CVE-2019-19745: Unrestricted file uploads
Impact
A back end user with access to the form generator can upload arbitrary files and execute them on the server.
Patches
Update to Contao 4.4.46 or 4.8.6.
Workarounds
Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.
References
https://contao.org/en/security-advisories/unrestricted-file-uploads
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/contao/contaoto a version that resolves this vulnerability.Fixed in 4.8.6 - Upgrade
Upgrade
composer/contao/contaoto a version that resolves this vulnerability.Fixed in 4.4.46 - Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 4.8.6 - Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 4.4.46 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 4.4.46 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 4.8.6 - Configuration
Configure the web server so PHP files and other scripts are not executed in the Contao file upload directory.
Web server Script execution in the Contao file upload directory = disabled
Event History
Frequently Asked Questions
What is CVE-2019-19745?
CVE-2019-19745 is a vulnerability that allows attackers to upload files without proper validation, leading to potential remote code execution.
How does the unrestricted file uploads vulnerability work?
The unrestricted file uploads vulnerability allows attackers to bypass file upload restrictions and upload malicious files to the server.
Which software versions are affected by CVE-2019-19745?
The affected software versions include Contao versions 4.0.0 to 4.4.46, 4.5.0 to 4.6.0, 4.6.0 to 4.7.0, 4.7.0 to 4.8.0, and 4.8.0 to 4.8.6.
What is the severity of CVE-2019-19745?
CVE-2019-19745 is considered a high severity vulnerability.
How can I fix CVE-2019-19745?
To fix CVE-2019-19745, update Contao or Core Bundle to a version higher than the affected ones, as mentioned in the security advisories provided by Contao.