CVE-2019-19576
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by uploading malicious .phar files to systems using vulnerable versions of verot.net class.upload library. The library failed to block .phar extensions, enabling PHP Archive files to be uploaded and executed. This affects Joomla! K2 extension users and any other applications using class.upload.php versions before 1.0.3 or 2.x before 2.0.4.
💻 Affected Systems
- verot.net class.upload library
- Joomla! K2 extension
- Other applications using class.upload.php
📦 What is this software?
K2 by Getk2
Verot by Verot Project
Verot by Verot Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to take complete control of the server, steal data, install malware, or pivot to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as a foothold for further attacks.
If Mitigated
File uploads blocked or properly validated, limiting impact to denial of service or failed upload attempts.
🎯 Exploit Status
Multiple public exploits exist, requiring only ability to upload files to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: class.upload 1.0.3 or 2.0.4
Vendor Advisory: https://github.com/verot/class.upload.php/commits/master
Restart Required: No
Instructions:
1. Update class.upload.php to version 1.0.3 or 2.0.4. 2. For Joomla! K2 extension, update to version containing commit d1344706c4b74c2ae7659b286b5a066117155124. 3. Replace vulnerable class.upload.php files with patched versions from official repository.
🔧 Temporary Workarounds
Block .phar file uploads
allAdd .phar to blocked extensions list in upload validation
Add '.phar' to $upload->file_safe_name array or equivalent extension blacklist
Disable file upload functionality
allTemporarily disable file uploads until patched
Disable file upload forms or set upload_max_filesize=0 in php.ini
🧯 If You Can't Patch
- Implement strict file type validation using MIME type checking, not just extensions
- Store uploaded files outside web root with no execute permissions
🔍 How to Verify
Check if Vulnerable:
Check if class.upload.php version is <1.0.3 or 2.x <2.0.4. Look for .phar in blocked extensions list.Check Version:
grep -i 'version' class.upload.php | head -5Verify Fix Applied:
Verify class.upload.php version is 1.0.3+ or 2.0.4+. Confirm .phar is in blocked extensions list.📡 Detection & Monitoring
Log Indicators:
- File upload attempts with .phar extension
- Unusual POST requests to upload endpoints
- Execution of uploaded files from upload directories
Network Indicators:
- POST requests with .phar files to upload endpoints
- Subsequent connections from server to external IPs
SIEM Query:
source="web_logs" AND (uri_path="*upload*" OR uri_path="*k2*") AND (file_extension=".phar" OR user_agent="*curl*" OR user_agent="*wget*")🔗 References
- http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
- https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124
- https://github.com/jra89/CVE-2019-19576
- https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1
- https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2
- https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3
- https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4
- https://medium.com/%40jra8908/cve-2019-19576-e9da712b779
- https://www.verot.net
- https://www.verot.net/php_class_upload.htm
- http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
- https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124
- https://github.com/jra89/CVE-2019-19576
- https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1
- https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2
- https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3
- https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4
- https://medium.com/%40jra8908/cve-2019-19576-e9da712b779
- https://www.verot.net
- https://www.verot.net/php_class_upload.htm
