Summary
This is a medium-risk vulnerability because it allows full compromise of the integrity of the container but cannot access the filepath outside of this container. This would serve as an attack that an attacker can mount when gaining access to the exposed upload functionality, changing any configuration file inside the container, or uploading malicious scripts depending on the allow list of extensions allowed. The threat increases when file upload paths are shared among several key components of the system.
The core issue here is input validation and sanitisation while uploading. Statamic CMS does not enforce the use of commonly abused characters. So, it’s vulnerable to several path traversal attacks that may attempt to access files outside the restriction using directory traversal sequences like ../. This vulnerability is also exacerbated because the application relies on the filename in order to know where it should store it.
First, this vulnerability requires an attacker to gain access to a form or upload endpoint that eventually processes user supplied files. Once this has been achieved, the attacker will be in a position to construct a filename devised to traverse directories and deposit the file into a location of his or her choice. Functionality of this upload system is intended to be used by anyone, including unauthenticated users.
Proof of concept
The PoC can be found on youtube here: https://youtu.be/pK-KloyCIzw
How to fix
Upgrade to Statamic CMS 5.17.0 or greater.
Acknowledgements
I would like to thank everyone at Bastion Security for their support as I was welcomed in for my first cyber security job, and for helping with all my questions, I am proud to be one of you!
Vulnerability disclosure timeline
- 18/11/2024 - Issue Disclosed
- 19/11/2024 - Vendor Responded
- 19/11/2024 - CVE Assigned (CVE-2024-52600)
- 25/11/2024 - Bastion Publishes Advisory