CKFinder 3.5.1 and CKFinder 2.6.3 released
We would like to announce that CKFinder 3.5.1 and CKFinder 2.6.3 have just been released. We have also published new guidelines for securing your server against content sniffing by web browsers when using a public folder for uploaded files.
CKFinder 2.6.3 includes a security patch for the server-side part of the application, so updating is highly recommended. The security patch for CKFinder 2.6.3 was added to the PHP, ASP.NET, classic ASP and ColdFusion server-side connectors. Java version was not affected.
The issue that is resolved in the patch and the updated security guidelines was reported by Joshua Provoste as a problem related to handling files without extension, content sniffing, and various XSS issues to which it may lead. We would like to thank Joshua for his cooperation!
Updated security guidelines
Before this release, the existing CKFinder documentation could lead to the impression that CKFinder can fully protect against content sniffing by web browsers. In order to clarify this and explain how to achieve a 100% secure configuration, we added a new article about content sniffing made by web browsers and recommended server configuration in order to avoid exposing users to an extra risk.
Uploading a file, both without an extension and with an allowed extension, under some circumstances may lead to XSS vulnerabilities. XSS may occur if:
- CKFinder is configured to upload files to a publicly accessible folder,
- and the web server does not send the
X-Content-Type-Options: nosniffheaders to all HTTP responses when serving files from the publicly available folder.
With the above conditions, a malicious user may upload a file without the .html extension that will be rendered by some browsers like a regular HTML file. This happens due to content sniffing as some browsers perform additional checks on the raw file contents.
Please take a moment to read the updated security guidelines for CKFinder and update your web server configuration:
- CKFinder 3 for PHP
- CKFinder 3 for ASP.NET
- CKFinder 2 for PHP
- CKFinder 2 for ColdFusion
- CKFinder 2 for ASP.NET
- CKFinder 2 for ASP
- CKFinder 2 for Java
Related CVE: CVE-2019-15891.
CKFinder 2.6.3
CKFinder 2.6.3 contains a security patch for the server-side part of the application and an update is highly recommended.
In version 2.6.2.1 and older it was possible to upload files without any extension. This applies to CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion and CKFinder for PHP. CKFinder for Java was not affected. Version 2.6.3 introduces a special type of extension (no_ext), which allows server administrators to explicitly enable the possibility of uploading files without any extension.
We recommend to always explicitly define the allowed extensions for uploaded files and set up a secure server configuration as explained in the guidelines mentioned above.
Related CVE: CVE-2019-15862.
CKFinder 3.5.1
In CKFinder 3 it was impossible to upload files without an extension. This feature has been added in version 3.5.1, but in order to allow such files, they must be explicitly enabled by using the special no_ext extension when defining the list of allowed or denied file extensions.
We recommend to always explicitly define the allowed extensions for uploaded files and set up a secure server configuration as explained in the guidelines mentioned above.
Changelog
See the release notes for a full list of changes.
Download
Download CKFinder now! Also available as a CKFinder 3 Symfony bundle and CKFinder 3 Laravel package.
Reporting issues and feature requests
If you miss anything in CKFinder, have ideas on how the best file uploader for CKEditor could be improved, or found a bug, please do not hesitate to report an issue in the CKFinder issue tracker. The tracker is public, so not only can you submit your ideas, but you can also browse existing issues and add your comments there.
Support
All CKFinder licenses come with a year of dedicated support straight from core CKFinder developers. You can also refer to StackOverflow for community support.
