PT-2019-14491 · Total.Js · Total.Js Cms

Riccardo Krauter · Published 2019-09-05 · Updated 2022-05-24 · CVE-2019-15952

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Total.js CMS version 12.0.0

Description An issue in Total.js CMS allows an authenticated user with the Pages privilege to conduct a path traversal attack to include .html files outside the permitted directory. If a page contains a template directive, it will be server-side processed, potentially leading to Remote Command Execution if a user can control the content of a .html file and inject a malicious template directive.

Recommendations For Total.js CMS version 12.0.0, restrict access to the Pages privilege and avoid allowing users to control the content of .html files to minimize the risk of exploitation. As a temporary workaround, consider disabling the processing of template directives in .html files until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-15952

GHSA-PWVP-H579-HFXG

Affected Products

Total.Js Cms

References · 8

• 🔥 https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf · Exploit
• 🔥 https://seclists.org/fulldisclosure/2019/Sep/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15952 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15952 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pwvp-h579-hfxg · Vendor Advisory
• https://github.com/totaljs/cms · Note
• http://seclists.org/fulldisclosure/2019/Sep/11 · Note
• http://packetstormsecurity.com/files/154340/Totaljs-CMS-12.0-Path-Traversal.html · Note