PT-2020-13131 · Monox · Monox

Published 2020-04-29 · Updated 2020-05-04 · CVE-2020-12471

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MonoX versions prior to 5.1.40.5152

Description The issue allows remote code execution due to deserialization in certain modules. This can be exploited via specific API endpoints, such as "HTML5Upload.ashx" or "Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx", because of vulnerabilities in ModuleGallery.HTML5Upload, ModuleGallery.SilverLightUploadModule, HTML5Upload, and SilverLightUploadHandler.

Recommendations For MonoX versions prior to 5.1.40.5152, update to version 5.1.40.5152 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable modules, specifically ModuleGallery.HTML5Upload and ModuleGallery.SilverLightUploadModule, until a patch is applied. Additionally, limit interactions with the affected API endpoints, "HTML5Upload.ashx" and "Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx", to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-12471

Affected Products

Monox

References · 3

• 🔥 https://github.com/belong2yourself/vulnerabilities/tree/master/MonoX%20CMS/Remote%20Code%20Execution%20via%20Insecure%20Deserialization · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12471 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12471 · Vendor Advisory