SEC Consult Vulnerability Lab Security Advisory < 20200717-0 > ======================================================================= title: Multiple Vulnerabilities product: WonderCMS vulnerable version: <=3.1.0 fixed version: - CVE number: - impact: High homepage: https://www.wondercms.com/ found: 2020-04-30 by: Calvin Phang (Office Singapore) SEC Consult Vulnerability Lab An integrated part of SEC Consult Europe | Asia | North America https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "WonderCMS is a free simple website builder. Aimed to be extremely easy to install (1 step), light and simple to use.It's an open source flat file CMS (Content Management System), built with PHP and developed since 2008." Source: https://www.wondercms.com/ Business recommendation: ------------------------ The vendor did not respond to our communication attempts, hence no patch is available. An in-depth security analysis performed by security professionals is highly advised, as the software may be affected from further security issues. Vulnerability overview/description: ----------------------------------- 1. Stored Cross Site Scripting via Filename (Authenticated user) This vulnerability allows an authenticated user (admin) to upload files with a malicious client side script as filename. It will be executed in the browser of a user if he visits the manipulated URL. 2. Directory Traversal (Authenticated user) This vulnerability allows an authenticated user (admin) to delete arbitrary files via directory traversal on the operating system with the access rights of the web server. 3. Upload of arbitrary files (Authenticated user) It was identified that an authenticated user (admin) can bypass file type checks and upload malicious files. In this specific case, arbitrary server side PHP code such as web shells can be uploaded. As a result the attacker can run arbitrary code on the server side with the privileges of the web server. This could lead to a full system compromise. Proof of concept: ----------------- 1. Stored Cross Site Scripting via Filename (Authenticated user) [ PoC has been removed as no patch is available and the vendor is unresponsive ] 2. Directory Traversal (Authenticated user) [ PoC has been removed as no patch is available and the vendor is unresponsive ] 3. Upload of arbitrary files (Authenticated user) [ PoC has been removed as no patch is available and the vendor is unresponsive ] Vulnerable / tested versions: ----------------------------- WonderCMS version 3.0.7 has been tested, which was the latest version available at the time of the test. Previous versions may also be affected. On 18-05-2020, the vendor released a newer version 3.1.0. However, the latest version are still vulnerable to the above vulnerabilities. Vendor contact timeline: ------------------------ 2020-05-06: Contacting vendor through report@wondercms.com; no response 2020-05-13: Follow-up with vendor; no response 2020-05-21: Follow-up with vendor; no response 2020-06-02: Follow-up with vendor; no response 2020-06-19: Follow-up with vendor; no response 2020-06-30: Tested the vulnerabilities in the latest version (3.1.0) that is available on vendor's webpage, still affected. 2020-07-17: Public release of security advisory Solution: --------- The vendor did not respond to our communication attempts, hence no patch is available. Workaround: ----------- None Advisory URL: ------------- https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/career/index.html Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/contact/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF C. Phang / @2020