CVE-2024-47049 czim/file-handling vulnerable to SSRF and directory traversal
Attackers can exploit improper URL validation to perform Server-Side Request Forgery and read local files via directory traversal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47049?
CVE-2024-47049 is a high-severity server-side request forgery vulnerability in n/a, published on 17 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.
Which versions are affected by CVE-2024-47049?
4 open source packages ship an affected version, including czim/file-handling. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
czim/file-handling Packagist | All versions | 1.5.0 |
czim/file-handling Packagist | All versions | 1.5.0 |
czim/file-handling Packagist | From 2.0.0 | 2.3.0 |
czim/file-handling Packagist | From 2.0.0 | 2.3.0 |
Products include Czim File-Handling.
How do I fix CVE-2024-47049?
Upgrade czim/file-handling to a fixed version for your release line: 1.5.0 or 2.3.0.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-47049 being exploited?
There is no known exploitation of CVE-2024-47049 in the wild and no public exploit code.
Sources
Also known as GHSA-6rgh-r6j3-3223.