Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-38916

CVE-2022-38916: Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-38916
GHSA ID
GHSA-4v5m-vwvp-p7w8
EPSS Score
0.90619%
CWE
CWE-434
Published
9/21/2022
Updated
1/31/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pagekit/pagekitcomposer<= 1.0.18

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description and GitHub issue indicate improper file type validation in the storage feature. The attack pattern (modifying filenames via Burp Suite) suggests missing server-side validation after client-side restrictions. Pagekit's architecture would handle uploads through its Filesystem component and StorageController. These components would be responsible for file validation and storage operations, making them prime candidates for the vulnerability. The high confidence comes from the attack vector matching typical unrestricted upload vulnerabilities in PHP frameworks and the explicit mention of storage feature involvement.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *il* uplo** vuln*r**ility *xists in t** stor*** ***tur* o* p***kit *.*.**, w*i** *llows *n *tt**k*r to uplo** m*li*ious *il*s

Reasoning

T** vuln*r**ility **s*ription *n* *it*u* issu* in*i**t* improp*r *il* typ* v*li**tion in t** stor*** ***tur*. T** *tt**k p*tt*rn (mo*i*yin* *il*n*m*s vi* *urp Suit*) su***sts missin* s*rv*r-si** v*li**tion **t*r *li*nt-si** r*stri*tions. P***kit's *r