Over 30 Vulnerabilities Discovered Across 20 CMS Products

guest · Aug 10, 2020

Over 30 Vulnerabilities Discovered Across 20 CMS Products
August 10, 2020
https://www.securityweek.com/over-30-vulnerabilities-discovered-across-20-cms-products

The research was conducted by Alvaro Muñoz of GitHub and Oleksandr Mirosh of Micro Focus Fortify, and it focused on the security controls implemented by various CMS frameworks and products and methods for bypassing them.
CMSs allow users to create and modify digital content, typically being used for web content management and enterprise content management.

Muñoz and Mirosh, who presented their findings last week at the Black Hat cybersecurity conference, focused on .NET and Java-based products, and they showed how an unprivileged attacker can escape template sandboxes and achieve remote code execution.

“In the most simple attack scenario, the attacker has access to the target CMS applications such as regular Sharepoint users being able to create their own sites and therefore being able to provide their own templates,” Muñoz explained.
[...] we were able to compromise the underlying infrastructure which could have allowed us to initiate attacks against other tenants.”
Click to expand...

Room for Escape: Scribbling Outside the Lines of Template Security

Some of the CMS that we analyzed were vulnerable to SSTI and we were able to inject arbitrary content on the templates. In other cases a XSS vulnerability could be used to trick a legitimate user to create or modify an existing template.

While some of these vectors, such as the flaws in the implementation of the sandboxes, are very specific to concrete template engines, others are generic in the sense that they work across different engines and will probably work even in future releases of these engines.
Click to expand...

Log in or Sign up

Over 30 Vulnerabilities Discovered Across 20 CMS Products

guest Guest

Log in or Sign up

Over 30 Vulnerabilities Discovered Across 20 CMS Products

guest Guest

Useful Searches