Unauthenticated Arbitrary File Upload in ELEX HelpDesk IMAP Attachment Handling

Skrevet den af i ELEX HelpDesk & Customer Ticketing System

The ELEX HelpDesk & Customer Ticketing System (WSDesk) plugin saves attachments from emails fetched over IMAP into the public uploads directory under the sender-supplied filename, checked only against a case-sensitive four-entry extension denylist. Anyone who can send email to the support mailbox can upload a file with an executable extension such as .PHP, .phtml or .phar and run code on the server. Sites with IMAP email piping enabled are affected.

This vulnerability affects the following application versions:

  • ELEX HelpDesk & Customer Ticketing System 1.0.0
  • ELEX HelpDesk & Customer Ticketing System 2.0.0
  • ELEX HelpDesk & Customer Ticketing System 2.0.1
  • ELEX HelpDesk & Customer Ticketing System 2.0.2
  • ELEX HelpDesk & Customer Ticketing System 3.0.0
  • ELEX HelpDesk & Customer Ticketing System 3.0.1
  • ELEX HelpDesk & Customer Ticketing System 3.1.0
  • ELEX HelpDesk & Customer Ticketing System 3.1.1
  • ELEX HelpDesk & Customer Ticketing System 3.1.2
  • ELEX HelpDesk & Customer Ticketing System 3.1.3
  • ELEX HelpDesk & Customer Ticketing System 3.1.4
  • ELEX HelpDesk & Customer Ticketing System 3.1.5
  • ELEX HelpDesk & Customer Ticketing System 3.2.0
  • ELEX HelpDesk & Customer Ticketing System 3.2.1
  • ELEX HelpDesk & Customer Ticketing System 3.2.2
  • ELEX HelpDesk & Customer Ticketing System 3.2.3
  • ELEX HelpDesk & Customer Ticketing System 3.2.4
  • ELEX HelpDesk & Customer Ticketing System 3.2.5
  • ELEX HelpDesk & Customer Ticketing System 3.2.6
  • ELEX HelpDesk & Customer Ticketing System 3.2.7
  • ELEX HelpDesk & Customer Ticketing System 3.2.8
  • ELEX HelpDesk & Customer Ticketing System 3.2.9
  • ELEX HelpDesk & Customer Ticketing System 3.3.0
  • ELEX HelpDesk & Customer Ticketing System 3.3.1
  • ELEX HelpDesk & Customer Ticketing System 3.3.2
  • ELEX HelpDesk & Customer Ticketing System 3.3.3
  • ELEX HelpDesk & Customer Ticketing System 3.3.4
  • ELEX HelpDesk & Customer Ticketing System 3.3.5
  • ELEX HelpDesk & Customer Ticketing System 3.3.6
  • ELEX HelpDesk & Customer Ticketing System 3.3.7