Critical RCE Bug Reported in dotCMS Content Management Software
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-26352 | Unauthenticated File-Upload RCE in dotCMS (CVE-2022-26352) The ContentResource API in dotCMS 3.0 through 22.02 accepts multipart form uploads without sanitizing the submitted filename, allowing directory traversal so the uploaded file is written outside the intended storage location. An attacker triggers this by sending a crafted multipart POST request with traversal sequences embedded in the filename. When anonymous content creation is enabled, the flaw permits a fully unauthenticated attacker to upload an executable file such as a .jsp webshell and achieve remote code execution on the server. All dotCMS deployments running affected versions are exposed, with the highest risk on instances that allow anonymous content creation and expose the ContentResource API to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-25 with known ransomware use, it carries a 91.6% EPSS probability of exploitation, and a public proof of concept is available. Do: Upgrade every dotCMS deployment in the 3.0–22.02 range to a fixed release per vendor instructions (any version beyond the affected range, e.g., 22.03 or later, or the vendor's patched LTS branch). If patching must wait, disable anonymous content creation, restrict the upload path so files cannot be written into web-executable directories, and audit the web root for unexpected .jsp files. Review access logs for multipart POSTs to the ContentResource API containing traversal sequences in filenames, and confirm remediation via CISA's required-action guidance. | 9.8 | 92% | KEV ransomware PoC |
| moderate≈1,000–10,000 internet-exposed dotCMS instances (estimate; no authoritative install count) |
Full article311 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 04, 2022
A pre-authenticated remote code execution vulnerability has been disclosed in dotCMS, an open-source content management system written in Java and "used by over 10,000 clients in over 70 countries around the globe, from Fortune 500 brands and mid-sized businesses."
The critical flaw, tracked as CVE-2022-26352, stems from a directory traversal attack when performing file uploads, enabling an adversary to execute arbitrary commands on the underlying system.
"An attacker can upload arbitrary files to the system," Shubham Shah of Assetnote said in a report. "By uploading a JSP file to the tomcat's root directory, it is possible to achieve code execution, leading to command execution."
In other words, the arbitrary file upload flaw can be abused to replace already existing files in the system with a web shell, which can then be used to gain persistent remote access.
Although the exploit made it possible to write to arbitrary JavaScript files being served by the application, the researchers said the nature of the bug was such that it could be weaponized to gain command execution.
AssetNote said it discovered and reported the flaw on February 21, 2022, following which patches have been released in versions 22.03, 5.3.8.10, and 21.06.7.
"When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the file down in a temp directory," the company said. "In the case of this vulnerability, dotCMS does not sanitize the filename passed in via the multipart request header and thus does not sanitize the temp file's name."
"In the case of this exploit, an attacker can upload a special .jsp file to the webapp/ROOT directory of dotCMS which can allow for remote code execution," it noted.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/05/critical-rce-bug-reported-in-dotcms.html