CVE-2020-23138
📋 TL;DR
This vulnerability allows attackers to upload malicious PHP files disguised as JPEG images to Microweber's admin panel. Attackers can execute arbitrary code on the web server, potentially compromising the entire system. All Microweber 1.1.18 installations with admin access are affected.
💻 Affected Systems
- Microweber CMS
📦 What is this software?
Microweber by Microweber
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or complete system takeover
Likely Case
Webshell installation allowing persistent access, data exfiltration, and lateral movement
If Mitigated
Limited impact with proper file upload restrictions and server hardening
🎯 Exploit Status
Exploit requires admin credentials but is trivial to execute once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.19 or later
Vendor Advisory: https://github.com/microweber/microweber/releases
Restart Required: No
Instructions:
1. Backup your Microweber installation. 2. Update to Microweber 1.1.19 or later via admin panel or manual download. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict file upload extensions
allConfigure web server to block .php file uploads in upload directories
# For Apache: Add to .htaccess in upload directory
<FilesMatch "\.(php|php3|php4|php5|phtml|pl|py|jsp|asp|htm|html|shtml|sh|cgi)$">
Order Allow,Deny
Deny from all
</FilesMatch>
# For Nginx: Add to server block
location ~* \.(php|php3|php4|php5|phtml|pl|py|jsp|asp)$ {
deny all;
}
Implement file type verification
allAdd server-side validation to check actual file content type, not just extension
# Example PHP validation snippet
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
if (!in_array($mime, ['image/jpeg', 'image/png', 'image/gif'])) {
die('Invalid file type');
}
🧯 If You Can't Patch
- Disable file upload functionality in admin panel
- Implement WAF rules to block .php file uploads and suspicious POST requests
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a .php file with image/jpeg content type via admin panel. If successful, system is vulnerable.Check Version:
Check Microweber version in admin dashboard or via composer show microweber/microweberVerify Fix Applied:
Attempt same upload test - should be rejected with proper error message📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload attempts with .php extensions
- Successful upload of .php files to upload directories
- Unusual admin login activity
Network Indicators:
- POST requests to upload endpoints with .php files
- Traffic to unexpected .php files in upload directories
SIEM Query:
source="web_server" AND (uri="*upload*" AND file_extension="php") OR (user_agent="*admin*" AND status=200 AND uri="*.php")