CVE-2024-47823

Improper Input Validation (CWE-20)

Published: Oct 8, 2024 / Updated: 42d ago

In the following scenario, an attacker could upload a file called shell.php with an image/png MIME type and execute it on the remote server. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension.

In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension. If the following criteria are met, the attacker can carry out an …

https://www.bleepingcomputer.com/news/security/akira-and-fog-ransomware-now-exploiting-critical-veeam-rce-flaw/ Ransomware gangs now exploit a critical security vulnerability that lets attackers gain remote code execution (RCE) on vulnerable Veeam Backup & Replication (VBR) servers.

Ransomware gangs now exploit a critical security vulnerability that lets attackers gain remote code execution (RCE) on vulnerable Veeam Backup & Replication (VBR) servers. New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

Summary: A critical vulnerability, CVE-2024-47823, has been discovered in Livewire, a Laravel framework, allowing attackers to exploit file uploads for Remote Code Execution (RCE). The flaw arises from improper validation of file extensions in versions prior to 3.5.2, enabling malicious file uploads that can be executed by the server.

If you are using an affected version, Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version. The following product-specific Vulnerability Patches have been made available in the latest update.