CVE-2022-26352
Published: 17 July 2022
Summary
CVE-2022-26352 is a critical-severity an unspecified weakness vulnerability in Dotcms Dotcms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Deeper analysis
The vulnerability is an unsanitized filename flaw in the ContentResource API of dotCMS versions 3.0 through 22.02. A crafted multipart form POST can cause the uploaded file to be written outside the intended directory via path traversal. When anonymous content creation is enabled, this affects the core content-handling component and can result in arbitrary file placement on the server.
An unauthenticated remote attacker can exploit the issue over the network without credentials or user interaction to upload executable files such as .jsp payloads. Successful exploitation grants full remote code execution with the privileges of the dotCMS process, corresponding to the observed CVSS 9.8 rating.
Public references include exploit code on Packet Storm and an entry in the CISA Known Exploited Vulnerabilities catalog, confirming that the flaw has been leveraged in the wild. The associated EPSS score has remained at a high level, reaching a peak of 0.9753 with a current value of 0.9431.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30911
Vulnerability details
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved…
more
outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
- CWE(s)
- KEV Date Added
- 25 August 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all input fields including filenames in multipart uploads to block path traversal.
Explicitly limits the actions (such as content creation and file upload) permitted for unauthenticated users, eliminating the anonymous RCE vector.
Enforces least-privilege restrictions so that even enabled anonymous upload paths cannot write executables outside approved directories.