TYPO3 Drag Drop Mass Upload Extension 'ameos_dragndropupload' Arbitrary File Upload Vulnerability

Bugtraq ID:	49516
Class:	Input Validation Error
CVE:	CVE-2011-3980
Remote:	Yes
Local:	No
Published:	Sep 08 2011 12:00AM
Updated:	Oct 05 2011 04:00PM
Credit:	Oliver Hader
Vulnerable:	Typo3 Drag Drop Mass Upload 2.0.2
Not Vulnerable:	Typo3 Drag Drop Mass Upload 3.1.1 Typo3 Drag Drop Mass Upload 3.0

TYPO3 Drag Drop Mass Upload Extension 'ameos_dragndropupload' Arbitrary File Upload Vulnerability

Drag Drop Mass Upload extension is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Drag Drop Mass Upload 2.0.2 is vulnerable; other versions may also be affected.

TYPO3 Drag Drop Mass Upload Extension 'ameos_dragndropupload' Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a browser.

TYPO3 Drag Drop Mass Upload Extension 'ameos_dragndropupload' Arbitrary File Upload Vulnerability

Solution:
Vendor updates are available, please see the reference for details.

TYPO3 Drag Drop Mass Upload Extension 'ameos_dragndropupload' Arbitrary File Upload Vulnerability

References:

• TYPO3 Homepage (TYPO3)
  
• Extension Repository (TYPO3)
  
• TYPO3 Security Bulletin TYPO3-EXT-SA-2011-010: A vulnerability in extension Drag (Oliver Hader)