Summary
Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted.
Impact
If the media folder is not restricted from running files this can lead to a remote code execution.
References:GSA_kwCzR0hTQS01eHcyLTU3angtcGdqcM4ABPH9
GrapesJsBuilder File Upload allows all file uploads
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:mautic/grapes-js-builder-bundle | >= 6.0.0, < 6.0.7, >= 5.0.0, < 5.2.9, >= 4.0.0, < 4.4.18 | 6.0.7, 5.2.9, 4.4.18 | |
Affected Version RangesAll affected versions4.0.0, 4.0.0-beta, 4.0.0-rc, 4.0.1, 4.0.2, 4.1.1, 4.1.2, 4.2.0, 4.2.0-rc, 4.2.0-rc1, 4.2.1, 4.2.2, 4.3.0, 4.3.0-beta, 4.3.0-rc, 4.3.1, 4.4.0, 4.4.0-beta, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, 4.4.12, 4.4.13, 5.0.0, 5.0.0-alpha, 5.0.0-alpha1, 5.0.0-beta1, 5.0.0-beta2, 5.0.0-rc1, 5.0.0-rc2, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 6.0.0, 6.0.0-alpha, 6.0.0-beta, 6.0.0-beta2, 6.0.0-rc, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6 All unaffected versions5.2.9, 6.0.7 |
|||