CVE-2023-48217

Remote code execution via form uploads in statamic/cms

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Statamic es un CMS plano con tecnología Laravel + Git diseñado para crear sitios web. En las versiones afectadas, es posible cargar ciertos archivos PHP adicionales manipulados para que parezcan imágenes, independientemente de las reglas de validación del tipo MIME. Esto afecta los formularios de front-end que utilizan la función "Formularios" y los campos de carga de activos en el panel de control. Los usuarios malintencionados podrían aprovechar esta vulnerabilidad para cargar y ejecutar código. Este problema se solucionó en las versiones 3.4.14 y 4.34.0. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2023-11-13 CVE Reserved
2023-11-14 CVE Published
2024-08-30 CVE Updated
2024-10-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-434: Unrestricted Upload of File with Dangerous Type

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411	2023-11-22

URL	Date	SRC
https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86	2023-11-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Statamic Search vendor "Statamic"		Statamic Search vendor "Statamic" for product "Statamic"				< 3.4.14 Search vendor "Statamic" for product "Statamic" and version " < 3.4.14"		-		Affected
Statamic Search vendor "Statamic"		Statamic Search vendor "Statamic" for product "Statamic"				>= 4.0.0 < 4.34.0 Search vendor "Statamic" for product "Statamic" and version " >= 4.0.0 < 4.34.0"		-		Affected