Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in CI4MS allows an authenticated user to upload specially crafted ZIP files that can overwrite arbitrary files on the server, potentially leading to remote code execution. Teams should pay close attention because this could compromise the entire system if not addressed.
- Can overwrite critical files.
- Enables running custom code.
- Requires backend access.
Attack Path
How an attacker could exploit the issue
An authenticated backend user with backup create permissions can abuse this vulnerability to write files to arbitrary filesystem locations. This can be used to drop a malicious PHP file into the public web root, leading to remote code execution.
- Authenticated, privileged user
- Uploading a crafted ZIP archive
- Target directory writable by the web server
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows an authenticated user with specific backup permissions to achieve remote code execution via a Zip Slip flaw. Attackers would favor this if they have already gained initial access and compromised credentials for a backend user within the CMS.
- Requires authenticated access.
- Patched in version 0.31.5.0.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching CI4MS installations to version 0.31.5.0 or later to address the critical Zip Slip vulnerability that allows for arbitrary file writes and remote code execution. If immediate patching is not feasible, implement strict access controls for the backup functionality and monitor for unusual file creation or modifications in the web root.
- Patch to version 0.31.5.0.
- Restrict backup create permissions.
- Monitor for new PHP files.
