CVE-2020-10212

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/trippo/ResponsiveFilemanager/issues/598	Exploit Issue Tracking Third Party Advisory
https://github.com/trippo/ResponsiveFilemanager/issues/598	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tecrail:responsive_filemanager:9.13.4:::::::*
	cpe:2.3:a:tecrail:responsive_filemanager:9.14.0:::::::*

History

21 Nov 2024, 04:54

Type	Values Removed	Values Added
References	~~() https://github.com/trippo/ResponsiveFilemanager/issues/598 - Exploit, Issue Tracking, Third Party Advisory~~	() https://github.com/trippo/ResponsiveFilemanager/issues/598 - Exploit, Issue Tracking, Third Party Advisory

Information

Published : 2020-03-07 00:15

Updated : 2024-11-21 04:54

NVD link : CVE-2020-10212

Mitre link : CVE-2020-10212

CVE.ORG link : CVE-2020-10212

JSON object : View

Products Affected

tecrail

responsive_filemanager

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2020-10212", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-03-07T00:15:13.117", "references": [{"url": "https://github.com/trippo/ResponsiveFilemanager/issues/598", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/trippo/ResponsiveFilemanager/issues/598", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728."}, {"lang": "es", "value": "El archivo upload.php en Responsive FileManager versiones 9.13.4 y 9.14.0, permite un ataque de tipo SSRF por medio del par\u00e1metro url porque el bloqueo de la extensi\u00f3n de archivo se maneja inapropiadamente y porque es posible que un nombre de host DNS se resuelva en una direcci\u00f3n IP interna. Por ejemplo, un intento de SSRF puede tener \u00e9xito si un nombre de archivo .ico es agregado al PATH_INFO. Adem\u00e1s, un atacante podr\u00eda crear un nombre de host DNS que se resuelva en la direcci\u00f3n IP 0.0.0.0 para una DNS pinning. NOTA: este problema se presenta debido a una correcci\u00f3n incompleta para CVE-2018-14728."}], "lastModified": "2024-11-21T04:54:58.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tecrail:responsive_filemanager:9.13.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E5817FB-89FD-4B34-A47F-F42E3B5756A1"}, {"criteria": "cpe:2.3:a:tecrail:responsive_filemanager:9.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07160113-5BCB-4E2F-9B56-B4DAABAA9933"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}