CVE-2024-40645

{"id": "CVE-2024-40645", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-07-31T19:15:11.870", "references": [{"url": "https://github.com/FOGProject/fogproject/blob/a4bb1bf39ac53c3cbe623576915fbc3b5c80a00f/packages/web/lib/pages/fogconfigurationpage.class.php#L2860-L2896", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FOGProject/fogproject/commit/9469606a18bf8887740cceed6593a2e0380b5e0c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-59mq-q8g5-2f4f", "tags": ["Exploit"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse. This vulnerability is fixed in 1.5.10.41."}, {"lang": "es", "value": "FOG es un sistema de gesti\u00f3n de inventario, clonaci\u00f3n, im\u00e1genes, suite de rescate. Una funci\u00f3n de carga de archivos restringida incorrectamente permite a los usuarios autenticados ejecutar c\u00f3digo arbitrario en el servidor de fogproject. La funci\u00f3n de cambio de marca tiene una verificaci\u00f3n en la imagen del banner del cliente que requiere que tenga 650 p\u00edxeles de ancho y 120 p\u00edxeles de alto. Aparte de eso, no hay controles sobre cosas como las extensiones de archivos. Se puede abusar de esto agregando un webshell PHP al final de la imagen y cambiando la extensi\u00f3n a cualquier cosa que el servidor web PHP analice. Esta vulnerabilidad se solucion\u00f3 en 1.5.10.41."}], "lastModified": "2024-09-05T17:09:16.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDC1FAD4-EE15-41FF-BDF0-685E7885E4F6", "versionEndIncluding": "1.5.10.41", "versionStartIncluding": "1.5.10"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}