CVE-2016-15017 (published 2023-01-10T15:15Z)

A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/fabarea/media_upload
commit_details: repo_url: https://github.com/fabarea/media_upload
author: Fabien Udriot
author_date: 2016-07-24 19:31:39+02:00
msg: [SECURITY] Prevent directory traversal

Resolves #6
repository: repo_url: https://github.com/fabarea/media_upload
repo_name: fabarea/media_upload
description: (Mass) upload Media on the Frontend - TYPO3 CMS extension
repo_language: JavaScript
owner: fabarea
file_changes: filename: UploadFileService.php
change_type: ModificationType.MODIFY
diff: @@ -34,33 +34,35 @@ class UploadFileService
      * Return an array of uploaded files, done in a previous step.
      *
      * @param string $property
-     * @throws \Exception
      * @return UploadedFile[]
+     * @throws \InvalidArgumentException
+     * @throws \RuntimeException
      */
     public function getUploadedFiles($property = '')
     {
-
         $files = array();
         $uploadedFiles = GeneralUtility::trimExplode(',', $this->getUploadedFileList($property), TRUE);
 
         // Convert uploaded files into array
         foreach ($uploadedFiles as $uploadedFileName) {
 
-            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . '/' . $uploadedFileName;
+            // Protection against directory traversal
+            $uploadedFileName = str_replace('..' . DIRECTORY_SEPARATOR, '', $uploadedFileName);
+            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . DIRECTORY_SEPARATOR . $uploadedFileName;
 
             if (!file_exists($temporaryFileNameAndPath)) {
                 $message = sprintf(
                     'I could not find file "%s". Something went wrong during the upload? Or is it some cache effect?',
                     $temporaryFileNameAndPath
                 );
-                throw new \Exception($message, 1389550006);
+                throw new \RuntimeException($message, 1389550006);
             }
             $fileSize = round(filesize($temporaryFileNameAndPath) / 1000);
 
             /** @var UploadedFile $uploadedFile */
             $uploadedFile = GeneralUtility::makeInstance(UploadedFile::class);
             $uploadedFile->setTemporaryFileNameAndPath($temporaryFileNameAndPath)
-                ->setFileName($uploadedFileName)
+                ->setFileName(basename($uploadedFileName))
                 ->setSize($fileSize);
 
             $files[] = $uploadedFile;

programming_language: PHP