Unrestricted File Upload in KodCloud KodExplorer

Executive Summary

This vulnerability affects KodCloud KodExplorer up to version 4.55. It involves the Online Editor Save Endpoint in the file app/controller/editor.class.php. An attacker can manipulate the path or filestr arguments to upload files without restrictions. The attack can be performed remotely, and the exploit has been publicly disclosed.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload malicious files to your system, potentially leading to remote code execution, data theft, or system compromise. If you use KodExplorer for file management, an attacker might gain unauthorized access or control over your files and server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using KodExplorer may face compliance breaches, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update KodCloud KodExplorer to the latest version beyond 4.55 if available. If no update is available, disable the Online Editor Save Endpoint feature in app/controller/editor.class.php. Restrict network access to the vulnerable component and monitor for unauthorized file uploads.

Useful 0 Not Useful 0