A pre-authenticated remote code execution vulnerability has been disclosed in dotCMS, an open-source content management system written in Java and “used by more than 10,000 customers in more than 70 countries around the world, from Fortune 500 brands and midsize companies.”
The critical flaw, tracked as CVE-2022-26352stems from a directory traversal attack when performing file downloads, allowing an adversary to execute arbitrary commands on the underlying system.
“An attacker can upload arbitrary files to the system,” Shubham Shah of Assetnote mentioned in a report. “By uploading a JSP file to the root directory of Tomcat, it is possible to achieve code execution, leading to the execution of commands.”
In other words, the arbitrary file upload flaw can be exploited to replace already existing files in the system with a web shell, which can then be used to gain persistent remote access.
Although the exploit allowed writing to arbitrary JavaScript files served by the app, researchers said the nature of the bug was such that it could be weaponized to get commands executed.
AssetNote said it discovered and reported the flaw on February 21, 2022, after which patches were released in versions 22.03, 5.3.8.10, and 21.06.7.
“When files are uploaded to dotCMS through the Content API, but before they become content, dotCMS writes the file to a temporary directory,” the company said. mentioned. “In the case of this vulnerability, dotCMS does not sanitize the filename passed through the multipart request header and therefore does not sanitize the temporary filename.”
“In the case of this exploit, an attacker can upload a special .jsp file to the dotCMS webapp/ROOT directory that may allow remote code execution,” he noted.
Comments are closed.