dotCMS template permissions allow arbitrary code execution

Overview

The dotCMS content management system version 1.9 and possibly earlier versions, contains a vulnerability that allows users with the appropriate permissions to create a malicious template with arbitrary code.

Description

An authenticated dotCMS user with the permissions required to author and upload templates may create a malicious XSLT or Velocity template that can execute arbitrary java code. The arbitrary java code will run with the permissions of the web service account.

---

Impact

An authenticated attacker with the permissions to create a template may upload a malicious XSLT or Velocity template that can run arbitrary java code. In some cases, the attacker may be able to exploit this vulnerability to obtain a shell on the web server.

---

Solution

Apply an Update

dotCMS version 1.9.5.1 or 2.0.1 and later address these vulnerabilities. If you are unable to upgrade please consider the following workarounds.

---

Workarounds

Unmap the XSLT Tool in the toolbox.xml file or apply this XSLT Tool which is backported from 2.0 to 1.9

Add to system.properties the property: runtime.introspector.uberspect = org.apache.velocity.util.introspection.SecureUberspector

---

Vendor Information

898083

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

dotCMS Affected

Notified: April 13, 2012 Updated: May 01, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	8.5	AV:N/AC:M/Au:S/C:C/I:C/A:C
Temporal	6.9	E:POC/RL:U/RC:UC
Environmental	6.9	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

• <http://dotcms.com/&gt;
• <https://github.com/dotCMS/dotCMS/issues/261&gt;
• <https://github.com/dotCMS/dotCMS/issues/281&gt;
• <https://velocity.apache.org/engine/devel/apidocs/org/apache/velocity/util/introspection/SecureUberspector.html&gt;
• <https://gist.github.com/2627440&gt;

Acknowledgements

Thanks to Ben Murphy for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2012-1826
Date Public:	2012-05-25 Date First Published: