Listen to this Post
The identified vulnerability resides in Kirby’s media thumbnail generation handler, specifically affecting deployments on servers that permit encoded slashes (%2f) within URL paths – a common configuration on nginx, PHP’s built‑in web server, or Apache with `AllowEncodedSlashes` enabled. Under normal operation, when a thumbnail is requested for an asset inside a page’s `media` directory, Kirby locates a corresponding `.json` job file that contains the asset’s metadata and generation instructions. The handler parses the request path, extracts the filename, and constructs the filesystem path by joining the parent directory’s absolute root with the provided filename. In vulnerable releases, this filename is not sanitised against path‑traversal sequences before being appended. Because the application does not decode or reject `%2f` (which represents /), an attacker can inject `../` sequences encoded as `..%2f` to step outside the intended parent media folder. The server’s URL decoder translates `%2f` to a literal slash, allowing the traversal to escape the site’s index root. The media handler then attempts to locate the corresponding `.json` job file for that traversed path. If the file exists and contains a valid `filename` key pointing to a media resource (e.g., an image), Kirby proceeds to generate a thumbnail from that external resource – even though it resides outside the authorised media directory – and subsequently deletes the job file after generation. If the targeted `.json` file does not exist, the response returns an error or a different status code, creating a clear distinction that can be leveraged as a file‑existence oracle for any `.json` file reachable via relative paths on the server. This combination of unauthorised thumbnail creation, arbitrary `.json` file detection, and job file deletion constitutes a high‑severity path traversal flaw. The attack chain is entirely blind and does not require authentication, making it remotely exploitable over HTTP. The fix, applied in Kirby 4.9.5 and 5.5.2, introduces a strict check in `Kirby\Cms\Media::thumb()` that rejects any filename containing path separators (e.g., `/` or \) before joining it with the validated root. Additionally, the `file::version` component was hardened to outright block any path containing ../, ensuring that encoded variants are also neutralised. For servers using Apache’s default configuration (where `AllowEncodedSlashes` is off) or other hardened setups that reject encoded slashes, the vulnerability is not exploitable, as the request never reaches the vulnerable logic with a traversable path.
DailyCVE Form:
Platform: Kirby CMS
Version: <= 4.9.4 / <= 5.5.1
Vulnerability : Path Traversal
Severity: High
date: November 2023
Prediction: Already patched (upgrade to 4.9.5+ or 5.5.2+)
What Undercode Say:
Check server susceptibility to encoded slashes
curl -I “https://target.com/media/pages/home/test%2f..%2f..%2fconfig.json”
Test file existence oracle (200 vs 404 for JSON files)
curl -s -o /dev/null -w “%{http_code}” “https://target.com/media/pages/any-page%2f..%2f..%2f..%2fsite%2fconfig%2fconfig.json”
Generate thumbnail from traversed media file (deletes job file afterward)
curl -O “https://target.com/media/pages/foo%2f..%2f..%2fstorage%2fimages%2favatar.jpg?width=100”
List vulnerable server headers (nginx often allows by default)
curl -I “https://target.com/” | grep -i server
Apache configuration check (if accessible)
grep -r “AllowEncodedSlashes” /etc/apache2/
Exploit: (Educational Purposes!)
- Identify an existing parent page on the target (e.g.,
/pages/home). Its media directory is typically/media/pages/home/. - Construct a URL that navigates from that media directory upward using `%2f` as the path separator:
`https://target.com/media/pages/home%2f..%2f..%2f..%2f..%2fetc%2fpasswd`
(Note: actual traversal depth depends on the installation path). - Append a target `.json` file (e.g.,
%2fsite%2fconfig%2fconfig.json) to probe for its existence – observe HTTP status differences. - For a valid JSON job file (e.g., one referencing an image), request the thumbnail endpoint with
?width=100. Kirby will generate the thumbnail from the referenced media file, even if located outside the media root. - The job file is deleted upon successful generation, potentially corrupting the original media’s metadata or breaking future thumbnail generation for that asset.
- Use this to enumerate filesystem structure, detect sensitive `.json` configuration files, and exfiltrate thumbnails of arbitrary images.
Protection:
– Immediately upgrade to Kirby 4.9.5, Kirby 5.5.2, or any later release where the `Media::thumb()` filename validation and `file::version` path blocking are active.
– If an immediate upgrade is not possible, configure your web server to reject encoded slashes in URLs:
– Apache: set `AllowEncodedSlashes Off` (default) and avoid overriding it.
– nginx: use `merge_slashes on;` and consider custom rewrite rules that block `%2f` in the request URI.
– PHP built‑in server: avoid using it in production; otherwise, implement a custom router script that rejects any path containing `%2f` or %5c.
– As a defensive measure, ensure that all media directories are stored outside the webroot or with strict read permissions, and validate that the `media` folder does not contain symbolic links pointing to sensitive areas.
– Monitor access logs for unusual `%2f` sequences or requests to `/media/pages/` with multiple `..` patterns.
Impact:
- File Existence Disclosure: Attackers can determine whether any arbitrary `.json` file exists on the server by comparing response codes (200 vs 404/403), exposing the presence of configuration, backup, or secret metadata files.
- Unauthorised Thumbnail Generation: By leveraging a valid `.json` job file that references a media asset outside the intended directory, attackers can generate and download thumbnails of images that should be inaccessible, leading to information disclosure of private images or documents.
- Job File Deletion: The thumbnail generation process deletes the original `.json` job file after creating the thumbnail. This can break the original asset’s thumbnail functionality, cause loss of metadata, and potentially disrupt site appearance or administrative workflows.
- Integrity and Availability: Although not directly allowing remote code execution, the combination of enumeration and resource deletion can aid further attacks (e.g., identifying config files for subsequent exploits) and degrade the availability of media assets, especially if critical job files are removed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
