-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Total.js CMS Code Injection in Widget Creation #12365
Conversation
I have updated the code. Please let me know if there's anything else I need to change. Thanks! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you!
Release NotesThis adds an exploit against the Total.js CMS framework, written in Node.js. An attacker with administrator credentials may create a new widget containing arbitrary JavaScript code that is evaluated server-side. |
Description
Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things (IoT), etc. Total.js CMS is a Content Management System (application) that is part of the Total.js framework. A commercial version is also available, and can be seen used world-wide.
In Total.js CMS, a user with admin permission may be able to create a widget, and extend CMS functionalities for visitors. However, this can also be abused to upload JavaScript code that will be evaluated server side. As a result, it is possible to embed malicious JavaScript in the new widget, and gain remote code execution.
Vulnerable Setup
First, please install node. You can do this easily with brew, for example:
And then download the following. There is a start.sh, just run that to start the server (will be port 8000):
cms.zip
Verification
set rhosts [ip]
set srvhost [ip]
set target [id]
(0 = Linux, 1 = Mac)set payload [payload name]
run
Demo
Check
Exploit