The Neos team has issued a warning about a critical security vulnerability in Flow and Neos, which, under certain conditions, allows attackers to upload arbitrary files to the server and potentially execute the uploaded code.
It affects all Flow versions released in recent years and, consequently, all Neos versions built on a vulnerable Flow version.
The vulnerability can be patched by updating to a newer version. Neos and Flow projects hosted on Flownative Beach were never at risk due to Beach’s security architecture. However, Neos and Flow projects should be upgraded as soon as possible.
What is this about?
In Flow applications, data from the web request is transformed into arguments for the code being called. If such an argument is of type PersistentResource, the file name and content can be included in the request.
In most cases, this is only possible if the user is logged in. And Flow provides a list of prohibited file extensions for such uploads.
It has now come to light that if such an argument is sent but a specific error is triggered in the request, processing is aborted – yet the upload remains publicly accessible on the file system.
This can have serious consequences if the server executes such a file as a script when it is accessed.
Why Beach is not affected
In Beach, such uploads are not written to the local file system but are stored in cloud storage. Due to the security vulnerability, it is also potentially possible to carry out unauthorised uploads in Beach projects.
However, the PHP interpreter in Beach never executes such files; requests for these resources are passed directly from the cloud storage without ever reaching PHP. Furthermore, other scripting languages are not processed in Beach anyway.
What you should do
Your instances are not vulnerable to attack via this vulnerability. However, this attack vector has given us further ideas on how we can make Beach even more secure for other scenarios. We will keep you informed of any changes.
However, due to the vulnerability in Flow, it is also possible to upload arbitrary files within Beach. An update to the versions released today is therefore also very important for Beach users.
If you use Flow and Neos outside of Beach as well – for example, locally, on other servers or in Docker images – please check whether the vulnerability can be exploited there. We also recommend that you update to the new versions there as soon as possible.
We have updated our public nginx image on Docker Hub to prevent PHP files from being executed from uploads, even if the image is not running within Beach.