Process Maker PM4Core-Docker Arbitrary File Upload Vulnerability Allowing Code Execution

A vulnerability allowing arbitrary file uploads has been identified in the Process Maker PM4Core-Docker application, specifically in version 4.1.21-RC7. This issue arises in the UI login page's logo upload feature, where attackers can upload crafted PHP or HTML files that execute arbitrary code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Process Maker is running.

Reproduction

To reproduce this vulnerability, upload a malicious file, such as a JSON file containing an XSS payload, through the custom login logo upload section in the UI customization settings. After uploading the file, request to import it as a process. Once imported, the malicious JavaScript code will be executed when the process is archived.