BlogEngine.NET 3.3.7 Directory Traversal / Remote Code Execution

2019.06.19
Credit: Aaron Bishop
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22

BlogEngine.NET, versions 3.3.7 and earlier, is vulnerable to two separate Directory Traversal issues that can lead to Remote Code Execution. CVE-2019-10719 exploits a directory traversal in /api/upload, allowing users to write files to any location within the web root. This bypasses the protection added in version 3.3.7 to prevent CVE-2019-6714. A user, with the ability to add images or files to posts, can upload a malicious PostView.ascx file to the Themes folder. The code could then be triggered by setting the theme parameter to the newly create folder. CVE-2019-10720 exploits a directory traversal in the theme cookie to trigger a remote code execution. A user, with the ability to add images or files to posts, can upload a malicious PostView.ascx file, then trigger the RCE by setting the theme cookie to ../../App_Data/files. Disclosure at: https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top