PT-2018-18198 · Sitecore · Sitecore.Net

Chris Moberly · Published 2018-04-27 · Updated 2018-08-11 · CVE-2018-7669

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sitecore Sitecore.NET versions 8.1 rev. 151207 Hotfix 141178-1 and above

Description An issue allows an attacker to perform a directory traversal attack using the 'Log Viewer' application. This is achieved by accessing a specific URI, "sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=", and manipulating the file parameter. The validation filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack, enabling access to arbitrary files from the host Operating System.

Recommendations For Sitecore Sitecore.NET versions 8.1 rev. 151207 Hotfix 141178-1 and above, consider restricting access to the 'Log Viewer' application until a patch is available. As a temporary workaround, avoid using the file parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-7669

Affected Products

Sitecore.Net

References · 5

• 🔥 http://seclists.org/fulldisclosure/2018/Apr/47 · Exploit
• 🔥 https://exploit-db.com/exploits/45152 · Exploit
• https://kb.sitecore.net/articles/356221 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7669 · Security Note