Beware of File Upload Vulnerability in JVM Gutenberg Rich Text Icons Plugin

CVECVE-2023-51417
CVSScvssV3_1: 9.9
SourceCVE-2023-51417

The JVM Gutenberg Rich Text Icons plugin, which is used by many websites to allow users to add icons to posts and pages, contains a high severity file upload vulnerability. Attackers can exploit this to upload a malicious file type, like a PHP file, that gets executed on the server when accessed.

This occurs because the plugin fails to properly sanitize the file type being uploaded. It allows all file extensions instead of only safe image file types. Once a PHP file is uploaded, an attacker just needs to link to it from their website or a social media post to trigger the code to run with the privileges of the vulnerable website.

This gives the attacker full control of the server, allowing them to steal sensitive data, install malware, or launch other attacks on site visitors. The vulnerability received a CVSS score of 9.9 out of 10 due to its critical impact.

If you use this plugin, update to the latest version immediately or consider removing it until patched. Website owners should also carefully check their files for any signs of compromise. Users are advised to be cautious visiting sites running this or other vulnerable plugins until updates are applied. Proper input validation and file type restrictions can prevent these kinds of security issues.

References