In the library , providing handlers for protection against by substituting files in the "Phar" format, (), allowing to bypass code deserialization protection through substitution of ".." characters in the path. For example, an attacker could use a URL like "phar://path/bad.phar/../good.phar" and the library will extract the base name "path/good.phar" during the check, while in further processing such a path will use the file "path/bad.phar."
The library was developed by the creators of CMS TYPO3, but is also used in Drupal and Joomla projects, making them susceptible to this vulnerability as well. The issue was resolved in releases . The Drupal project addressed the issue in updates 7.67, 8.6.16, and 8.7.1. In Joomla, the problem appears starting from version 3.9.3 and was fixed in release 3.9.6. To fix the issue in TYPO3, the PharStreamWrapper library needs to be updated.
Practically, the vulnerability in PharStreamWrapper allows a user with Drupal Core administrator privileges (‘Administer theme’) to upload a malicious phar file and execute embedded PHP code disguised as a legitimate phar archive. To recall, the essence of the "Phar deserialization" attack is that when checking uploaded files with the PHP function file_exists(), this function automatically performs deserialization of metadata from Phar (PHP Archive) files when processing paths starting with "phar://". It is possible to transmit a phar file disguised as an image, as the file_exists() function determines the MIME type based on content rather than extension.
Source: opennet.ru
