PT-2017-12033 · Dotcms · Dotcms

M3@Pandas · Publicado 2017-07-20 · Atualizado 2017-07-25 · CVE-2017-11466

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dotCMS version 4.1.1

Description The issue allows remote authenticated administrators to upload arbitrary files, including .jsp files, to any location on the server. This is achieved through directory traversal sequences in the fieldName parameter to the 'servlets/ajax file upload' endpoint. As a result, arbitrary code can be executed by requesting the uploaded .jsp file at a /assets URI.

Recommendations For dotCMS version 4.1.1, consider restricting access to the 'servlets/ajax file upload' endpoint to prevent arbitrary file uploads until a patch is available. Additionally, restrict the fieldName parameter to prevent directory traversal sequences. As a temporary workaround, consider disabling the AjaxFileUploadServlet to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-11466

Produtos afetados

Dotcms

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2017/Jul/33 · Exploit
• 🔥 https://packetstormsecurity.com/files/143383/dotcms411-shell.txt · Exploit
• https://github.com/dotCMS/core/issues/12131 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-11466 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11466 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11466 · Nota