Dotcms SI-62 任意文件上传 (CVE-2022-26352)

小黑黑 911天前

作者：h1ei1@白帽汇安全研究院

漏洞简介

Dotcms dotCMS是美国dotCMS（Dotcms）公司的一套内容管理系统（CMS）。该系统支持RSS订阅、博客、论坛等模块，并具有易于扩展和构建的特点。DotCMS对上传的文件名过滤不严格导致目录穿越，攻击者可以将一个特殊的.jsp 文件上传到dotCMS 的webapp/ROOT 目录，从而允许远程执行代码。

环境搭建

参考官网docker-compose.yml案例：https://www.dotcms.com/run/demo 和远程调试设置 https://www.dotcms.com/docs/latest/docker-image-configuration-options，如下(采用22.02版本以及远程调试端口8000)

version: '3.5'

networks:
  db_net:
  es_net:

volumes:
  cms-shared:
  dbdata:
  esdata:

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.9.1
    environment:
      - cluster.name=elastic-cluster
      - discovery.type=single-node
      - data
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xmx1G "
    ports:
      - 9200:9200
      - 9600:9600
    volumes:
      - esdata
    networks:
      - es_net

  dotcms:
    image: dotcms/dotcms:22.02
    environment:
        "CATALINA_OPTS": '-Xmx1g '
        "DB_ba se_URL": "jdbc:postgresql://db/dotcms"
        "DB_USERNAME": 'dotcmsdbuser'
        "DB_PASSWORD": 'password'
        "DOT_ES_AUTH_BASIC_PASSWORD": 'admin'
        "DOT_ES_ENDPOINTS": 'http://elasticsearch:9200'
        "DOT_INITIAL_ADMIN_PASSWORD": 'admin'
        #"CUSTOM_STARTER_URL": 'https://repo.dotcms.com/artifactory/libs-release-local/com/dotcms/starter/20211201/starter-20211201.zip'
        "CMS_JAVA_OPTS": ' -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:8000'
    depends_on:
      - elasticsearch
      - db
    volumes:
      - cms-shared
      #- {license_local_path}/license.zip:/data/shared/assets/license.zip
    networks:
      - db_net
      - es_net
    ports:
      - "8080:8080"
      - "8443:8443"
      - "8000:8000"

  db:
    image: postgres:13
    command: postgres -c 'max_connections=400' -c 'shared_buffers=128MB'
    environment:
        "POSTGRES_USER": 'dotcmsdbuser'
        "POSTGRES_PASSWORD": 'password'
        "POSTGRES_DB": 'dotcms'
    volumes:
      - dbdata
    networks:
      - db_net