Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| backpack/crud | composer | >= 6.0.0, < 6.8.14 | 6.8.14 |
| backpack/crud | composer | >= 7.0.0, < 7.0.38 | 7.0.38 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the handling of base64 encoded file uploads in the Backpack CRUD for Laravel. The core of the issue is in the SingleBase64Image uploader, specifically in the uploadFiles and uploadRepeatableFiles methods. These methods would accept any string that started with data:image, decode the base64 part, and save it to disk. There was no validation of the actual file type or its contents. This allowed an authenticated user to upload malicious files, such as an SVG containing JavaScript, which could lead to stored Cross-Site Scripting (XSS).
Aiding this vulnerability was a bug in FileNameGenerator::getExtensionFromFile. When processing a data URI, it failed to extract a file extension, causing the uploaded file to be saved without one. This could help in bypassing security measures that rely on file extensions.
The patch addresses these issues by:
validateAndDecodeBase64Image in SingleBase64Image.php. This method uses a whitelist of allowed MIME types (image/jpeg, image/png, image/gif, image/webp, image/avif) and also uses finfo to verify the actual file content's MIME type after decoding.uploadFiles and uploadRepeatableFiles to use this new validation method.FileNameGenerator::getExtensionFromFile to correctly parse the MIME type from data URIs, ensuring a proper file extension is generated.Backpack\CRUD\app\Library\Uploaders\SingleBase64Image::uploadFilessrc/app/Library/Uploaders/SingleBase64Image.php
Backpack\CRUD\app\Library\Uploaders\SingleBase64Image::uploadRepeatableFilessrc/app/Library/Uploaders/SingleBase64Image.php
Backpack\CRUD\app\Library\Uploaders\Support\FileNameGenerator::getExtensionFromFilesrc/app/Library/Uploaders/Support/FileNameGenerator.php