Description
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
elunez eladmin
Default version status: unaffected
0 to ≤ 2.7affected
pkg:github/elunez/eladminReferences
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/eladmin/poc_localStorage_pictures.py ↗
- https://github.com/elunez/eladmin/blob/39d480938d27a9630d632578c3ef60cf3647a79e/eladmin-tools/src/main/java/me/zhengjie/rest/LocalStorageController.java#L72-L82 ↗
- https://www.vulncheck.com/advisories/eladmin-through-2.7-missing-authorization-via-api-localstorage-pictures-upload ↗