dotCMS File Upload RCE (CVE-2022-26352)

What is dotCMS?

dotCMS is designed to deliver content-driven applications at scale. Whether you're building a network of global websites, an employee intranet, a customer portal, or a single-page web application, dotCMS helps you manage content, images, and assets in one centralized location and deliver them to any channel.

Reference: https://www.dotcms.com/

What is CVE-2022-26352?

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-26352 

Lab Environment

In this lab environment, the user is going to get access to a Kali GUI instance. A dotCMS instance vulnerable to RCE, identified by CVE-2022-26352, is running on the target server. It can be accessed using the tools installed on Kali at http://demo.ine.local:8080/dotAdmin  

Your task is to fingerprint the dotCMS service using the tools available on the Kali machine. Then, exploit it using the appropriate Metasploit exploit module.

Objective: Exploit the dotCMS application using the Metasploit framework and find the flag.

Instructions:

• Your Kali machine has an interface with IP address 10.10.X.Y. Run “ip addr” to know the values of X and Y.
  
• The IP address of the target machine is mentioned in the file “/root/Desktop/target”
• Do not attack the gateway located at IP address 192.V.W.1 and 10.10.X.1