PT-2020-15365 · Halo · Halo Cms

Any-How · Published 2020-09-30 · Updated 2020-10-09 · CVE-2020-21523

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions halo CMS version 1.1.3

Description A Server-Side Freemarker template injection issue exists in the Edit Theme File function, where the ftl file can be edited. This Freemarker template file can cause arbitrary code execution when rendered in the background. An example of exploitation is through the assignment and execution of a specific command, such as creating a file named "freemarkerPwned" in the /tmp directory.

Recommendations For halo CMS version 1.1.3, as a temporary workaround, consider restricting access to the Edit Theme File function to minimize the risk of exploitation. Additionally, avoid editing the ftl file directly until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-21523

Affected Products

Halo Cms

References · 4

• 🔥 https://github.com/halo-dev/halo/issues/419 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21523 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21523 · Vendor Advisory
• https://t.me/cibsecurity/14963 · Telegram Post