CVE-2021-44673

Vulnerability

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2 via the admin/file-manager/attachments endpoint. The application fails to properly validate uploaded file types, allowing an authenticated attacker with administrative access to upload arbitrary files, including PHP web shells. The affected version is Croogo 3.0.2, a CakePHP-based content management system [1][2].

Exploitation

An attacker must first obtain valid administrative credentials to the Croogo admin panel. Once authenticated, the attacker navigates to the file manager attachments section and uploads a malicious PHP file (e.g., a web shell) disguised as a legitimate attachment. The upload mechanism does not enforce file type restrictions, so the malicious file is accepted and stored on the server. After upload, the attacker can access the uploaded file directly via its URL and execute arbitrary PHP code on the server [1][2].

Impact

Successful exploitation allows the attacker to achieve remote code execution on the underlying web server with the privileges of the web application user. This can lead to full compromise of the Croogo installation, including data theft, defacement, privilege escalation, and lateral movement within the hosting environment [1][2].

Mitigation

As of the available references, no official patch or fixed version has been released for this vulnerability. Administrators should restrict access to the admin panel to trusted users, implement additional file upload validation via web server configuration (e.g., .htaccess rules to block execution of PHP files in the uploads directory), and monitor for unusual file uploads. The Croogo project appears to be inactive, with no recent commits addressing this issue [3]. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.