CVE-2023-27164

[description]
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows
attackers to execute arbitrary code via a crafted .md file.
>
------------------------------------------
>
[VulnerabilityType Other]
File Upload
>
------------------------------------------
>
[Vendor of Product]
https://github.com/halo-dev/halo
>
------------------------------------------
>
[Affected Product Code Base]
halo - <= Version 1.6.1
>
------------------------------------------
>
[Affected Component]
The API endpoints /api/admin/backups/markdown/import is vulnerable to malicious file upload.
>
------------------------------------------
>
[Attack Type]
Remote
>
------------------------------------------
>
[Impact Code execution]
true
>
------------------------------------------
>
[Impact Information Disclosure]
true
>
------------------------------------------
>
[Attack Vectors]
POC: upload a malicious file, it's content is javascript code, like <script>alert("XSS")</script>, when we view this article, the JS code will be executed.
details can be seen: https://notes.sjtu.edu.cn/s/s5oEvs-p5
>
------------------------------------------
>
[Discoverer]
beet1e
>
------------------------------------------
>
[Reference]
http://halo.com
https://github.com/halo-dev/halo
https://notes.sjtu.edu.cn/s/s5oEvs-p5