CVE-2022-24800: Race Condition in October CMS upload process
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the October\Rain\Database\Attach\File::fromData as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24800?
CVE-2022-24800 is a vulnerability found in October/System, the system module for October CMS.
What is October CMS?
October CMS is a self-hosted CMS platform based on the Laravel PHP Framework.
What is the severity of CVE-2022-24800?
CVE-2022-24800 has a severity level of high (8.1).
How does CVE-2022-24800 affect October CMS?
CVE-2022-24800 affects October CMS versions 1.0.476, 1.1.0 to 1.1.12, and 2.0.0 to 2.2.15.
How can an unauthenticated user exploit CVE-2022-24800?
An unauthenticated user can exploit CVE-2022-24800 by performing remote code execution when the developer allows the user to specify their own filename in the `fromData` method.