PT-2017-16445 · Dotcms · Dotcms

Ben Nott · Publicado 2017-02-17 · Atualizado 2017-09-01 · CVE-2017-5344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.6.2

Description An issue was discovered in the findChildrenByFilter() function, which is called by the web-accessible path /categoriesServlet. This function performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented as part of a remediation effort, these controls can be overcome in the case of the q and inode parameters to the /categoriesServlet path. This allows for blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.

Recommendations For dotCMS versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /categoriesServlet path to minimize the risk of exploitation. Avoid using the q and inode parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-5344

Produtos afetados

Dotcms

Referências · 8

• 🔥 https://github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.sh · Exploit
• 🔥 https://exploit-db.com/exploits/41377 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Feb/34 · Exploit
• http://dotcms.com/security/SI-39 · Aviso do Fabricante
• http://securityfocus.com/bid/96259 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5344 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5344 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5344 · Aviso do Fabricante