Pixlogix_Flexibleforms

[gwillem]

FYI we found malicious PHP code in the media/flexibleforms/files/ on two separate installs, one running 2.0.1 (M2) and one running 0.5.0. Should look into the vuln and affected versions (cannot tell if 2.0.1 was compromised or an older version).

Edit: we contacted the vendor last month but they did not reply

[JerVoo]

Pixlogix_Flexibleforms can also be used to inject malicious code into Magento 1 stores, we discovered yesterday.

The extension doesn't have any form of protection against unwanted file uploads. A file can be uploaded using the module's submit actions, which will then be stored in media/flexibleforms/files and will become publicly available. The uploaded file we've discovered, contained an eval() method, which can evaluate PHP code that is posted to the file.

[gwillem]

@JerVoo thanks for confirmation. Which version are you describing?

[JerVoo]

Every version to be honest. I discovered the vulnerability in v0.7.0, but the latest version (v1.0.13) has still got the same vulnerability built in.

The module doesn't check for allowed file types. In the code there is a reference to a list of allowed file extensions, but it's impossible to define which file extensions are allowed, nor is there a list of allowed extensions defined anywhere in the code.

[gwillem]

Cheers, want to make a PR for M1 ? https://github.com/sansecio/magevulndb/blob/master/magento1-vulnerable-extensions.csv