CVE-2022-40797: Malicious File Upload

Published Nov 9, 2022

Updated

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDENUPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)

Affected Software

1 affected component

Roxyfileman Roxy Fileman=1.4.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Roxy Fileman to a version that resolves this vulnerability.
Fixed in 1.4.6
Configuration
In conf.json, update FORBIDDEN_UPLOADS so it also blocks .phar uploads (current default only blocks .php, .php4, and .php5).
Roxy Fileman conf.json FORBIDDEN_UPLOADS = .php,.php4,.php5,.phar

Event History

Nov 9, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-40797?

CVE-2022-40797 has a critical severity rating as it allows remote code execution due to improper file upload restrictions.

How do I fix CVE-2022-40797?

To mitigate CVE-2022-40797, configure the FORBIDDEN_UPLOADS setting in conf.json to block .phar file uploads.

What are the potential impacts of CVE-2022-40797?

The potential impacts of CVE-2022-40797 include unauthorized remote code execution, which could lead to complete system compromise.

Which version of Roxy Fileman is affected by CVE-2022-40797?

Roxy Fileman version 1.4.6 is affected by CVE-2022-40797.

Is CVE-2022-40797 specific to any web server configuration?

Yes, CVE-2022-40797 is particularly relevant in web server configurations that invoke the PHP interpreter for .phar files.