CVE-2024-45398: Remote command execution through file upload in contao/core-bundle
Impact
Back end users with access to the file manager can upload malicious files and execute them on the server.
Patches
Update to Contao 4.13.49, 5.3.15 or 5.4.3.
Workarounds
Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.
References
https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Jakob Steeg from usd AG for reporting this vulnerability.
Other sources
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45398?
CVE-2024-45398 is considered a critical vulnerability due to its potential for remote command execution.
How do I fix CVE-2024-45398?
To fix CVE-2024-45398, update to Contao version 4.13.49, 5.3.15, or 5.4.3.
What type of vulnerability is CVE-2024-45398?
CVE-2024-45398 is a remote command execution vulnerability that allows attackers to upload and execute malicious files on the server.
Which Contao versions are affected by CVE-2024-45398?
CVE-2024-45398 affects Contao versions prior to 4.13.49, 5.3.15, and 5.4.3.
Are there any workarounds for CVE-2024-45398?
A workaround for CVE-2024-45398 is to configure your web server to disable the execution of PHP files and other scripts in the Contao file manager.