dotCMS Administration Panel up to 3.7.1 Push Publishing path traversal

Summaryinfo

A vulnerability was found in dotCMS Administration Panel up to 3.7.1. It has been rated as critical. The impacted element is an unknown function of the component Push Publishing. The manipulation leads to path traversal. This vulnerability is traded as CVE-2017-3188. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in dotCMS Administration Panel up to 3.7.1 (Content Management System). It has been rated as critical. This issue affects an unknown function of the component Push Publishing. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.

The bug was discovered 03/06/2017. The weakness was shared 07/24/2018 as confirmed advisory (CERT.org). The advisory is shared at kb.cert.org. The identification of this vulnerability is CVE-2017-3188 since 12/04/2016. The attack may be initiated remotely. The successful exploitation requires a simple authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 505 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 96616†). The entries VDB-122128 and VDB-122130 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Name

• dotCMS Administration Panel

Version

• 3.7.0
• 3.7.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion