CVE-2022-24800: October CMS upload process vulnerable to RCE via Race Condition
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.83741%
CWE
Published
7/13/2022
Updated
1/27/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| october/system | composer | < 1.0.476 | 1.0.476 |
| october/system | composer | >= 1.1.0, < 1.1.12 | 1.1.12 |
| october/system | composer | >= 2.0.0, < 2.2.15 | 2.2.15 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from the File::fromData method's handling of user-supplied filenames. The original code used the user-provided filename directly to create a temporary file path (via temp_path(basename($filename))), allowing attackers to predict the temporary file's location. This predictability enabled a race condition where an attacker could write a malicious payload to the temporary file and execute it before the system deleted it. The patch introduced a randomized temporary filename (via uniqid()), breaking the predictability. The commit diff confirms this critical change occurred in the fromData method's logic.