Remote Code Execution in ClipBucket via Unrestricted File Upload

ClipBucket v5 versions prior to 5.5.3-#182 are susceptible to a critical remote code execution (RCE) vulnerability. The flaw exists within the FileUpload::manageFile() function located in fileupload.class.php. Attackers with valid application accounts can bypass the existing MIME type validation by crafting a malicious PHP payload that includes valid image magic bytes. Because the application logic fails to correctly enforce or update the file extension during the processing phase, the server saves the attacker-supplied file with a .php extension to the web-accessible filesystem. Once uploaded, an attacker can trigger the execution of this file via PHP-FPM by navigating to the file path, resulting in arbitrary code execution on the underlying host. This vulnerability represents a significant risk for organizations running ClipBucket in internet-facing configurations, as it allows full system compromise upon successful authentication and upload.

Attack Chain

1. Attacker authenticates to the ClipBucket application as a registered user.
2. Attacker crafts a PHP payload disguised as an image by prepending valid image magic bytes to the file content.
3. Attacker initiates a photo upload request to the application's photo upload endpoint.
4. The application triggers FileUpload::manageFile() to validate the uploaded file's MIME type.
5. The validation logic is bypassed by the presence of the legitimate image magic bytes.
6. The application writes the malicious file to the storage directory, failing to sanitize or overwrite the .php extension.
7. Attacker identifies the storage path of the uploaded file via the application response or web directory enumeration.
8. Attacker sends an HTTP request to the uploaded file's URL, causing the web server to execute the PHP code via PHP-FPM.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the web server with the privileges of the web service account. This could lead to full system compromise, data theft, further lateral movement within the network, or the installation of persistent backdoors. Targeted entities include any organization hosting video content platforms using vulnerable versions of ClipBucket.

Recommendation

Prioritized actions for defense and remediation:

• Patch ClipBucket to version 5.5.3-#182 or later immediately to resolve the logic error in FileUpload::manageFile().
• Inspect web server access logs for repeated HTTP 200 responses to files with extensions like .php residing in typical user-upload directories.
• Implement strict file extension whitelisting on all web application upload endpoints to ensure only non-executable formats are processed.
• Configure the web server and PHP-FPM to prevent script execution within directories intended for user-provided static content (e.g., /uploads/).
• Deploy web application firewall (WAF) rules to detect and block file upload requests containing suspicious PHP code sequences within image-based MIME payloads.