Title: Multiple SQL injection vulnerabilities in dotCMS (8x CVE) Credit: Elar Lang / https://security.elarlang.eu Vendor/Product: dotCMS (http://dotcms.com/) Vulnerability: SQL injection Vulnerable version: before 3.5; 3.3.1 and 3.3.2 (depends on CVE) CVE: CVE-2016-8902, CVE-2016-8903, CVE-2016-8904, CVE-2016-8905, CVE-2016-8906, CVE-2016-8907, CVE-2016-8908, CVE-2016-4040 # Multiple SQL injections in dotCMS framework. ## CVE-2016-8902 - categoriesServlet, sort SQL injection vulnerability in the categoriesServlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter. Preconditions: None. No authentication needed. Proof-of-Concept URL, vulnerable parameter is "sort": /categoriesServlet?start=0&count=10&sort=SQLi ## CVE-2016-8903 - "Templates pages", _EXT_13_orderby SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the _EXT_13_orderby parameter. Preconditions: attacker must be authenticated. Proof-of-Concept URL (from "Admin Site" UI: "Site Browser > Templates pages", click on some column title in the resultset table): /c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=EXT_13&p_p_action=0&p_p_state=maximized&p_p_mode=view&_EXT_13_struts_action=%2Fext%2Ftemplates%2Fview_templates&_EXT_13_pageNumber=1&_EXT_13_orderby=SQLi ## CVE-2016-8904 - "Containers pages", _EXT_12_orderby SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the _EXT_12_orderby parameter. Preconditions: attacker must be authenticated. Proof-of-Concept URL (from "Admin Site" UI: "Site Browser > Containers pages", click on some column title in the resultset table): /c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=EXT_12&p_p_action=0&p_p_state=maximized&p_p_mode=view&_EXT_12_struts_action=%2Fext%2Fcontainers%2Fview_containers&_EXT_12_pageNumber=1&_EXT_12_orderby=SQLi ## CVE-2016-8905 - JSONTags servlet, sort SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter. Preconditions: attacker must be authenticated. Proof-of-Concept /JSONTags?start=0&count=10&sort=tagname SQLi ## CVE-2016-8906 - "Links pages", _EXT_18_orderby SQL injection vulnerability in the "Site Browser > Links page" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the _EXT_18_orderby parameter. Preconditions: attacker must be authenticated. Proof-of-Concept URL (from "Admin Site" UI: "Site Browser > Links pages", click on some column title in the resultset table): /c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=EXT_18&p_p_action=0&p_p_state=maximized&p_p_mode=view&_EXT_18_struts_action=%2Fext%2Flinks%2Fview_links&_EXT_18_pageNumber=1&_EXT_18_orderby=SQLi ## CVE-2016-8907 - "Content Types", _EXT_STRUCTURE_orderBy and _EXT_STRUCTURE_direction SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the _EXT_STRUCTURE_orderBy and _EXT_STRUCTURE_direction parameters. Preconditions: attacker must be authenticated. Proof-of-Concept URL (from "Admin Site" UI: "Content Types > Content Types", click on some column title in the resultset table) /c/portal/layout?p_l_id=56fedb43-dbbf-4ce2-8b77-41fb73bad015&p_p_id=EXT_STRUCTURE&p_p_action=1&p_p_state=maximized&p_p_mode=view&_EXT_STRUCTURE_struts_action=%2Fext%2Fstructure%2Fview_structure&_EXT_STRUCTURE_orderBy=SQLi&_EXT_STRUCTURE_direction=SQLi ## CVE-2016-8908 - "HTML pages", _EXT_15_orderby SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the _EXT_15_orderby parameter. Preconditions: attacker must be authenticated. Proof-of-Concept URL (from "Admin Site" UI: "Site Browser > HTML pages", click on some column title in the resultset table): /c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=EXT_15&p_p_action=0&p_p_state=maximized&p_p_mode=view&_EXT_15_struts_action=%2Fext%2Fhtmlpages%2Fview_htmlpages&_EXT_15_orderby=modDate,SQLi&_EXT_15_pageNumber=1 ## CVE-2016-4040 - "Workflow", _EXT_15_orderby SQL injection vulnerability in the "Workflow Screen" in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the _EXT_15_orderby parameter. Preconditions: attacker must be authenticated. Proof-of-Concept URL (from "Admin Site" UI: "Home > Workflow tasks", click on some column title in the resultset table) /html/portlet/ext/workflows/view_tasks_list.jsp?schemeId=&assignedTo=&createdBy=&stepId=&open=false&closed=true&keywords=&orderBy=SQLi&count=1&page=1 # Vulnerability Disclosure Timeline 2015-12-14 | me > dotCMS | 8 SQL injection vulnerabilities 2015-12-14 | dotCMS > me | they were planning fixes in upcoming release, estimated to beginning of 2016 2016-03-16 | dotCMS | dotCMS version 3.3.1 release (CVE-2016-4040 still not fixed) 2016-04-07 | me > dotCMS | what is the situation with reported vulnerabilities? 2016-04-07 | dotCMS > me | CVE-2016-4040 will be fixed in 3.5, which is estimated to be out in mid-April 2016-04-19 | dotCMS | dotCMS version 3.5 release 2016-05-10 | dotCMS | dotCMS version 3.3.2 release 2016-10-31 | me | Full Disclosure on http://security.elarlang.eu # Related fixes and releases https://dotcms.com/docs/latest/change-log#release-3.3.1 https://dotcms.com/docs/latest/change-log#release-3.5 https://dotcms.com/docs/latest/change-log#release-3.3.2 -- Elar Lang Blog @ https://security.elarlang.eu Pentester, lecturer @ http://www.clarifiedsecurity.com