Unrestricted File Upload in Form Tools

Executive Summary

This vulnerability is an unrestricted file upload flaw in FormTools version 3.1.1. It allows authenticated users, including low-privileged ones, to upload arbitrary PHP files to the server's web-accessible upload directory without proper validation. The issue occurs in the Files::uploadFile function of global/code/actions.php, where missing checks on file extensions, MIME types, and content enable attackers to upload malicious PHP scripts. These files can then be executed remotely via URL, leading to potential remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the upload directory (default: rootDir/upload). Look for files with names like ft_sf_tmp_*.php or unexpected PHP files. Use commands like 'find /path/to/upload -name "*.php" -type f' to search for PHP files in the upload directory. Monitor network traffic for POST requests to /global/code/actions.php with action=upload_scraped_page_for_smart_fill.

• Inspect server logs for suspicious file uploads or execution attempts in the upload directory.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to upload a PHP web shell, gaining full control over the server with the same privileges as the web application. This could lead to data theft, unauthorized access to sensitive information, defacement of websites, or further attacks on connected systems. Even low-privileged users can exploit this if they are authenticated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to severe compliance violations. GDPR requires protecting personal data; a breach could result in fines. HIPAA mandates safeguarding health information; unauthorized access risks penalties. The flaw enables data theft and system compromise, directly violating confidentiality and integrity requirements of these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the smart_fill feature in FormTools if not required. Restrict access to the upload directory by disabling script execution (e.g., via .htaccess or server configuration). Implement strict file validation: allow only specific file types, validate MIME types and content, and use random filenames. Add CSRF protection and restrict the upload endpoint to administrators only.

• Temporarily block write access to the upload directory or move it outside the web root until patches are applied.

Useful 0 Not Useful 0