Arbitrary Code Execution through Configuration Archive Upload in Backdrop CMS

CVE-2019-14771 · HIGH Severity

AV:N/AC:M/AU:N/C:C/I:C/A:C

Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.)

Learn more about our Cis Benchmark Audit For Server Software.