Security issue

[AndreGl]

Hi

It is possible to upload files by using the direct url
/admin/plugins/ckeditor/fm/connectors/php/upload.php

So you can upload a file to images folder and rename it by using:
/admin/plugins/ckeditor/plugins/pdw_file_browser/actions.php

Here is the server provider log:

12/01/2025 12:03:49
Ausfuehrendes Script: ~/www/admin/plugins/ckeditor/fm/connectors/php/upload.php
Betroffene Datei: www/images/af84723e11b2.gif
Vorgang: create

12/01/2025 12:03:49
Ausfuehrendes Script: ~/www/admin/plugins/ckeditor/fm/connectors/php/upload.php
Betroffene Datei: www/images/af84723e11b2.gif
Vorgang: open

12/01/2025 12:03:49
Ausfuehrendes Script: ~/www/admin/plugins/ckeditor/fm/connectors/php/upload.php
Betroffene Datei: www/images/af84723e11b2.gif
Vorgang: setattr

12/01/2025 12:03:49
Ausfuehrendes Script: ~/www/admin/plugins/ckeditor/plugins/pdw_file_browser/actions.php
Betroffene Datei: www/images/af84723e11b2.gif
Vorgang: rename-from

12/01/2025 12:03:49
Ausfuehrendes Script: ~/www/admin/plugins/ckeditor/plugins/pdw_file_browser/actions.php
Betroffene Datei: www/images/af84723e11b2.php
Vorgang: rename-to

[OverClockd]

I have already been a victim of this attack. New site owner via Google Merchant Center.
Best immediste fix I can think of is to DENY ALL except for whitewashed IPs for the admin .htaccess folder. Not the best fix and not sure how common IP spoofing is, however, definitely need a solid fix for this

[JasperVeerman]

I did password protect the /admin directory. This adds an additional login to the admin (like osc 2.3.x admin), which prompts before any request to any file is executed.

[JasperVeerman]

refer to commit: 04ce99e

[Neustradamus]

Dear @osCommerce team, @JanZ, @haraldpdl, @markkevans, @gburton, @acidvertigo, @Gergely, @tgely, @osc2nuke, @scottcwilson, @nickw108, @foxp2, @gadlol, @vakondweb, @anthonyjhicks, @mommaroodles, @ynechitajlo, @pan-oscom, @vladmalyshev: Have you seen this security ticket?