Description
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Webasyst | Webasyst Framework | ≤ 4.4.0 | — |
References
- GitHub Issue #396 issue-tracking
- https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/file/waArchiveTar.class.php#L1243-L1250 technical-description
- https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/file/waTheme.class.php#L2609-L2660 technical-description
- https://github.com/webasyst/webasyst-framework product
- VulnCheck Advisory: Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks third-party-advisory