Summary
A file upload validation weakness in yii2-starter-kit allows authenticated users with the manager role to upload PHP files through backend storage actions. When the uploaded files are placed in a web-accessible directory, requesting them may execute server-side code with the application's privileges.
Affected context
The vulnerability occurs in deployments using yii2-starter-kit through version 4.2.0 where backend storage upload actions do not reliably restrict uploaded file types. Exploitation depends on a manager account being able to submit files, the storage location being reachable through the web server, and the server treating uploaded PHP files as executable code.
Exploit preconditions
- Attack surface: Backend storage upload functionality
- Required access: An authenticated account with the manager role or equivalent upload permissions
- Trigger point: Upload handling followed by a request to the stored file
- Why exploitation is possible: File type restrictions are insufficient, and uploaded server-side scripts may be stored in a web-accessible, executable location
Why this happens
The underlying bug is inadequate server-side validation and handling of uploaded files. When an application relies on client-controlled filenames, extensions, or loosely enforced content checks, an attacker may submit a server-side script where only inert data should be accepted. Storing that file beneath a web-accessible execution path maps to CWE-434, Unrestricted Upload of File with Dangerous Type.
Potential impact
- An attacker may execute arbitrary code with the web application's privileges.
- The compromise could expose application data and configuration secrets.
- The attacker may alter stored content or application behavior.
- The server could be used for lateral movement or further system compromise.
General mitigation guidance
Mitigation generally focuses on reducing trust in upload metadata and
ensuring uploaded content cannot become executable.
Common defensive patterns include:
- Allowing only a narrowly defined set of required, non-executable file types.
- Validating file content independently of the filename and client-provided MIME type.
- Generating server-side filenames and separating metadata from storage paths.
- Storing uploads outside the web root or serving them through a non-executing content handler.
- Applying explicit web-server rules that prevent script execution in upload directories.
- Restricting upload permissions according to least privilege and reviewing manager-role assignments.
- Scanning uploaded content and enforcing size, encoding, and storage policies where appropriate.
How teams detect issues like this
High-level detection can include:
- Static analysis checks for upload handlers that trust extensions, MIME headers, or client-provided filenames.
- Code review of storage-path construction, filename normalization, and authorization checks.
- Policy enforcement requiring uploads to use non-executable storage locations.
- Monitoring for unexpected script extensions, executable content, or newly created files in public directories.
- Reviewing web-server logs for requests to uploaded files and correlating them with upload events.
- Automated security review tools may help identify dangerous file-type handling patterns.
