Vulnerability feed

Executive summary

A security flaw in GouguOA, reported in version 6.1.2 and described as affecting versions up to 6.1.2, lets any logged-in employee upload a file that the server then runs as code, which can lead to full control of the server. The advisory rates the issue 8.8 High using CVSS 3.1. The advisory's remediation calls for enforcing a file type allowlist on merged uploads, moving storage out of the web root, and fixing the related code errors.

Technical summary

The advisory describes an unrestricted file upload (CWE-434) in the chunked upload endpoint POST /disk/api/chunkUpload, which leads to remote code execution. Any authenticated employee with a default role can exploit it, and no special privileges are required according to the advisory. The extension allowlist is applied only to chunk parts, while the merged file takes its extension from an unchecked POST parameter, so a php extension can be written under public/storage, which Apache executes as PHP. The advisory states the affected version as v6.1.2 and says earlier versions were not tested, with versions containing the same implementation presumed affected. No fixed version is stated, and the advisory gives remediation steps rather than a patched release. The advisory gives no detection beyond hunting for public/storage/**/*.php and public/backup/*.sql files after patching, and it does not state a workaround other than those remediation steps.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/Gum29/rrrreeeeeeee-readme/bl…rd-Vuln-Report-EN.md

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

GouguOAGouguOA