Miggo Logo
Miggo Vulnerability Database
→
GHSA-gv2c-5g79-h73c

GHSA-gv2c-5g79-h73c: Ibexa ezplatform-kernel download route allows filename change

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-gv2c-5g79-h73c
EPSS Score
-
CWE
-
Published
11/3/2023
Updated
11/16/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
ezsystems/ezplatform-kernelcomposer>= 1.3.0, < 1.3.341.3.34

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the downloadBinaryFileAction method accepting a user-provided 'filename' parameter. The commit diff shows this parameter was removed from the Content-Disposition header generation and replaced with $field->value->fileName. This indicates the original implementation's direct use of user input for filenames was the root cause. The routing change from redirectToContentDownloadAction to downloadBinaryFileByIdAction further confirms the attack surface was in the original filename handling logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** rout* us** *or *il* *ownlo**s *llows sp**i*yin* t** n*m* o* t** *ownlo**** *il*. T*is is *n unint*n*** si** *****t o* t** impl*m*nt*tion, *n* m**ns on* *oul* *onstru*t *ownlo** URLs wit* *il*n*m*s t**t **v* no r*l*tion to t** **tu*l *i

Reasoning

T** vuln*r**ility st*ms *rom t** *ownlo***in*ry*il***tion m*t*o* ****ptin* * us*r-provi*** '*il*n*m*' p*r*m*t*r. T** *ommit *i** s*ows t*is p*r*m*t*r w*s r*mov** *rom t** *ont*nt-*isposition *****r **n*r*tion *n* r*pl**** wit* $*i*l*->v*lu*->*il*N*m*