| 标题 | ChestnutCMS V1.5.4 Command Injection |
|---|
| 描述 | Vulnerability description
ChestnutCMS V1.5.4 has two background command execution vulnerabilities, both of which require administrator permissions to trigger.
The first vulnerability is in the Groovy script execution feature, which dynamically compiles and executes user-supplied Groovy scripts via the GroovyClassLoader, resulting in arbitrary code execution.
The second vulnerability is in the template resolution function, which can lead to remote code execution by concatenating the user's controllable template path, combined with the file upload function.
Code audit procedure
The first vulnerability: Groovy script execution
Code location: execGroovyScript method
Vulnerability analysis:
This method dynamically compiles and executes user-supplied Groovy scripts through a GroovyClassLoader.
A BaseGroovyScript instance directly calls the run method, resulting in arbitrary code execution.
Vulnerability trigger conditions:
Requires administrator rights.
Send Groovy script content via POST request.
The second vulnerability: template parsing
Code location: getSsIVirtualContent method
Vulnerability analysis:
By concatenating user-controllable template paths, combined with file upload capabilities, remote code execution may occur.
During template parsing, you enter Freemarker template parsing directly, resulting in arbitrary file reading or code execution.
Vulnerability trigger conditions:
Requires administrator rights.
Template resolution is triggered by a GET request.
POC
Vulnerability 1
Login Background - System Tools - GroovyScript
class TestGroovyScript extends com.chestnut.system.groovy.BaseGroowyScript {
void run(PrintWriter out) {
out.println(new Scanner(Runtime.getRuntime ().exec("whoami").getInputStream()). useDelimiter("\\A"). next())
}
}
Vulnerability 2
Login Background - Content Management - Template Management
$_{"freemarker.template.utility.Execute"? new()("whoami")}
To access the template file:
http(s)://target-ip/cms/ssi/virtual/? sid={sid}&pp=pc&t={template file name}
|
|---|
| 来源 | ⚠️ https://wiki.shikangsi.com/post/share/079359db-a913-44b5-89f6-46ac3b243bac |
|---|
| 用户 | XingYue_Mstir (UID 72225) |
|---|
| 提交 | 2025-04-03 04時38分 (2 年前) |
|---|
| 管理 | 2025-04-14 01時33分 (11 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 294545 [ChestnutCMS 直到 1.5.0 Create Template 权限提升] |
|---|
| 积分 | 0 |
|---|