Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
The problem occurs only when a custom file upload validation feature is enabled, configured using one of the validation scripts based on Vulcan Logic Disassembler (VLD), and the VLD module itself is not available in the CLI SAPI context. In such a situation, the validation logic cannot properly verify the uploaded file and — instead of rejecting the file or returning an error — passes its contents to be executed as PHP code. An attacker can therefore upload a specially crafted file containing malicious PHP code and cause it to be executed on the server side.
An unauthenticated remote attacker can achieve full remote code execution (RCE) on the server, which may consequently lead to taking control of the application, data theft, or further lateral movement in the infrastructure.
Snuffleupagus should be updated to version 0.13.0, in which the issue has been fixed. As a temporary workaround, you can disable the file upload validation feature based on VLD scripts or ensure the availability of the VLD extension in the CLI SAPI.
Snuffleupagus in versions earlier than 0.13.0, only when a custom file upload validation feature based on VLD scripts is active and the VLD extension is not available in CLI SAPI.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XJvoisin Snuffleupagus
APPJvoisin< 0.13.0