CVE-2018-19458 Unauthenticated File Read in PHP Proxy

High 7.5 Published 22 Nov 2018 Updated 16 Sep 2024

Unauthenticated attackers can read arbitrary server files via a Local File Inclusion vulnerability in PHP Proxy.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-19458?

CVE-2018-19458 is a high-severity path traversal vulnerability in n/a, published on 22 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.

Weakness: CWE-287

Which versions are affected by CVE-2018-19458?

2 open source packages ship an affected version, including athlon1600/php-proxy-app. It affects 1 product.

Package	Affected	Fixed in
`athlon1600/php-proxy-app` Packagist	All versions to `3.0`	None
`athlon1600/php-proxy-app` Packagist	All versions to `3.0`	None

Products include Php-Proxy Php-Proxy.

How do I fix CVE-2018-19458?

No fix has been published for CVE-2018-19458 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-19458 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-19458 exists.

Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.

Sources

Also known as GHSA-3x3m-p2wx-g7cw.