#VU47491 Code injection in Nette - CVE-2020-15227

Vulnerability identifier: #VU47491

Vulnerability risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2020-15227

CWE-ID: CWE-74

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Nette
Web applications / CMS

Vendor: Nette Foundation

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation in URL. A remote attacker can pass specially crafted data to the application and execute arbitrary PHP code on the server.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Nette: 2.0.0 - 3.0.5

---

External links
https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
https://packagist.org/packages/nette/application
https://packagist.org/packages/nette/nette

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.