CVE-2021-44892: ThinkPHP Remote Code Execution (RCE) vulnerability
Summary
CVE-2021-44892: ThinkPHP Remote Code Execution (RCE) vulnerability. Affects topthink/framework versions < 3.2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ThinkPHP is a popular PHP framework used for developing web applications. It provides a range of features and functionalities to simplify the development process. However, ThinkPHP versions 3.x.x are vulnerable to a Remote Code Execution (RCE) vulnerability. This vulnerability can be exploited by an attacker through the value[_filename] parameter in the index.php file. By manipulating this parameter, a malicious user can gain control over the server and execute arbitrary code.
Vulnerability Detail
The ThinkPHP Remote Code Execution (RCE) vulnerability allows an attacker to execute arbitrary code on a server running ThinkPHP 3.x.x. By providing a specially crafted value[_filename] parameter in the index.php file, an attacker can bypass security measures and gain control over the server. This can lead to various consequences, including unauthorized access, data theft, and further exploitation of the compromised system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization measures to prevent the exploitation of this vulnerability. Ensure that the value[_filename] parameter is properly validated and sanitized before processing it in the index.php file. Here is an example of how to sanitize the parameter using PHP's filter_var function:
$filename = filter_var($_GET['value']['_filename'], FILTER_SANITIZE_STRING);
Conclusion
The ThinkPHP Remote Code Execution (RCE) vulnerability in versions 3.x.x can allow an attacker to execute arbitrary code on a server running ThinkPHP. It is crucial to upgrade to a version higher than 3.2.3 to mitigate the risk. Regularly updating the framework and implementing input validation measures can help prevent the exploitation of this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for topthink/framework →
FAQ
ThinkPHP is a PHP framework used for developing web applications. It provides a range of features and functionalities to simplify the development process.
The vulnerability allows an attacker to execute arbitrary code on a server running ThinkPHP 3.x.x. This can lead to unauthorized access, data theft, and further exploitation of the compromised system.
To fix this vulnerability, it is recommended to upgrade ThinkPHP to a version higher than 3.2.3, which is the last affected version. Regularly updating the framework is also advised to ensure the latest security patches are applied.
As a temporary workaround, you can implement input validation and sanitization measures to prevent the exploitation of this vulnerability. Ensure that the value[_filename] parameter is properly validated and sanitized before processing it in the index.php file.
For more information about the ThinkPHP Remote Code Execution vulnerability, you can refer to the official advisory published on GitHub: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for topthink/framework.
