CVE-2019-13187
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files to Symphony CMS servers running the vulnerable Rich Text Formatter (Redactor) extension. Attackers can upload malicious files like webshells to gain remote code execution. All Symphony CMS installations using Redactor extension v1.1.1 or earlier are affected.
💻 Affected Systems
- Symphony CMS Rich Text Formatter (Redactor) extension
📦 What is this software?
Rich Text Formatter by Symphonyextensions
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via remote code execution, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Webshell deployment leading to website defacement, data exfiltration, or use as part of a botnet.
If Mitigated
File upload attempts blocked or logged, with no successful exploitation.
🎯 Exploit Status
Simple HTTP POST requests to vulnerable endpoints with malicious files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://symphonyextensions.com/extensions/richtext_redactor/
Restart Required: No
Instructions:
1. Remove or disable the Redactor extension. 2. Delete all uploaded files from the extension's upload directories. 3. Consider alternative rich text editor extensions.
🔧 Temporary Workarounds
Block vulnerable endpoints
allUse web server configuration to block access to content.fileupload.php and content.imageupload.php
# Apache: RewriteRule ^(.*)/content\.(file|image)upload\.php$ - [F]
# Nginx: location ~ /\.php$ { if ($request_uri ~* /content\.(file|image)upload\.php) { return 403; } }
Restrict file upload permissions
linuxSet strict file permissions on upload directories to prevent execution
chmod 644 /path/to/upload/directory/*
chmod 755 /path/to/upload/directory/
🧯 If You Can't Patch
- Disable the Redactor extension immediately
- Implement WAF rules to block file uploads to vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check if Redactor extension is installed and version is ≤1.1.1 via Symphony CMS extensions panel.Check Version:
Check Symphony CMS admin panel → System → ExtensionsVerify Fix Applied:
Confirm extension is removed/disabled and test file upload functionality is blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /content.fileupload.php or /content.imageupload.php
- Uploads of executable file types (.php, .jsp, .asp)
Network Indicators:
- Unusual outbound connections from web server
- Large file uploads to vulnerable endpoints
SIEM Query:
source="web_server" AND (url="*content.fileupload.php*" OR url="*content.imageupload.php*") AND method="POST"