CVE-2021-32708: 
PHP vulnerability analysis and mitigation

Flysystem, an open source file storage library for PHP, was found to contain a vulnerability (CVE-2021-32708) related to whitespace normalization in versions 1.x and 2.x. The vulnerability was discovered and disclosed in June 2021, affecting all versions before 1.1.4 and 2.0.0 through 2.1.0. This security issue impacts systems where Flysystem is used to handle file uploads with specific configurations (GitHub Advisory).

The vulnerability stems from the whitespace normalization functionality that removes unicode whitespace characters. The issue is classified as a Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367). The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (NVD).

Under specific conditions, this vulnerability could allow a malicious user to execute code remotely. The exploitation requires several conditions to be met: the user must be allowed to supply file paths or filenames, path validation must not check for unicode characters, extension checking must use a deny-list approach, the filename must contain unicode whitespace in the extension, and the upload directory must allow PHP code execution (GitHub Advisory).

The vulnerability is exploitable when all the specified conditions are met, allowing an attacker to upload and execute arbitrary code on the target system. The attack vector is network-accessible with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability has been patched by replacing the unicode whitespace removal with a rejection mechanism. Users of version 1.x should upgrade to version 1.1.4 or later, while users of version 2.x should upgrade to version 2.1.1 or later. The fixes are implemented in commits f3ad691 for 1.x and a3c694d for 2.x (GitHub Advisory, Fedora Update).