{"id":6283,"date":"2017-01-23T14:08:24","date_gmt":"2017-01-23T22:08:24","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-134\/"},"modified":"2017-01-23T14:08:24","modified_gmt":"2017-01-23T22:08:24","slug":"news-134","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-134\/","title":{"rendered":"SSD Advisory \u2013 dotCMS H2 Database Remote Code Execution"},"content":{"rendered":"
\n

Vulnerabilities Summary<\/strong>
The following advisory describes an SQL Injection in dotCMS 3.6.0 H2 Database that allows attackers to Remote Code Execution.<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

Vendor response<\/strong>
We contacted the vendor back in December 2016 and they responded with:
“H2 is not a production DB for us. It is just for testing and trying out dotCMS. We do not support it in production or on public servers<\/em>”<\/p>\n

Please note that since this vulnerability will not be fixed, default installations of dotCMS that don’t switch from H2 to some other database are vulnerable. In addition, the only warning found on the web site of dotCMS related to H2 is:
“Important: H2DB should NOT be used for a production in environment.<\/strong>”<\/p>\n

Which doesn’t explain the lack of security due to dotCMS using an H2 database.<\/p>\n

<\/span><\/p>\n

Vulnerability Details<\/strong>
dotCMS offers a Tomcat server with a preconfigured dotCms installation, the Tomcat server listens by default on public port 8080 (tcp\/http) for incoming requests to the web panel.<\/p>\n

Using an unauthenticated connection it is possible to visit the the’CategoriesServlet<\/em>‘ servlet. The getCreateSortChildren()<\/em> function of the ‘H2CategorySQL<\/em>‘ class suffers of an SQL injection vulnerability into the ‘inode<\/em>‘ parameter of a GET request, when the ‘reorder<\/em>‘ parameter is set to ‘TRUE<\/em>‘. <\/p>\n

H2 allows stacked queries to be performed. In addition, the underlying H2 database offers the ‘SCRIPT TO <\/filename><\/em>‘ construct. Through this it is possible to store arbitrary Java code into a newly created .jsp script.<\/p>\n

A remote attacker, could then create an arbitrary script into an accessible web path and execute arbitrary code\/commands against the target server.<\/p>\n

Vulnerable code<\/u>
The vulnerable code can be found in:<\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n