Authenticated RCE in WCMS via Arbitrary File Upload

Executive Summary

This vulnerability is a remote code execution flaw in W (wcms) through version 3.18.0. Authenticated editors can exploit it by uploading malicious files via the Media Upload API. The issue allows uploading .php files that are executed by the web server. Attackers can also use directory traversal sequences to write files outside the media directory or delete arbitrary files using the DELETE endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the media directory or web root. Inspect POST requests to /api/v0/media/upload/[*:path] for file uploads with .php extensions or path traversal sequences like ../. Monitor DELETE requests to /api/v0/media/[*:path] for unusual file deletions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with editor access could upload and execute malicious PHP files on your server, leading to full system compromise. They could also delete critical files, modify data, or escalate privileges. The impact includes data breaches, service disruption, and potential compliance violations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information. Both standards mandate safeguards against such breaches, and this flaw undermines those protections.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade wcms to a patched version if available. Restrict file uploads to allow-listed extensions (e.g., only images). Implement path sanitization using realpath() with prefix checks. Add CSRF tokens to all POST requests and enable HttpOnly flags for cookies.

Useful 0 Not Useful 0