CVE-2024-55417: DevDojo Voyager Arbitrary File Write Vulnerability
Summary
CVE-2024-55417: DevDojo Voyager Arbitrary File Write. Affects tcg/voyager versions < 1.8.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DevDojo Voyager is a popular open-source admin panel package for PHP applications, designed to simplify the management of various resources within a web application. It provides a user-friendly interface for managing database records, media uploads, and other administrative tasks. However, versions up to 1.8.0 are susceptible to a significant security flaw that allows authenticated users to bypass file type verification during file uploads.
Vulnerability Detail
The vulnerability arises from inadequate file type verification in the file upload functionality located at /admin/media/upload. An authenticated user can exploit this weakness to upload malicious files, such as web shells, which can lead to arbitrary code execution on the server. This poses a severe risk as it can allow attackers to gain unauthorized access and control over the server, potentially leading to data breaches and further exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict file uploads to specific file types and implement server-side validation to ensure that uploaded files are safe. This can be done by checking the file extension and MIME type before processing the upload.
Conclusion
The CVE-2024-55417 vulnerability in DevDojo Voyager poses a significant risk to applications using this package. By updating to a secure version and implementing proper file upload validations, developers can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for tcg/voyager →
FAQ
CVE-2024-55417 is a vulnerability in the DevDojo Voyager package that allows authenticated users to upload malicious files, leading to arbitrary code execution.
All versions up to and including 1.8.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access, data breaches, and complete control over the server by attackers.
Update to a patched version of the DevDojo Voyager package and implement strict file upload validations as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for tcg/voyager.
