October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• octobercms octoberup to 1.0.412 inclusive

Other highest-scoring records for the same primary product.

• CVE-2021-32648Account Takeover in OctobercmsKEV
  93Now
• CVE-2017-1000119October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other a
  46Plan
• CVE-2021-3311An issue was discovered in October through build 471.
  40Plan
• CVE-2017-1000196October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other
  40Plan
• CVE-2017-1000197October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on
  39Monitor
• CVE-2017-1000194October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and poss
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Data received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1payload = sock.recv(65536)2job = pickle.loads(payload)

1payload = sock.recv(65536)2if not hmac.compare_digest(sign(payload), header_sig):3    raise PermissionError("invalid signature")4job = JobSchema.validate(json.loads(payload))

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.