Description
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webasyst Webasyst Framework
Default version status: unaffected
0 to ≤ 4.4.0affected
pkg:composer/webasyst/frameworkReferences
- https://github.com/webasyst/webasyst-framework/issues/396 ↗
- https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/file/waArchiveTar.class.php#L1243-L1250 ↗
- https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/file/waTheme.class.php#L2609-L2660 ↗
- https://github.com/webasyst/webasyst-framework ↗
- https://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-arbitrary-file-read-via-waarchivetar-symlinks ↗