Insufficient Type Distinction Affecting livewire/livewire package, versions <3.5.2

livewire/livewire is an A front-end framework for Laravel.

Affected versions of this package are vulnerable to Insufficient Type Distinction when validating uploaded files in the generateHashNameWithOriginalNameEmbedded() function. An attacker can execute code by uploading a file with a valid MIME type such as image/png which actually contains executable code and has an executable file extension like .php.

Note: This is only exploitable if the following conditions are met, illustrated in the snippet below:

1. The affected application applies $file->getClientOriginalName() to filenames.

2. Files are stored in a publicly accessible directory on the affected server.

3. The affected server is configured to execute uploaded files.

class SomeComponent extends Component
{
    use WithFileUploads;

#[Validate('image|extensions:png')]
public $file;

public function save()
{
    $this->validate();

    $this->file->storeAs(
        path: 'images',
        name: $this->file->getClientOriginalName(),
        options: ['disk' => 'public'],
    );
}

}

• GitHub Commit