cyfenced.com →

[ CVE-2022-26352 · Published 17 Jul 2022 ]

dotCMS Unrestricted Upload of File Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 91%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-08-25
  • Known to be used in ransomware campaigns
  • EPSS: 91% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

CISA: dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Sep 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References