PT-2019-14493 · Total.Js · Total.Js Cms

Riccardo Krauter · Published 2019-09-05 · Updated 2022-05-24 · CVE-2019-15954

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Total.js CMS version 12.0.0

Description An issue allows an authenticated user with the widgets privilege to achieve Remote Command Execution (RCE) on the remote server. This is done by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server-side. The back-end's evaluation of the tag allows an attacker to escape the sandbox object using a specific payload: <script total>global.process.mainModule.require(child process).exec(RCE);</script>.

Recommendations For Total.js CMS version 12.0.0, consider disabling the widget functionality or restricting the child process module to prevent exploitation until a patch is available. Restrict access to the widget creation feature to minimize the risk of RCE.

Exploit

Fix

RCE

Command Injection

Missing Authorization

Weakness Enumeration

CWE-77

CWE-862

Related Identifiers

CVE-2019-15954

GHSA-V287-9W3V-X5C5

Affected Products

Total.Js Cms

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/totaljs_cms_widget_exec.rb · Exploit
• 🔥 https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf · Exploit
• 🔥 http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/47531 · Exploit
• 🔥 https://seclists.org/fulldisclosure/2019/Sep/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15954 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15954 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v287-9w3v-x5c5 · Vendor Advisory
• https://github.com/totaljs/cms · Note
• https://t.me/cvenotify/1195 · Telegram Post