CVE-2020-13443 : Security Advisory and Response

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. This CVE affects users with low privileges, enabling them to bypass MIME type and file-extension checks while uploading files.

Understanding CVE-2020-13443

This CVE allows for the execution of arbitrary code by uploading a .php%20 file through specific actions in ExpressionEngine.

What is CVE-2020-13443?

ExpressionEngine before version 5.3.2 is vulnerable to remote code execution through file uploads, potentially leading to a compromise of the system.

The Impact of CVE-2020-13443

The vulnerability allows attackers to upload and execute malicious PHP code, bypassing security checks, and gaining unauthorized access to the system.

Technical Details of CVE-2020-13443

ExpressionEngine's vulnerability lies in its file upload functionality, enabling the execution of arbitrary PHP code.

Vulnerability Description

Attackers can upload and execute PHP code by exploiting the lack of proper file-type and extension checks in ExpressionEngine.

Affected Systems and Versions

ExpressionEngine versions before 5.3.2

Exploitation Mechanism

Attackers can upload a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions
Bypass MIME type and file-extension checks
Direct access to uploaded files without short aliases
Upload PHP files with member access or by creating a member with a default group id of 5

Mitigation and Prevention

It is crucial to take immediate steps to secure systems vulnerable to CVE-2020-13443.

Immediate Steps to Take

Update ExpressionEngine to version 5.3.2 or later
Restrict file upload permissions for low-privileged users
Monitor file uploads for suspicious activity

Long-Term Security Practices

Regularly audit and review file upload functionalities
Implement strict file-type and extension checks
Educate users on safe file upload practices

Patching and Updates

Apply patches and updates provided by ExpressionEngine to address this vulnerability