GHSA-5vv7-j593-mgjc: 
PHP vulnerability analysis and mitigation

Neos Flow, a PHP framework, was found to contain two significant security vulnerabilities. The first issue allowed arbitrary file uploads, including server-side scripts, in version 3.0.0. The second vulnerability involved XML External Entity (XXE) processing in the MediaTypeConverter component affecting versions 2.3.0 to 2.3.6. These vulnerabilities were discovered and disclosed on November 23rd, 2015, with a medium severity rating (Neos Blog).

The vulnerability primarily manifests in two ways: First, Flow 3.0.0 removed previous restrictions on PHP file uploads, allowing potential malicious script uploads. Prior versions had specifically blocked .php file extensions. Second, versions 2.3.0 to 2.3.6 contained a potential XML External Entity processing vulnerability in the MediaTypeConverter component. The issue was assigned a suggested CVSS v2.0 score of (AV:N/AC:L/Au:S/C:P/I:P/A:N/E:ND/RL:OF/RC:C) (Neos Blog).

If exploited, the arbitrary file upload vulnerability could lead to several severe consequences including information disclosure, placement of backdoors, and data removal, particularly if uploaded scripts are executed through their public URL. However, the actual risk depends on the system setup and whether the application built on Flow provides file upload capabilities. The impact is only relevant if uploaded script files can be executed by the server (GitHub Advisory).

The exploitability of the file upload vulnerability is contingent on whether the application built on Flow provides means for file uploads and the system's configuration. The vulnerability is only exploitable if uploaded script files can be executed by the server when accessed through their public URL (Neos Blog).

The issues were addressed in Flow versions 2.3.8 and 3.0.2. Flow 3.0.2 introduced a blacklist for file extensions that may be uploaded and/or published, which includes extensions used by popular scripting languages. The execution of server-side scripts in the public resources folder was disabled by default on Apache. Additionally, the processing of external entities when loading XML in the MediaTypeConverter was disabled in both Flow releases. Note that versions 2.3.7 and 3.0.1 contained minor regressions that were subsequently fixed (Neos Blog).

The vulnerability was discovered through responsible disclosure by Mickael Dorigny from Synetis (file upload issue) and Wouter Wolters (XXE problem). The fixes were sponsored by Flownative and networkteam, and reviewed by the Neos security team (Neos Blog).