What happened?

A critical vulnerability has been found in the way Flow handles file uploads. With a single request, and without being logged in, an attacker can place arbitrary files in the public resources folder (Web/_Resources/Persistent) of a Flow application. Two problems come together here: the upload is processed before the security policy of the called action is enforced, and the list of forbidden file extensions had gaps.

Whether this turns into remote code execution depends on your web server. If it executes PHP or other scripts located below Web/_Resources, an uploaded file can be run by simply requesting it. On Apache, an uploaded .htaccess file can even switch on script execution that had been disabled before.

Neos is built on Flow, so every Neos site running on one of the affected Flow versions is vulnerable as well, regardless of which packages or plugins it uses.

What you need to do

Update Flow now. Fixed versions are available for all maintained branches: 8.3.22, 8.4.7, 9.0.10, 9.1.5 and 9.2.3. For most projects this is a matter of running

composer update neos/flow

and deploying the result. Check with composer show neos/flow that you actually ended up on one of the fixed versions. The releases are plain patch-level updates; details and change logs are in the release announcement on discuss.neos.io.

The new versions check file extensions for every kind of upload, discard newly created resources if a request fails, and enforce the action policy before an error action is called.

If you cannot update right away, or if you run Flow 8.2 or older: configure your web server so that it never executes PHP or any other script type below Web/_Resources. This closes the code execution path. Versions up to Flow 8.2 are no longer maintained and will not receive a fix, so there this workaround is the only protection. It is a sensible hardening measure in any case, also after updating.

Check whether you have been hit. Updating closes the hole but does not remove files which may have been uploaded already. The security advisory contains concrete steps for this: look for suspicious files in Web/_Resources/Persistent, and for suspicious file names in the neos_flow_resourcemanagement_persistentresource table. Review what you find, then remove the files and their database records.

Thank you

This issue was reported to us by mittwald, who found it and disclosed it responsibly via security (at) neos.io, giving us the time to prepare a fix before any details became public. That is exactly how we wish every security report would reach us. Thank you!

Once the report was in, fixes and releases for five branches were ready within 24 hours. That only works if a lot of people drop what they are doing. A big thank you to everyone who analysed, fixed, reviewed, tested and released:

• Denny Lubitz
• Bernhard Schmitt
• Sebastian Kurfürst
• Karsten Dambekalns
• Marc Henry Schultz
• Christian Müller
• Bastian Waidelich
• Anke Häslich
• Robert Lemke
• Steffen Meyer

Questions?

If you are unsure whether your project is affected or need a hand with the update, ask in the forum or on Slack. And if you ever come across a security issue in Neos, Flow or a related package, please do not post it in public but write to security (at) neos.io, so we can work on a fix together first.