RCE via upload addons plugin

[tranquac]

RCE via upload addon plugin It was identified that an authenticated user (admin) has the possibility to upload malicious files without any restriction. In this specific case, arbitrary server side PHP code such as web shells can be uploaded. As a result the attacker can run arbitrary code on the server side with the privileges of the web server. This could lead to a full system compromise.

To Reproduce Steps to reproduce the behavior:

1. Login to flatcore CMS (admin user)
2. Click on 'Addons'
3. Click on 'Install'
4. Click on 'Plugin'
5. Choose a malious PHP file (revershell, webshell...), example is shell.php
6. URL for malious PHP file: http://domain/upload/plugins/shell.php

Screenshots

• This POC for vuln : https://www.youtube.com/watch?v=yoFkkgM1P8E

Desktop (please complete the following information):

• OS: tested in Linux
• Browser : All
• Version : Last version

Additional context This vulnerability is extremely serious affecting the system. An attacker can take control of the entire server.

[tranquac]

@patkon Can you help me check issue this? Looking forward to hearing from you. Thank.

[patkon]

In order to install addons afterwards, the upload of PHP files must be possible. Everyone should be aware that this can lead to security problems. I think I'll add a "super admin" to rights management. Possibly with an additional password entry before the upload can start. And additional safety information. Or do you have an idea how to add addons to the system?

[tranquac]

• This my idea for this issue:
• If that module does not need to use functions to interact with the os shell, disable it (system, exec, shell_exec, passthru...).
• Set permission limit read write system file permission.