CVE-2019-9858 Path traversal in n/a
Attackers can exploit path traversal in image upload handling to write PHP backdoors to the web root, achieving remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9858?
CVE-2019-9858 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 29 May 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)
Weakness: CWE-22
Which versions are affected by CVE-2019-9858?
It affects 2 products.
Products include Debian Debian Linux, Horde Groupware.
How do I fix CVE-2019-9858?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-9858 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-9858 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-9858, DLA-1822-1, DSA-4468-1, GHSA-mhgr-3vxf-9f79, UBUNTU-CVE-2019-9858.