CVE-2021-32708: League/flysystem Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
CRITICALCVE-2021-32708 is a CRITICAL (CVSS 9.8) time-of-check time-of-use (toctou) race condition vulnerability (CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition) affecting League/flysystem libraries in the Packagist ecosystem. The issue involves time-of-check time-of-use (toctou) race condition in league/flysystem. Remediation is available by upgrading affected packages to version 1.1.4, 2.1.1.
CVE-2021-32708 at a Glance
Security Impact
CVSS: 9.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2021-32708
To remediate this vulnerability, upgrade all affected League/flysystem dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade league/flysystem to 1.1.4Upgrade league/flysystem to 2.1.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for league/flysystemHow to Check if You Are Affected
To determine whether your application is affected by CVE-2021-32708, inspect your project dependencies for League/flysystem:
inspect dependencies for league/flysystemAnalyze the terminal output to locate any version of League/flysystem in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.1.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, where the product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. In League/flysystem, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-32708 Affected League/flysystem Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
league/flysystem
|
Packagist |
< 1.1.4
|
1.1.4
|
|
league/flysystem
|
Packagist |
≥ 2.0.0
< 2.1.1
|
2.1.1
|
References
Frequently Asked Questions
What is CVE-2021-32708?
Which League/flysystem versions are affected?
What version fixes CVE-2021-32708?
Is league/flysystem affected?
What is the CVSS score of CVE-2021-32708?
What CWE is associated with CVE-2021-32708?
How can I check Packagist dependencies for CVE-2021-32708?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9f46-5r25-5wfm",
"modified" : "2021-09-21T14:55:38Z",
"published" : "2021-06-29T03:13:28Z",
"aliases" : [ "CVE-2021-32708" ],
"summary" : "Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem",
"details" : "### Impact\n\nThe whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.\n\nThe conditions: \n\n- A user is allowed to supply the path or filename of an uploaded file.\n- The supplied path or filename is not checked against unicode chars.\n- The supplied pathname checked against an extension deny-list, not an allow-list.\n- The supplied path or filename contains a unicode whitespace char in the extension.\n- The uploaded file is stored in a directory that allows PHP code to be executed.\n\nGiven these conditions are met a user can upload and execute arbitrary code on the system under attack.\n\n### Patches\n\nThe unicode whitespace removal has been replaced with a rejection (exception).\n\nThe library has been patched in:\n- 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32\n- 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74\n\n### Workarounds\n\nFor 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "league/flysystem"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.1.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "league/flysystem"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.1.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfm"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-32708"
}, {
"type" : "WEB",
"url" : "https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74"
}, {
"type" : "WEB",
"url" : "https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/league/flysystem/CVE-2021-32708.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/thephpleague/flysystem"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWPTENBYKI2IG47GI4DHAACLNRLTWUR5"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNZSWK4GOMJOOHKLZEOE5AQSLC4DNCRZ"
}, {
"type" : "WEB",
"url" : "https://packagist.org/packages/league/flysystem"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-367" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2021-06-24T18:03:15Z",
"nvd_published_at" : "2021-06-24T17:15:00Z"
}
}