-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a path traversal weakness in the backup creation functionality of the Redaxo Backup addon. The analysis of the provided security advisory and the associated patch confirms that the root cause is the lack of input validation on the EXPDIR POST parameter, which specifies the directories to be included in a file backup.
The investigation started by identifying the relevant code changes between the vulnerable version (<= 5.20.1) and the patched version (5.20.2). By comparing the git tags, a commit with the message "Backup: validate selected export dirs" was identified as the security patch.
The patch exclusively modifies the file redaxo/src/addons/backup/pages/export.php. This script is the entry point that handles the backup export request. It retrieves the EXPDIR parameter from the user's POST request. The patch introduces code to intersect the user-provided directories with an allowlist of valid directories, effectively sanitizing the input.
The advisory points out that the unsanitized input was being used in redaxo/src/addons/backup/lib/backup.php. An examination of the codebase reveals that export.php instantiates the rex_backup class and calls its doExport method, passing the unsanitized $EXPDIR array. The rex_backup::doExport function then iterates through the provided directory paths and adds them to the backup archive. It is within this function that the path traversal occurs, as it concatenates the user-provided path with the base directory without proper sanitization.
Therefore, while the patch is in export.php, the function that would appear in a runtime profile during exploitation is rex_backup::doExport, as it is the function that directly processes the malicious input and performs the vulnerable file operation.
rex_backup::doExportredaxo/src/addons/backup/lib/backup.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| redaxo/source | composer | <= 5.20.1 | 5.20.2 |