulnerability that allows for remote code execution due to the deserialization of untrusted data. It is essential to update to version 3.0.9 or later to mitigate this risk. Regular monitoring with tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for backpack/filemanager →
FAQ
The vulnerability has a CVSS score of 7.6, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to gain unauthorized access to the server and potentially compromise sensitive data.
Yes, failing to update the package leaves your application vulnerable to attacks that could exploit this deserialization flaw.
The vulnerability was reported responsibly by Vladislav Gladkiy at Positive Technologies.
