CVE-2008-6178: Code Injection
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or block the FileUpload action for uploads with the application/zip content type in the FCKeditor PHP connector to prevent uploading ZIP files that can contain embedded PHP code.
FCKeditor connector (editor/filemanager/browser/default/connectors/php/connector.php) allow FileUpload of application/zip = disabled - Configuration
Configure the web server to prevent execution of PHP in the UserFiles/File directory (for example, remove or disable the PHP handler for that directory, add appropriate directives to deny execution, or serve files from that directory as static content only).
Web server configuration for UserFiles/File directory PHP execution in /UserFiles/File = disabled - Compensating control
Prevent direct public access to the UserFiles/File directory (for example, restrict access via webserver rules or firewall/ACLs so uploaded files cannot be directly requested) to mitigate exploitation of uploaded files.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6178?
CVE-2008-6178 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2008-6178?
To fix CVE-2008-6178, you should upgrade to a patched version of FCKeditor or apply relevant security patches provided by the vendors.
What type of vulnerability is CVE-2008-6178?
CVE-2008-6178 is an unrestricted file upload vulnerability that allows attackers to upload malicious PHP files.
Which applications are affected by CVE-2008-6178?
CVE-2008-6178 affects FCKeditor versions 2.0rc2, 2.0rc3, 2.2, as well as various versions of Phplist CMS.
Can CVE-2008-6178 lead to data theft?
Yes, CVE-2008-6178 can potentially lead to data theft as it allows remote attackers to execute arbitrary code on the server.