CVE-2023-36097: Insecure File Upload in funadmin/funadmin
Summary
CVE-2023-36097: fuadmin vulnerable to insecure file upload. Affects funadmin/funadmin versions >= 3.3.2, <= 3.3.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
funadmin is a package available on Packagist that provides administrative functionality for web applications. It allows users to manage plugins and perform various administrative tasks. However, versions 3.3.2 and 3.3.3 of funadmin are vulnerable to an insecure file upload issue when installing plugins.
Vulnerability Detail
The insecure file upload vulnerability in funadmin allows an attacker to upload malicious files to the server. This can lead to various security risks, such as remote code execution, unauthorized access, and data manipulation. The vulnerability arises due to a lack of proper file type validation and insufficient security measures during the file upload process.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to disable the plugin installation feature in funadmin until the vulnerability is fixed. This can be done by modifying the configuration or access permissions to prevent unauthorized access to the plugin installation functionality.
Conclusion
The insecure file upload vulnerability in funadmin can have severe security implications. It is crucial to update to a secure version of funadmin, such as version 3.3.4, to mitigate the vulnerability. Additionally, disabling the plugin installation feature can serve as a temporary workaround. For further support and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for funadmin/funadmin →
FAQ
The vulnerability allows an attacker to upload malicious files to the server, which can lead to remote code execution, unauthorized access, and data manipulation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Yes, the maintainers of funadmin have released a fix in version 3.3.4. It is recommended to upgrade to this version or any subsequent secure version to mitigate the vulnerability.
As a temporary workaround, you can disable the plugin installation feature in funadmin until the vulnerability is fixed. This can be done by modifying the configuration or access permissions.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
