File Upload

[Pd1r]

Describe the bug

Upload jsp files to control the target server

Steps to reproduce the behavior:

1. uri.startsWith () determines whether uri starts with / asset

2. Can bypass restricted access to files under assets, like
   /asdasd/../asset

3. Upload malicious JSP file here

4. Get file id
   

5. Execute arbitrary server commands
   

6. Can upload even without authorization
   

dir like this

[wezell]

@Pd1r Questions on this:

1. What app server is this running? Tomcat or something else? Is it behind any proxy or using any special connectors?
2. What OS is the server running? Is it containerized? If so, what is the base os. If Linux, what distro?

I am trying to reproduce this and I cannot:

curl -XPOST http://localhost:8080/234aa/../assets/messages/cms_language_en.properties

gives me a 403

When I step through and debug the code, the uri variable at this line
https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotmarketing/filters/CMSFilter.java#L87
has been made absolute, stripped of any relative pathing, e.g.

[Pd1r]

server : tomcat 8.5.32
os : 10.14.6
Tool : Can't use curl, need Burpsuite
Unreachable when I use localhost, It is possible to use the IP assigned by the router .

I downloaded from here

[wezell]

@Pd1r thank you for the report and details, I can confirm this. We are working on a fix.

[jgambarios]

PR: #17809

[bryanboza]

Fixed, tested on release-5.2.4 // Postgres // FF

[cfi-gb]

I am trying to reproduce this and I cannot:

curl -XPOST http://localhost:8080/234aa/../assets/messages/cms_language_en.properties

Note that you need to pass the --path-as-is parameter for directory traversals in such curk calls:

--path-as-is Do not squash .. sequences in URL path