GHSA-mmj4-63m4-r6h5: CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations.
Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe extension check, such as extin on patched versions - save uploaded files using the client-supplied filename - place uploads in a web-accessible directory where PHP files can execute
Patches Upgrade to v4.7.4 or later.
Workarounds - Save uploads outside the public web root, preferably under writable/uploads. - Use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving the original client filename. - Disable script execution in any public upload directory. - Manually verify the client filename extension before moving the file. - For image uploads, reject files when $file->getClientExtension() is not an allowed image extension. - For exact MIME-type validation, reject files when $file->getClientExtension() does not match $file->guessExtension().
Other sources
CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/codeigniter4/frameworkto a version that resolves this vulnerability.Fixed in 4.7.4 - Upgrade
Upgrade
CodeIgniterto a version that resolves this vulnerability.Fixed in 4.7.4 - Configuration
For exact MIME-type validation, reject files when $file->getClientExtension() does not match $file->guessExtension(); for image uploads, reject files when the client extension is not an allowed image extension, and use an independent safe extension check such as ext_in.
CodeIgniter upload validation independent safe extension validation = reject mismatches - Configuration
Disable script execution in any public upload directory.
Public upload directories script execution = disabled - Configuration
Save uploads outside the public web root, preferably under writable/uploads.
Uploaded files storage location = outside the public web root - Configuration
Use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving the original client filename; manually verify the client filename extension before moving the file.
Uploaded files filename = random generated filename
Event History
Frequently Asked Questions
What is the severity of GHSA-mmj4-63m4-r6h5?
The severity of GHSA-mmj4-63m4-r6h5 is critical with a score of 9.8.
How do I fix GHSA-mmj4-63m4-r6h5?
To fix GHSA-mmj4-63m4-r6h5, ensure that file uploads are validated with both safe extension checks and appropriate MIME type checks.
What happens if GHSA-mmj4-63m4-r6h5 is exploited?
Exploiting GHSA-mmj4-63m4-r6h5 can lead to remote code execution on the vulnerable application.
Which software is affected by GHSA-mmj4-63m4-r6h5?
The vulnerability GHSA-mmj4-63m4-r6h5 affects the composer/codeigniter4/framework software.
What type of vulnerability is GHSA-mmj4-63m4-r6h5 categorized as?
GHSA-mmj4-63m4-r6h5 is categorized as a Malicious File Upload vulnerability.