[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] MS Made Simple - File upload bypass with .phar extension lead to RCE
From: riccardo krauter <riccardo.krauter () gmail ! com>
Date: 2021-03-17 13:22:10
Message-ID: 8a2e062b-77ae-4969-f38b-640532e2b7e5 () gmail ! com
[Download RAW message or body]
1) Summary
Affected software CMS Made Simple-2.2.15
Vendor URLhttp://www.cmsmadesimple.org/ <http://www.cmsmadesimple.org/>
Vulnerability File upload bypass with .phar extension lead to RCE
2) Vulnerability Description
The vulnerability affect the `FilePicker` module,
it is possible to bypass the restriction and upload a malicious file with `.phar` extension to \
gain Remote Code Execution. This vulnerability is remotely exploitable and require \
authentication.
3) PoC and details
* Login into the admin area and surf to the `MicroTiny WYSIWYG editor` functionality then click \
on the insert/edit image button
* A new window will be opened, now click on the search button, the `CMSMS File Picker` will be \
shown
* Click on the upload button and Select the .phar file
* Surf to uploads/your-file-name.phar and enjoy the shell
The exploit is working because the upload handler checks only if the extension contains the \
`php` string (obviously `phar` does not match). The exploit works fine on a standard Ubuntu \
system, here the configuration used for the tests:
* Linux ubuntu 5.4.0-58-generic
* php version 7.4.3
* Apache/2.4.41 (Ubuntu)
* File Picker version = "1.0.5"
* CMS Made Simple-2.2.15
More details here: https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md
4) Credits
This vulnerability has been discovered and reported
by Riccardo Krauter researcher @ Soter IT Security (soteritsecurity.com).
5) Timeline
2021/02/26 Vendor was informed
2021/02/26 Vendor said he won't fix
2021/03/17 Public disclosure
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic