[ https://issues.apache.org/jira/browse/OFBIZ-11948?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17490204#comment-17490204 ]
ASF subversion and git services commented on OFBIZ-11948: --------------------------------------------------------- Commit 8691b1a7e168e773711f0d9972345179e8d357ee in ofbiz-framework's branch refs/heads/release22.01 from Jacques Le Roux [ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=8691b1a ] Fixed: Remote Code Execution (File Upload) Vulnerability (OFBIZ-11948) This fixes and improves file upload. Refactor a bit SecuredUpload class and fixes: Prevent double extensions Check extensions Improves getMimeTypeFromFileName() by checking is file exists In isValidImageFile() finally use isValidText() bypassing encoding Completely refactor deniedWebShellTokens in security.properties by re-adding removed tokens in last commit and adding several new ones. I have still to check encoded, encrypted and obfuscated webshells) Modifies SecurityUtilTest::webShellTokensTesting accordingly While at it better format commonsImagingSupportedFormats, deniedFileExtensions and imagejSupportedFormats properties for legibility. Check if createAnonFile service is used in GroovyBaseScript.groovy and if a complete file name is used (file exist) check, using SecuredUpload, extensions and prevent double extensions, actually check all the file and stop there. Adds some "Check if a webshell is not uploaded" comments in ContentManagementServices.java DataServices.java ScaleImage.java FrameImage.java ImageManagementServices.java ProductServices.java HttpRequestFileUpload.java ProgramExport.groovy Trivial comments fixes in catalog.properties Also fixes OFBIZ 12571 (I use here a space because of pending INFRA 22843) by simply adding processbuilder to deniedWebShellTokens > Remote Code Execution (File Upload) Vulnerability > ------------------------------------------------- > > Key: OFBIZ-11948 > URL: https://issues.apache.org/jira/browse/OFBIZ-11948 > Project: OFBiz > Issue Type: Sub-task > Components: product/catalog > Affects Versions: Trunk, 17.12.04, 18.12.01 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Priority: Major > Fix For: 17.12.05, 18.12.01 > > > Harshit Shukla harshit.sh...@gmail.com reported this RCE vulnerability to the > OFBiz security team, and we thank him for that. > I'll later quote here his email message when the vulnerability will be fixed. > It's a post-auth vulnerability so we did not ask for a CVE. -- This message was sent by Atlassian Jira (v8.20.1#820001)