Centraleyezer: Unrestricted File Upload — CVE-2019–12271

Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding “.jpg” to any uploaded filename is not enforced on the server side.

The image upload is vulnerable to bypass, the file upload adds .jpg extension to every file sent, but on client side, so I could intercept the request and change it to .php. I uploaded a simple shell and was able to execute commands as user www-data on the server.

This vulnerability was reported as fixed.

Intercepting the request from the front-end and changing it’s extension

Checking if the upload was successful

Executing commands in the webshell as www-data

References:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12271

https://seclists.org/fulldisclosure/2019/Nov/7