CVE-2020-28337 Zip slip in Microweber

High 7.2 Published 15 Feb 2021 Updated 4 Aug 2024

An authenticated administrator can achieve remote code execution by uploading a malicious ZIP file with path traversal sequences and restoring it.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-28337?

CVE-2020-28337 is a high-severity path traversal vulnerability in Microweber Microweber, published on 15 Feb 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.

Weakness: CWE-22

Which versions are affected by CVE-2020-28337?

2 open source packages ship an affected version, including microweber/microweber. It affects 1 product.

Package	Affected	Fixed in
`microweber/microweber` Packagist	All versions	`1.2.3`
`microweber/microweber` Packagist	All versions	`1.2.3`

Products include Microweber Microweber.

How do I fix CVE-2020-28337?

Upgrade microweber/microweber to 1.2.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-28337 being exploited?

There is no known exploitation of CVE-2020-28337 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

All Microweber Microweber vulnerabilities

Sources

Also known as GHSA-pqcf-v8v5-jmcg.