Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the file validation logic of CodeIgniter4's FileRules strict validation class. Specifically, the is_image and mime_in validation rules failed to properly validate the file extension provided by the client. The functions only checked the MIME type derived from the file's content (the first few bytes, or magic numbers). This allowed an attacker to bypass the validation by crafting a file with a legitimate MIME type (e.g., by adding a GIF header) but with a malicious file extension (e.g., .php). When the application saves the uploaded file using its original client-supplied name in a web-accessible directory, this could lead to remote code execution.
The patch addresses this by introducing two new private helper methods, hasInvalidImageClientExtension and hasMismatchedClientExtension, which are now called from within is_image and mime_in respectively. These new checks ensure that the client-provided file extension is also validated, either by checking if it corresponds to an image type (is_image) or by ensuring it matches the extension guessed from the file's actual content (mime_in). The analysis of the commit b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa clearly shows the addition of these checks as the mitigation for the vulnerability, thus identifying is_image and mime_in as the vulnerable functions.
CodeIgniter\Validation\StrictRules\FileRules::is_imagesystem/Validation/StrictRules/FileRules.php
CodeIgniter\Validation\StrictRules\FileRules::mime_insystem/Validation/StrictRules/FileRules.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codeigniter4/framework | composer | < 4.7.4 | 4.7.4 |