Thelia Upload Bypass & CSV Injection Vulnerabilities (GHSA)

Vulnerability Overview GHSAs-5524-gfqp-33v9: The upload policy checked the filename sent by the client, but storage only retained letters, numbers, hyphens, underscores, and dots. Filenames such as (with a trailing space), , or passed the extension blacklist and server executable checks. The document was stored as and served under , allowing anyone opening the link to execute it. GHSAs-7wrm-pcwm-4q9m: Document upload accepted HTML and other file types that browsers interpret as pages or scripts, serving them under . This allowed anyone opening the link to execute the scripts. GHSAs-6r9v-8frt-w2wc: CSV export files containing customer and newsletter subscriber names, addresses, and phone numbers are stored in plain text, e.g., as or . Any CSV file, whether from core or modules, where a text cell starts with one of these characters or contains a newline, now loses the leading quote and remains unescaped. Pure numeric values like or are written directly. Cells containing or are enclosed in quotes, preventing other delimiters from starting a formula and breaking the CSV structure mid-cell. JSON, XML, and YAML exports are not affected. The Backend Theme 1.1.2 writes newsletter exports in the same manner. Impact Scope GHSAs-5524-gfqp-33v9: Anyone uploading files with trailing spaces or extra extensions can cause those files to be executed from . GHSAs-7wrm-pcwm-4q9m: Anyone uploading HTML or other file types interpreted by browsers as pages or scripts can cause those files to be executed from . GHSAs-6r9v-8frt-w2wc: Anyone exporting CSV files containing special characters may cause data formatting errors, impacting data parsing and display. Remediation GHSAs-5524-gfqp-33v9: Update the core and setup packages, then update the database from the project root directory, and warm up the cache. The project maintains a 3.1 skeleton, and Composer keeps the core at version 3.1. GHSAs-7wrm-pcwm-4q9m: Update the core and setup packages, then update the database from the project root directory, and warm up the cache. The project maintains a 3.1 skeleton, and Composer keeps the core at version 3.1. GHSAs-6r9v-8frt-w2wc: Update the core and setup packages, then update the database from the project root directory, and warm up the cache. The project maintains a 3.1 skeleton, and Composer keeps the core at version 3.1. POC Code Pre-Update File Removal The update rejects new uploads but retains previously stored files. Identify images or documents stored with names like (associated with GHSAs-5524-gfqp-33v9) and (associated with GHSAs-7wrm-pcwm-4q9m). From the project root, use GNU commands: ```bash find local/media public/cache -regextype posix-extended \ -type d ! -path public/cache/documents/.htaccess \ \( -iregex '.*\.[tT][jJ][pP][gG][iI][fF][wW][bB][mM][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE][gG][jJ][pP][eE]

Goal Reached Thanks to every supporter — we hit 100%!

Thelia Upload Bypass & CSV Injection Vulnerabilities (GHSA)

More from this source