Description (CNA)
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| odt2spip / odt2spip | affected 0 through 4.4.0 |
CWE
CWE-78
References
- https://plugins.spip.net/odt2spip.html
- https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename
- https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce
ADP enrichment
No English description supplied.
No references supplied.