PHP file inclusion in the Sulu admin panel
Impact
_What kind of vulnerability is it? Who is impacted?_
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.6.44Ecosystem versions | 1.6.44 |
| From 2.0.0 before 2.2.18Ecosystem versions | 2.2.18 |
| From 2.3.0 before 2.3.8Ecosystem versions | 2.3.8 |
| From 2.4.0-RC1 before 2.4.0Ecosystem versions | 2.4.0 |
Version evidence: OSV · GHSA-vx6j-pjrh-vgjh
View original version evidence (261 explicit versions)
Original source description
Impact
What kind of vulnerability is it? Who is impacted?
An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.
- Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
- Exploitation pre-requisite: User account on the backend
Patches
Has the problem been patched? What versions should users upgrade to?
The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.
References
Are there any links users can visit to find out more?
Currently not.
For more information
If you have any questions or comments about this advisory:
- Open an issue in example link to repo
- Email us at example email address