PT-2017-12033 · Dotcms · Dotcms

M3@Pandas · Published 2017-07-20 · Updated 2017-07-25 · CVE-2017-11466

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dotCMS version 4.1.1

Description The issue allows remote authenticated administrators to upload arbitrary files, including .jsp files, to any location on the server. This is achieved through directory traversal sequences in the fieldName parameter to the 'servlets/ajax file upload' endpoint. As a result, arbitrary code can be executed by requesting the uploaded .jsp file at a /assets URI.

Recommendations For dotCMS version 4.1.1, consider restricting access to the 'servlets/ajax file upload' endpoint to prevent arbitrary file uploads until a patch is available. Additionally, restrict the fieldName parameter to prevent directory traversal sequences. As a temporary workaround, consider disabling the AjaxFileUploadServlet to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-11466

Affected Products

Dotcms

References · 6

• 🔥 http://seclists.org/fulldisclosure/2017/Jul/33 · Exploit
• 🔥 https://packetstormsecurity.com/files/143383/dotcms411-shell.txt · Exploit
• https://github.com/dotCMS/core/issues/12131 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-11466 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11466 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11466 · Note