PT-2020-16680 · Horizontcms · Horizontcms

Erikwynter · Published 2020-11-05 · Updated 2022-10-19 · CVE-2020-27387

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HorizontCMS versions prior to 1.0.0-beta (patched, but version number remains the same)

Description The issue allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code. This is achieved by uploading a PHP payload, renaming it using the FileManager's rename function to provide the payload with the PHP extension, and then executing the PHP file via an HTTP GET request to "/storage/".

Recommendations For HorizontCMS version 1.0.0-beta, update to the patched version of 1.0.0-beta to resolve the issue. As a temporary workaround, consider restricting access to the FileManager and disabling the rename function to minimize the risk of exploitation. Avoid using the FileManager to upload files with executable extensions until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-27387

Affected Products

Horizontcms

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/pull/14340 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/horizontcms_upload_exec.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/160046/HorizontCMS-1.0.0-beta-Shell-Upload.html · Exploit
• 🔥 https://blog.vonahi.io/whats-in-a-re-name · Exploit
• https://github.com/ttimot24/HorizontCMS/commit/436b5ab679fd27afa3d99c023dbe103113da4fee · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-27387 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27387 · Vendor Advisory
• https://t.me/cibsecurity/15854 · Telegram Post
• https://t.me/cvenotify/28464 · Telegram Post
• https://t.me/cvenotify/29057 · Telegram Post
• https://t.me/cibsecurity/40187 · Telegram Post