FrozenNode Laravel-Administrator Unrestricted File Upload Vulnerability Allowing Remote Code Execution

A vulnerability in FrozenNode Laravel-Administrator versions through 5.0.12 allows unrestricted file uploads, leading to remote code execution. The issue arises in the image upload feature of the admin tips module, where PHP code can be embedded within a GIF image file with a .php extension. Although the application attempts to block such uploads, this restriction can be easily bypassed by manipulating the file upload request.

Impact

Exploitation of this vulnerability results in unauthorized file uploads that can be executed on the server, leading to remote code execution.

Reproduction

To reproduce this vulnerability, log into the Laravel-Administrator panel and navigate to a module that allows file uploads. Upload a file with an allowed extension, such as a PNG. After the upload, intercept the request using a tool like Burp Suite. Change the file extension to .php, add a GIF header to bypass content filters, and include the PHP code to be executed. Once the file is uploaded, the server will respond with the name of the uploaded file, which can be used to execute the embedded PHP code.

Remediation

Users are advised to migrate to supported platforms, as Laravel-Administrator is discontinued.