Summary
Wolf CMS suffers from an unrestricted file creation vulnerability in its FileManagerController, allowing authenticated users to create arbitrary PHP files without proper extension validation.
When attackers possess the file_manager_mkfile capability, they can write and execute malicious PHP code in a web-accessible directory, leading to remote code execution.
Wolf CMS suffers from an unrestricted file creation vulnerability in its FileManagerController, allowing authenticated users to create arbitrary PHP files without proper extension validation.
When attackers possess the file_manager_mkfile capability, they can write and execute malicious PHP code in a web-accessible directory, leading to remote code execution.
Affected context
This vulnerability occurs in Wolf CMS deployments that expose the File Manager functionality to authenticated users holding the file_manager_mkfile capability.
It is relevant when the FILES_DIR directory is web-accessible and PHP is interpreted by the web server for files written there.
Environments with relaxed role and permission configurations or shared administrative accounts are more susceptible, as they increase the chance of an attacker gaining the necessary capability.
This vulnerability occurs in Wolf CMS deployments that expose the File Manager functionality to authenticated users holding the file_manager_mkfile capability.
It is relevant when the FILES_DIR directory is web-accessible and PHP is interpreted by the web server for files written there.
Environments with relaxed role and permission configurations or shared administrative accounts are more susceptible, as they increase the chance of an attacker gaining the necessary capability.
Exploit preconditions
- Attack surface: Web application interface, specifically the File Manager features backed by
FileManagerController. - Required access: Authenticated user account with the
file_manager_mkfilecapability (or equivalent permission to create and save files). - Trigger point: Invoking the
create_file()andsave()functions to create a file with a.phpextension (or another executable extension) in the FILES_DIR. - Why exploitation is possible: The application does not enforce strict file extension validation or content-type restrictions before writing files, allowing attacker-controlled PHP code to be stored in a location served and executed by the web server.
- Attack surface: Web application interface, specifically the File Manager features backed by
FileManagerController. - Required access: Authenticated user account with the
file_manager_mkfilecapability (or equivalent permission to create and save files). - Trigger point: Invoking the
create_file()andsave()functions to create a file with a.phpextension (or another executable extension) in the FILES_DIR. - Why exploitation is possible: The application does not enforce strict file extension validation or content-type restrictions before writing files, allowing attacker-controlled PHP code to be stored in a location served and executed by the web server.
Why this happens
The core issue is missing validation and restriction on file types that can be created and written via the File Manager controller.
The create_file() and save() functions accept attacker-controlled filenames and content and persist them directly under the web-accessible FILES_DIR without checking for executable extensions, MIME types, or enforcing an allowed list.
This maps to CWE-434: Unrestricted Upload of File with Dangerous Type, where the application permits creation of files that the server subsequently executes, turning a content-management feature into an arbitrary code execution primitive.
The core issue is missing validation and restriction on file types that can be created and written via the File Manager controller.
The create_file() and save() functions accept attacker-controlled filenames and content and persist them directly under the web-accessible FILES_DIR without checking for executable extensions, MIME types, or enforcing an allowed list.
This maps to CWE-434: Unrestricted Upload of File with Dangerous Type, where the application permits creation of files that the server subsequently executes, turning a content-management feature into an arbitrary code execution primitive.
Potential impact
- Attackers may execute arbitrary PHP code on the server, gaining full remote code execution.
- Compromise of CMS data, including pages, user accounts, and configuration settings.
- Installation of web shells or backdoors for persistent access to the server environment.
- Lateral movement to adjacent systems or databases accessible from the compromised host.
- Defacement of the website and manipulation of content served to end users.
- Exfiltration or tampering of sensitive data stored or processed by the CMS.
- Attackers may execute arbitrary PHP code on the server, gaining full remote code execution.
- Compromise of CMS data, including pages, user accounts, and configuration settings.
- Installation of web shells or backdoors for persistent access to the server environment.
- Lateral movement to adjacent systems or databases accessible from the compromised host.
- Defacement of the website and manipulation of content served to end users.
- Exfiltration or tampering of sensitive data stored or processed by the CMS.
General mitigation guidance
Effective mitigation focuses on reducing the ability to store and execute attacker-controlled code through file management features.
Common defensive patterns include:
- Restricting file creation to a whitelist of non-executable extensions and validating filenames server-side before writing.
- Separating user-uploaded or CMS-managed files from directories that the web server treats as executable code, ideally serving them from non-PHP-enabled locations.
- Implementing server-side content-type and extension checks so that script-like content (e.g., PHP, CGI) cannot be stored where it is interpreted.
- Applying least-privilege principles to CMS roles and capabilities, limiting
file_manager_mkfileto strictly necessary accounts and regularly reviewing permissions. - Enforcing secure defaults in configuration so that file management features are constrained and cannot be trivially repurposed for code upload.
Effective mitigation focuses on reducing the ability to store and execute attacker-controlled code through file management features.
Common defensive patterns include:
- Restricting file creation to a whitelist of non-executable extensions and validating filenames server-side before writing.
- Separating user-uploaded or CMS-managed files from directories that the web server treats as executable code, ideally serving them from non-PHP-enabled locations.
- Implementing server-side content-type and extension checks so that script-like content (e.g., PHP, CGI) cannot be stored where it is interpreted.
- Applying least-privilege principles to CMS roles and capabilities, limiting
file_manager_mkfileto strictly necessary accounts and regularly reviewing permissions. - Enforcing secure defaults in configuration so that file management features are constrained and cannot be trivially repurposed for code upload.
How teams detect issues like this
Detection often combines application-level review with infrastructure monitoring:
- Static analysis and code review focusing on file management controllers, looking for file creation or write operations lacking extension and path validation.
- Policy-based checks in CI/CD pipelines to flag any logic that writes user-controlled files into web-accessible or executable directories.
- Log monitoring for suspicious file creation patterns, such as
.phpor other script extensions appearing in FILES_DIR via CMS actions. - Web server or WAF rules that alert on or block requests to newly created executable files in upload directories.
- Periodic security assessments that crawl CMS-managed directories to identify unexpected executable files and anomalous content.
Detection often combines application-level review with infrastructure monitoring:
- Static analysis and code review focusing on file management controllers, looking for file creation or write operations lacking extension and path validation.
- Policy-based checks in CI/CD pipelines to flag any logic that writes user-controlled files into web-accessible or executable directories.
- Log monitoring for suspicious file creation patterns, such as
.phpor other script extensions appearing in FILES_DIR via CMS actions. - Web server or WAF rules that alert on or block requests to newly created executable files in upload directories.
- Periodic security assessments that crawl CMS-managed directories to identify unexpected executable files and anomalous content.
