Kirby Path Traversal and Arbitrary PHP File Inclusion Vulnerability

A path traversal vulnerability allowing arbitrary PHP file inclusion has been identified in Kirby, an open-source content management system. This issue affects versions 5.3.0 prior to 5.4.1. The vulnerability arises because the user ID provided during lookup was not properly validated, enabling attackers to traverse directories and include PHP files, such as plugin files, which could be executed on the server. The flaw is present in the authentication API, the users API, and any functionality that uses the $users->find() method to retrieve user information by email or ID. Additionally, the vulnerability allows for probing the existence of arbitrary directories on the server, which could be used to gather information about the server and site setup, including installed plugins and content structure.

Impact

Exploitation of this vulnerability could lead to unauthorized inclusion and execution of PHP files on the server, depending on the logic contained within those files. It also allows attackers to probe and fingerprint the server's directory structure and installed plugins.

Remediation

Users are advised to update Kirby to version 5.4.1 or later, where this vulnerability has been patched. In the updated version, additional checks have been implemented to validate user IDs and ensure that the corresponding account directory paths are contained within the designated accounts directory.