PT-2020-16679 · Flexdotnetcms · Flexdotnetcms

Erik Wynter · Published 2020-11-12 · Updated 2022-12-06 · CVE-2020-27386

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FlexDotnetCMS versions prior to 1.5.9

Description The issue allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code in the form of a safe file type and then renaming the file to an executable extension using the FileEditor or the FileManager's rename function. The attacker can then execute the file via an HTTP GET request to the file's path.

Recommendations For versions prior to 1.5.9, update to version 1.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileManager and FileEditor to minimize the risk of exploitation. Avoid using the rename function in the FileManager to prevent malicious file uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-27386

Affected Products

Flexdotnetcms

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/pull/14339 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/flexdotnetcms_upload_exec.rb · Exploit
• 🔥 https://blog.vonahi.io/whats-in-a-re-name · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27386 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27386 · Vendor Advisory
• https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9 · Note
• http://packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upload.html · Note
• https://t.me/cibsecurity/16269 · Telegram Post