CMS Made Simple 2.2.15 Shell Upload

2021.03.22
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

1) Summary Affected software CMS Made Simple-2.2.15 Vendor URLhttp://www.cmsmadesimple.org/ <http://www.cmsmadesimple.org/> Vulnerability File upload bypass with .phar extension lead to RCE 2) Vulnerability Description The vulnerability affect the `FilePicker` module, it is possible to bypass the restriction and upload a malicious file with `.phar` extension to gain Remote Code Execution. This vulnerability is remotely exploitable and require authentication. 3) PoC and details * Login into the admin area and surf to the `MicroTiny WYSIWYG editor` functionality then click on the insert/edit image button * A new window will be opened, now click on the search button, the `CMSMS File Picker` will be shown * Click on the upload button and Select the .phar file * Surf to uploads/your-file-name.phar and enjoy the shell The exploit is working because the upload handler checks only if the extension contains the `php` string (obviously `phar` does not match). The exploit works fine on a standard Ubuntu system, here the configuration used for the tests: * Linux ubuntu 5.4.0-58-generic * php version 7.4.3 * Apache/2.4.41 (Ubuntu) * File Picker version = "1.0.5" * CMS Made Simple-2.2.15 More details here: https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md 4) Credits This vulnerability has been discovered and reported by Riccardo Krauter researcher @ Soter IT Security (soteritsecurity.com). 5) Timeline 2021/02/26 Vendor was informed 2021/02/26 Vendor said he won't fix 2021/03/17 Public disclosure


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top