CVE-2020-10806

Root

Cause CVE-2020-10806 is a vulnerability in eZ Publish Kernel and Legacy that allows remote code execution through file uploads. The root cause is that the file upload mechanism did not prevent uploading PHP files, and if the web server vhost configuration permits execution of any PHP file (rather than only app.php), an attacker can achieve code execution [1].

Exploitation

An attacker needs to have file upload permissions on the eZ Publish site. The vulnerability can be exploited when the recommended vhost configuration (which restricts execution to app.php) is not in use. The built-in PHP development server is always vulnerable as it lacks such restrictions [2].

Impact

Successful exploitation allows an attacker to upload arbitrary PHP code and execute it on the server, leading to full remote code execution. This can compromise the entire application and underlying infrastructure [2].

Mitigation

The vendor has released patches for the affected versions: eZ Publish Kernel 5.4.14.1, 6.13.6.2, 7.5.6.2; and eZ Publish Legacy 5.4.14.1, 2017.12.7.2, 2019.03.4.2. The fix adds a configurable blacklist for uploaded file extensions (e.g., .php) to prevent uploading executable code [2]. Using the recommended vhost configuration also provides protection.