Summary
This medium-risk vulnerability allows attackers to fully compromise the container's integrity but does not grant access to file paths beyond the container itself. If the upload functionality is exposed, an attacker could exploit it to modify configuration files or upload malicious scripts, depending on the permitted file types. The risk increases when upload paths are shared across critical system components.
At the core of this issue is insufficient input validation and sanitisation during file uploads. Statamic CMS does not properly restrict characters commonly used in path traversal attacks. As a result, attackers can use sequences like ../ to bypass directory restrictions. The vulnerability is further worsened by the system’s reliance on the user-supplied filename to determine the file storage location.
To exploit this flaw, an attacker needs access to a form or upload endpoint that accepts file submissions. Once access is gained, they can craft a malicious filename to navigate directories and place files in unintended locations. This risk is significant because the upload feature is intended for public use, even by unauthenticated users.
Proof of Concept
A demonstration is available here:
👉 https://youtu.be/pK-KloyCIzw
How to Fix
Upgrade to Statamic CMS version 5.17.0 or later, where the issue has been addressed.
Vulnerability Disclosure Timeline
- 18/11/2024 – Issue disclosed
- 19/11/2024 – Vendor acknowledged
- 19/11/2024 – CVE assigned (CVE-2024-52600)
- 25/11/2024 – Cythera publishes advisory
