提出 #549918: ChestnutCMS V1.5.4 Command Injection

Vulnerability description

ChestnutCMS V1.5.4 has two background command execution vulnerabilities, both of which require administrator permissions to trigger.

The first vulnerability is in the Groovy script execution feature, which dynamically compiles and executes user-supplied Groovy scripts via the GroovyClassLoader, resulting in arbitrary code execution.

The second vulnerability is in the template resolution function, which can lead to remote code execution by concatenating the user's controllable template path, combined with the file upload function.

Code audit procedure

The first vulnerability: Groovy script execution

Code location: execGroovyScript method

Vulnerability analysis:

This method dynamically compiles and executes user-supplied Groovy scripts through a GroovyClassLoader.

A BaseGroovyScript instance directly calls the run method, resulting in arbitrary code execution.

Vulnerability trigger conditions:

Requires administrator rights.

Send Groovy script content via POST request.

The second vulnerability: template parsing

Code location: getSsIVirtualContent method

Vulnerability analysis:

By concatenating user-controllable template paths, combined with file upload capabilities, remote code execution may occur.

During template parsing, you enter Freemarker template parsing directly, resulting in arbitrary file reading or code execution.

Vulnerability trigger conditions:

Requires administrator rights.

Template resolution is triggered by a GET request.

POC

Vulnerability 1

Login Background - System Tools - GroovyScript

class TestGroovyScript extends com.chestnut.system.groovy.BaseGroowyScript {

void run(PrintWriter out) {

out.println(new Scanner(Runtime.getRuntime ().exec("whoami").getInputStream()). useDelimiter("\\A"). next())

}

}

Vulnerability 2

Login Background - Content Management - Template Management

$_{"freemarker.template.utility.Execute"? new()("whoami")}

To access the template file:

http(s)://target-ip/cms/ssi/virtual/? sid={sid}&pp=pc&t={template file name}

• ソース: ⚠️ https://wiki.shikangsi.com/post/share/079359db-a913-44b5-89f6-46ac3b243bac
• ユーザー: XingYue_Mstir (UID 72225)
• 送信: 2025年04月03日 04:38 (2 年 ago)
• モデレーション: 2025年04月14日 01:33 (11 days later)
• ステータス: 重複
• VulDBエントリ: 294545 [ChestnutCMS 迄 1.5.0 Create Template 特権昇格]
• ポイント: 0