Summary
Mautic 7's campaign import feature may copy files from an uploaded campaign archive into a publicly accessible media directory without sufficiently restricting file names or types. An authenticated user who can create campaign imports could place a server-side script there, potentially enabling remote code execution when the web server processes the file.
Mautic 7's campaign import feature may copy files from an uploaded campaign archive into a publicly accessible media directory without sufficiently restricting file names or types. An authenticated user who can create campaign imports could place a server-side script there, potentially enabling remote code execution when the web server processes the file.
Affected context
The issue can arise in Mautic 7 deployments that enable campaign imports through the user interface or the /api/campaigns/import endpoint and copy archive contents into a web-accessible media or document root. Risk is higher when the web server permits uploaded files to be interpreted as executable scripts, including configurations where per-directory rules are honored.
The issue can arise in Mautic 7 deployments that enable campaign imports through the user interface or the /api/campaigns/import endpoint and copy archive contents into a web-accessible media or document root. Risk is higher when the web server permits uploaded files to be interpreted as executable scripts, including configurations where per-directory rules are honored.
Exploit preconditions
- Attack surface: Campaign import functionality exposed through the Mautic user interface or API
- Required access: An authenticated account permitted to create campaign imports; administrator privileges may not be required
- Trigger point: Processing an uploaded campaign archive and copying bundled assets into the media directory
- Why exploitation is possible: File names and types are not sufficiently restricted, allowing potentially executable server-side content to reach a publicly accessible location
- Environmental dependency: Remote code execution depends on the web server interpreting the uploaded file type as executable
- Attack surface: Campaign import functionality exposed through the Mautic user interface or API
- Required access: An authenticated account permitted to create campaign imports; administrator privileges may not be required
- Trigger point: Processing an uploaded campaign archive and copying bundled assets into the media directory
- Why exploitation is possible: File names and types are not sufficiently restricted, allowing potentially executable server-side content to reach a publicly accessible location
- Environmental dependency: Remote code execution depends on the web server interpreting the uploaded file type as executable
Why this happens
The vulnerability results from treating archive contents as trusted assets during campaign import without enforcing a strict allowlist for file names, extensions, content types, and storage locations. This maps primarily to CWE-434: Unrestricted Upload of File with Dangerous Type; the resulting execution of uploaded server-side content can also relate to CWE-94: Improper Control of Generation of Code.
The vulnerability results from treating archive contents as trusted assets during campaign import without enforcing a strict allowlist for file names, extensions, content types, and storage locations. This maps primarily to CWE-434: Unrestricted Upload of File with Dangerous Type; the resulting execution of uploaded server-side content can also relate to CWE-94: Improper Control of Generation of Code.
Potential impact
- An attacker may execute server-side code with the privileges of the web server process
- The application configuration and stored secrets could be exposed
- Contact data and other application-managed information could be read or modified
- Campaign content or application behavior could be altered
- The compromised instance could be used for lateral movement or further attacks
- An attacker may execute server-side code with the privileges of the web server process
- The application configuration and stored secrets could be exposed
- Contact data and other application-managed information could be read or modified
- Campaign content or application behavior could be altered
- The compromised instance could be used for lateral movement or further attacks
General mitigation guidance
Mitigation generally focuses on treating campaign archives as untrusted input and ensuring uploaded content cannot become executable code.
Common defensive patterns include:
- Allowing only explicitly required asset types and validating both names and file content
- Extracting archives into storage outside the web root whenever possible
- Renaming uploaded files and preventing user-controlled paths or archive traversal
- Disabling server-side execution in upload and media directories
- Serving uploaded content through a controlled download handler with safe response headers
- Applying equivalent restrictions consistently across user-interface and API import paths
- Running the web process with least privilege and limiting access to configuration files and secrets
Mitigation generally focuses on treating campaign archives as untrusted input and ensuring uploaded content cannot become executable code.
Common defensive patterns include:
- Allowing only explicitly required asset types and validating both names and file content
- Extracting archives into storage outside the web root whenever possible
- Renaming uploaded files and preventing user-controlled paths or archive traversal
- Disabling server-side execution in upload and media directories
- Serving uploaded content through a controlled download handler with safe response headers
- Applying equivalent restrictions consistently across user-interface and API import paths
- Running the web process with least privilege and limiting access to configuration files and secrets
How teams detect issues like this
Detection can include:
- Static analysis checks for archive extraction and file-copy operations that use user-controlled names or extensions
- Code review of upload handlers for missing type allowlists, path canonicalization, and execution restrictions
- Dynamic tests that submit archives containing unexpected extensions, nested paths, and script-like content
- Web-server monitoring for requests to newly created files in media or upload directories
- Policy enforcement requiring uploads to use non-executable storage and approved content-validation libraries
- Alerts for campaign imports that create unusual file types or access patterns
Detection can include:
- Static analysis checks for archive extraction and file-copy operations that use user-controlled names or extensions
- Code review of upload handlers for missing type allowlists, path canonicalization, and execution restrictions
- Dynamic tests that submit archives containing unexpected extensions, nested paths, and script-like content
- Web-server monitoring for requests to newly created files in media or upload directories
- Policy enforcement requiring uploads to use non-executable storage and approved content-validation libraries
- Alerts for campaign imports that create unusual file types or access patterns
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
