Code injection in ezsystems/ezpublish-kernel
The advisory, in context
When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.
The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 7.5.0 before 7.5.26
Fixed in 7.5.26
33 explicitly affected versions
v7.5.0, v7.5.1, v7.5.10, v7.5.11, v7.5.12, v7.5.13, v7.5.14, v7.5.15, v7.5.15.1, v7.5.15.2, v7.5.16, v7.5.17, v7.5.18, v7.5.19, v7.5.2, v7.5.20, v7.5.21, v7.5.22, v7.5.23, v7.5.24, v7.5.25, v7.5.3, v7.5.4, v7.5.5, v7.5.6, v7.5.6-rc1, v7.5.6.2, v7.5.7, v7.5.7-rc1, v7.5.7.1, v7.5.8, v7.5.9, v7.5.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.5.0"
},
{
"fixed": "7.5.26"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.5.0",
"v7.5.1",
"v7.5.10",
"v7.5.11",
"v7.5.12",
"v7.5.13",
"v7.5.14",
"v7.5.15",
"v7.5.15.1",
"v7.5.15.2",
"v7.5.16",
"v7.5.17",
"v7.5.18",
"v7.5.19",
"v7.5.2",
"v7.5.20",
"v7.5.21",
"v7.5.22",
"v7.5.23",
"v7.5.24",
"v7.5.25",
"v7.5.3",
"v7.5.4",
"v7.5.5",
"v7.5.6",
"v7.5.6-rc1",
"v7.5.6.2",
"v7.5.7",
"v7.5.7-rc1",
"v7.5.7.1",
"v7.5.8",
"v7.5.9",
"v7.5.9.1"
]
}