PacketStorm 125836, Web Server (PHP) KCFinder browse.php Arbitrary File Upload

There is an arbitrary file upload vulnerability in the web file manager KCFinder. The vulnerability lies within the configuration of the application which allows unauthenticated users to upload arbitrary files. There is an attempt to prevent malicious files being uploaded but this can be easily bypassed. The attacker can upload a malicious file to the server and execute arbitrary code. This can lead to the total compromise of the server. 

Exploitation

Stages

1. The remote unauthenticated attacker uploads a malicious file to browse.php that bypasses the denied extension list.
2. The server responds successfully with a 200 OK and the name of the file.
3. The attacker requests their file at ‘uploads/files/<malicious file>.

Prerequisites

The attacker must know that the web file manager is installed on the victim’s environment.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Upgrade your software to the latest non-vulnerable version.