CVE-2021-23814: Unisharp/laravel filemanager Unrestricted Upload Of File With Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f8x6-m9f5-ffp8",
  "modified" : "2024-04-22T19:10:22Z",
  "published" : "2022-01-06T21:08:34Z",
  "aliases" : [ "CVE-2021-23814" ],
  "summary" : "Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager",
  "details" : "This affects the package unisharp/laravel-filemanager prior to version 2.6.2. The `upload()` function does not sufficiently validate the file type when uploading.\n\nAn attacker may be able to reproduce the following steps:\n- Install a package with a web Laravel application.\n- Navigate to the Upload window\n- Upload an image file, then capture the request\n- Edit the request contents with a malicious file (webshell)\n- Enter the path of file uploaded on URL\n- Remote Code Execution\n\n**Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "unisharp/laravel-filemanager"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.6.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-23814"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/UniSharp/laravel-filemanager/issues/1113#issuecomment-1812092975"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/UniSharp/laravel-filemanager/commit/bd84899ce65a7f193e676dd8444e424fa50f64fa"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/UniSharp/laravel-filemanager"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php#L26"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php%23L26"
  }, {
    "type" : "WEB",
    "url" : "https://snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-434" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-01-04T18:05:21Z",
    "nvd_published_at" : "2021-12-17T20:15:00Z"
  }
}