CVE-2020-21322
📋 TL;DR
CVE-2020-21322 is an arbitrary file upload vulnerability in Feehi CMS that allows attackers to upload malicious PHP files. This can lead to remote code execution on affected systems. All Feehi CMS installations version 2.0.8 and below are vulnerable.
💻 Affected Systems
- Feehi CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the web server, data exfiltration, and lateral movement to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as part of a botnet.
If Mitigated
Attack blocked at web application firewall level or file upload validation prevents malicious uploads.
🎯 Exploit Status
Exploitation requires authenticated access to the CMS admin panel.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.0.9 and above
Vendor Advisory: https://github.com/liufee/cms/issues/44
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download the latest version from the official repository. 3. Replace all files except configuration and upload directories. 4. Verify functionality.
🔧 Temporary Workarounds
Disable file upload functionality
allTemporarily disable file upload features in the CMS admin panel
Web server file type restrictions
linuxConfigure web server to block execution of uploaded PHP files
For Apache: Add 'php_flag engine off' to .htaccess in upload directory
For Nginx: Add 'location ~ \.php$ { deny all; }' to upload directory config
🧯 If You Can't Patch
- Implement strict file upload validation (whitelist allowed extensions, verify file signatures)
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check CMS version in admin panel or via version.php fileCheck Version:
grep -r 'version' /path/to/feehicms/version.phpVerify Fix Applied:
Verify version is 2.0.9 or higher and test file upload with PHP extension is rejected📡 Detection & Monitoring
Log Indicators:
- Multiple failed file upload attempts
- Successful upload of .php files to upload directories
- Unusual admin panel login activity
Network Indicators:
- POST requests to file upload endpoints with PHP content
- Outbound connections from web server to unknown IPs
SIEM Query:
source="web_logs" AND (uri="/admin/upload" OR uri="/admin/file") AND (file_extension=".php" OR content_type="application/x-php")