In the library , which provides handlers for protection against via file substitution in the 'Phar' format, (), allowing bypassing of deserialization protection through the substitution of '..' characters in the path. For example, an attacker could use a URL format like 'phar://path/bad.phar/../good.phar' and the library would extract the base name '/path/good.phar' during the verification, although the file '/path/bad.phar' would be used in further processing of such a path.
The library was developed by the creators of the TYPO3 CMS, but it is also used in Drupal and Joomla projects, making them vulnerable as well. The issue has been resolved in releases . The Drupal project addressed the issue in updates 7.67, 8.6.16, and 8.7.1. In Joomla, the problem appears from version 3.9.3 and was resolved in release 3.9.6. To address the issue in TYPO3, the PharStreamWrapper library must be updated.
From a practical perspective, the vulnerability in PharStreamWrapper allows a user of the Drupal Core with admin rights ('Administer theme') to upload a malicious phar file and execute the PHP code contained within as a legitimate phar archive. It's important to note that the essence of the 'Phar deserialization' attack is that when checking uploaded files using the PHP function file_exists(), this function automatically performs deserialization of metadata from Phar files (PHP Archive) when processing paths starting with 'phar://'. Passing a phar file is possible in the guise of an image, as the file_exists() function determines the MIME type based on content rather than extension.
Forrás: opennet.ru
