Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read
Flextype CMS v1.0.0-alpha.3 stores unsanitized expressions in entries, letting privileged authenticated users achieve arbitrary file read when fields are parsed.
Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression injection flaw in the Entries ExpressionsDirective. An authenticated user with privileges to create or modify entries can persist arbitrary expression syntax in an entry field. When the field is later retrieved or processed, the stored value is passed to parsers()->expressions()->parse(), leading to arbitrary file read on the server.
- Stored expression syntax in entry fields is parsed via parsers()->expressions()->parse()
- Requires privileges to create or modify entries
- Impact is arbitrary file read when affected fields are processed
- Vendors
- Flextype
- Products
- Flextype CMS
From the original article
Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.