Thelia v2.6.0 Remote Code Execution via Malicious Banner Upload

Executive Summary

In Thelia v2.6.0, the store banner upload feature has weak filetype validation that only checks client-supplied MIME types. An attacker with admin access can upload a PHP file disguised as an image, bypassing validation and gaining remote code execution on the server.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded PHP files in the store banner directory. Look for files with double extensions like .jpg.php or files with MIME types that do not match their actual content. Inspect server logs for unusual file uploads or execution attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of the server, steal sensitive data, install malware, or disrupt services. This requires admin access but allows severe system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the store banner upload feature if not required. Implement server-side filetype validation to verify file content, not just MIME types. Restrict file uploads to a specific directory with no execute permissions. Update Thelia to a patched version if available.

Useful 0 Not Useful 0