Executive brief
b2evolution is a content management system used to host blogs and websites. A security flaw in its file management component allows users with back-office access to bypass folder restrictions. This could allow an attacker to view or delete sensitive files on the server, potentially leading to data theft or website disruption.
Technical details
A directory traversal vulnerability exists in 'inc/files/files.ctrl.php' within b2evolution versions up to and including 6.8.3. The root cause is insufficient sanitization of the 'fm_selected' array parameter, which is used to specify file paths for operations. An authenticated attacker with back-office (administrative) privileges can inject '..' (dot-dot-slash) sequences into this parameter to escape the intended directory. This allows for the unauthorized reading or deletion of arbitrary files on the host filesystem. The issue was addressed in January 2017 via a commit that implements regex-based validation to block traversal patterns.
Affected products
- b2evolution b2evolution through 6.8.3
Timeline
- 2017-01-14: disclosed: Issue reported on GitHub by blackwolfsec
- 2017-01-15: advisory: NVD publication date
- 2017-01-15: patched: Fix committed to b2evolution repository