CVE-2022-25336

Vulnerability

In Ibexa DXP (ezsystems/ezpublish-kernel) versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12, uploaded image files are stored with a predictable path and filename based on the original file name. This lack of access control over image files enables an Insecure Direct Object Reference (IDOR) attack. The affected versions include all releases prior to the fixes, as listed in advisory IBEXA-SA-2022-001 [1][3]. The vulnerability is inherent to the image storage mechanism, which deliberately does not enforce access controls for performance reasons.

Exploitation

To exploit this vulnerability, an attacker needs to have access to upload images to the system (a prerequisite that limits the attack surface). With that access, the attacker can deduce or guess the full path and filename of other stored images because the naming convention is predictable. No authentication is required for the read operation; the attacker simply sends HTTP GET requests for the guessed file paths. The advisory notes that dictionary attacks can be used to enumerate filenames [3].

Impact

Successful exploitation allows an attacker to access any image file stored on the system, including those intended to be private. This leads to unauthorized information disclosure. While the attacker cannot modify or delete the images, they can retrieve sensitive visual data (e.g., confidential documents, personal photos) if such images are uploaded. The vulnerability does not directly enable remote code execution or privilege escalation, but the data leakage can have significant privacy and security implications.

Mitigation

The vulnerability is fixed in versions ezsystems/ezpublish-kernel 7.5.26 and ezsystems/ezplatform-kernel 1.3.12, released on 18 January 2022 [3]. The fix implements a new image file naming scheme: the original filename is better sanitized and a 12-character secure random hash is prepended, making unauthorized access prohibitively difficult. Administrators must run php bin/console ibexa:images:normalize-paths after upgrading to ensure all existing images are renamed correctly, then clear both HTTP and persistence cache, and finally run php bin/console liip:imagine:cache:remove to remove old cached thumbnails [3]. No workaround is available; upgrading to the patched version is required.