GHSA-mmj4-63m4-r6h5: Malicious File Upload
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations.
Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe extension check, such as extin on patched versions - save uploaded files using the client-supplied filename - place uploads in a web-accessible directory where PHP files can execute
Patches Upgrade to v4.7.4 or later.
Workarounds - Save uploads outside the public web root, preferably under writable/uploads. - Use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving the original client filename. - Disable script execution in any public upload directory. - Manually verify the client filename extension before moving the file. - For image uploads, reject files when $file->getClientExtension() is not an allowed image extension. - For exact MIME-type validation, reject files when $file->getClientExtension() does not match $file->guessExtension().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/codeigniter4/frameworkto a version that resolves this vulnerability.Fixed in 4.7.4 - Upgrade
Upgrade
unknown (application)to a version that resolves this vulnerability.Fixed in 4.7.4 - Configuration
Disable script execution in any public upload directory.
File upload handling Public upload directory script execution = disabled - Configuration
Reject files when `$file->getClientExtension()` does not match `$file->guessExtension()` (for exact MIME-type validation).
File upload validation Extension validation (client vs guessed) = reject on mismatch - Configuration
For image uploads, reject files when `$file->getClientExtension()` is not an allowed image extension.
Image uploads Allowed image extension enforcement = reject if not allowed - Configuration
Manually verify the client filename extension before moving the file.
File upload processing Client filename extension verification before move = manual verify before moving - Configuration
Save uploads outside the public web root, preferably under `writable/uploads`.
Filesystem placement for uploads Upload storage location = outside public web root (e.g., writable/uploads) - Configuration
Use `$file->store()` or `$file->move($path, $file->getRandomName())` instead of preserving the original client filename.
File upload saving Preserve original client filename = do not preserve; use random name
Event History
Frequently Asked Questions
What is the severity of GHSA-mmj4-63m4-r6h5?
The severity of GHSA-mmj4-63m4-r6h5 is critical with a score of 9.8.
How do I fix GHSA-mmj4-63m4-r6h5?
To fix GHSA-mmj4-63m4-r6h5, ensure that file uploads are validated with both safe extension checks and appropriate MIME type checks.
What happens if GHSA-mmj4-63m4-r6h5 is exploited?
Exploiting GHSA-mmj4-63m4-r6h5 can lead to remote code execution on the vulnerable application.
Which software is affected by GHSA-mmj4-63m4-r6h5?
The vulnerability GHSA-mmj4-63m4-r6h5 affects the composer/codeigniter4/framework software.
What type of vulnerability is GHSA-mmj4-63m4-r6h5 categorized as?
GHSA-mmj4-63m4-r6h5 is categorized as a Malicious File Upload vulnerability.