Advisories

eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints

Go Back
severity
medium
date
Affecting
  • eGovFramework/egovframe-common-components <= 4.3.1

  • KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5280"

CWE
  • CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS
6.9
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Credit
Pierre Barre
Description
eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints. These controllers accept multipart requests without authentication, pass the uploaded content to a shared upload helper, and store the file on the server under a framework-controlled path. The framework then returns a download URL that can be used to retrieve the uploaded content, including an attacker-controlled Content-Type within the limits of the image upload functionality. While a filename extension whitelist is enforced, the attacker fully controls the file contents and the response MIME type used when the file is served. This enables an unauthenticated attacker to use any affected application as a persistent file hosting service for arbitrary content under the application's origin. KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5280."