CVE-2021-36461
📋 TL;DR
Microweber 1.1.3 has an arbitrary file upload vulnerability that allows attackers to upload malicious files disguised as pictures, potentially leading to remote code execution. This affects all Microweber installations running version 1.1.3 or earlier. Attackers can compromise the web server and gain control over the affected system.
💻 Affected Systems
- Microweber
📦 What is this software?
Microweber by Microweber
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise with attacker gaining shell access, data theft, ransomware deployment, and lateral movement to other systems.
Likely Case
Webshell installation leading to website defacement, data exfiltration, and use as a foothold for further attacks.
If Mitigated
File uploads blocked or properly validated, preventing malicious file execution.
🎯 Exploit Status
Exploitation requires uploading a malicious user.ini file disguised as an image, which can then be used to execute arbitrary PHP code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0 and later
Vendor Advisory: https://github.com/microweber/microweber/issues/751
Restart Required: No
Instructions:
1. Backup your Microweber installation and database. 2. Update to Microweber version 1.2.0 or later via the admin panel or manual update. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable file uploads
allTemporarily disable the Settings Upload Picture functionality
# Modify Microweber configuration to disable uploads
# Check your specific installation for upload settings
File extension validation
linuxImplement server-side validation to only allow specific image file extensions
# Add to .htaccess or server configuration:
SetEnvIf Request_URI ".*\.(php|ini)$" block_upload
Deny from env=block_upload
🧯 If You Can't Patch
- Implement strict file upload validation on the web server level
- Use a Web Application Firewall (WAF) to block malicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check if running Microweber version 1.1.3 or earlier in admin panel or via version fileCheck Version:
grep -r 'version' /path/to/microweber/installation/ | grep -i microweberVerify Fix Applied:
Confirm version is 1.2.0 or later and test file upload functionality with restricted file types📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to upload directories
- Files with .ini extension in upload folders
- Multiple failed upload attempts
Network Indicators:
- POST requests to upload endpoints with unusual file types
- Traffic patterns suggesting webshell communication
SIEM Query:
source="web_logs" AND (uri="*upload*" OR uri="*settings*") AND (file_extension="ini" OR file_extension="php")