PT-2019-14493 · Total.Js · Total.Js Cms
Riccardo Krauter
·
Publicado
2019-09-05
·
Atualizado
2022-05-24
·
CVE-2019-15954
CVSS v3.1
9.9
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Total.js CMS version 12.0.0
Description
An issue allows an authenticated user with the widgets privilege to achieve Remote Command Execution (RCE) on the remote server. This is done by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server-side. The back-end's evaluation of the tag allows an attacker to escape the sandbox object using a specific payload:
<script total>global.process.mainModule.require(child process).exec(RCE);</script>.Recommendations
For Total.js CMS version 12.0.0, consider disabling the widget functionality or restricting the
child process module to prevent exploitation until a patch is available. Restrict access to the widget creation feature to minimize the risk of RCE.Exploit
Correção
RCE
Command Injection
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Total.Js Cms