Neos Flow Arbitrary File Upload and XML External Entity Processing
Summary
GHSA-5vv7-j593-mgjc: Neos Flow Arbitrary file upload and XML External Entity processing. Affects neos/flow across 2 version ranges.
>= 2.3.0, < 2.3.7
>= 3.0.0, < 3.0.1
Fixed in 2.3.7 or 3.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Neos Flow is a PHP web application framework that follows the Model-View-Controller (MVC) architectural pattern. It provides a flexible and extensible platform for developing web applications. However, a vulnerability has been discovered in versions 2.3.0 to 2.3.6 and 3.0.0 of Neos Flow that allows arbitrary file uploads and XML External Entity (XXE) processing. This vulnerability can lead to the execution of malicious scripts and potential attacks on the server.
Vulnerability Detail
The vulnerability in Neos Flow allows for arbitrary file uploads, including server-side scripts. If these scripts are executed by the server when accessed through their public URL, various malicious activities such as information disclosure, backdoor placement, and data removal can occur. The risk of this vulnerability depends on the system setup and whether the application built on Flow allows file uploads. In previous versions, the upload of PHP files was blocked. Additionally, a potential XXE processing vulnerability has been discovered in the MediaTypeConverter of Flow 2.3.0 to 2.3.6.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.72.3.7composer require neos/flow:2.3.7 -
>= 3.0.0, < 3.0.13.0.1composer require neos/flow:3.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the fixed versions of Neos Flow.
Conclusion
The vulnerability in Neos Flow that allows arbitrary file uploads and XML External Entity (XXE) processing can have serious consequences if exploited. It is crucial to upgrade to the fixed versions of Neos Flow to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for neos/flow →
FAQ
Neos Flow is a PHP web application framework that follows the Model-View-Controller (MVC) architectural pattern. It provides a flexible and extensible platform for developing web applications.
The vulnerability allows for arbitrary file uploads and XML External Entity (XXE) processing. If malicious scripts are executed by the server, various attacks such as information disclosure, backdoor placement, and data removal can occur.
Versions 2.3.0 to 2.3.6 and 3.0.0 of Neos Flow are affected by this vulnerability.
Yes, in versions prior to 3.0.0, the upload of files with the extension php was blocked.
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the fixed versions of Neos Flow.
References
Related vulnerabilities
Recent vulnerabilities recorded for neos/flow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
