CVE-2020-20907
📋 TL;DR
MetInfo 7.0 beta contains a path traversal vulnerability that allows attackers to delete and modify critical INI configuration files. This affects all installations of MetInfo 7.0 beta content management system. Attackers can exploit this to manipulate system settings and potentially gain administrative access.
💻 Affected Systems
- MetInfo CMS
📦 What is this software?
Metinfo by Metinfo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through configuration file manipulation leading to remote code execution, data destruction, or persistent backdoor installation.
Likely Case
Unauthorized modification of system settings, privilege escalation to admin access, or disruption of website functionality.
If Mitigated
Limited impact with proper file permission controls and web application firewalls blocking path traversal attempts.
🎯 Exploit Status
Public GitHub issues demonstrate exploitation techniques. Simple path traversal attacks can modify critical configuration files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0 stable or later versions
Vendor Advisory: Not specified in provided references
Restart Required: No
Instructions:
1. Upgrade to MetInfo 7.0 stable or later version. 2. Replace vulnerable files: app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php with patched versions. 3. Verify file permissions are properly set.
🔧 Temporary Workarounds
File Permission Restriction
linuxSet strict file permissions on INI configuration files to prevent modification
chmod 644 app/system/language/admin/language_general.class.php
chmod 644 app/system/include/function/file.func.php
Web Application Firewall Rules
allBlock path traversal patterns in web requests
🧯 If You Can't Patch
- Implement strict file system permissions (read-only for web user on configuration files)
- Deploy web application firewall with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check MetInfo version in admin panel or by examining version files. If version is 7.0 beta, system is vulnerable.Check Version:
Check admin panel or examine /app/system/version.php fileVerify Fix Applied:
Verify file modification dates and permissions on vulnerable files. Test if path traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Multiple failed attempts to access path traversal patterns
- Unauthorized file modification attempts in system logs
- Requests containing '../' patterns targeting INI files
Network Indicators:
- HTTP requests with path traversal sequences targeting vulnerable file paths
- Unusual POST requests to file manipulation endpoints
SIEM Query:
web.url:*../app/system/language/admin/language_general.class.php OR web.url:*../app/system/include/function/file.func.php