Vulnerabilities > CVE-2019-15954 - Missing Authorization vulnerability in Totaljs Total.Js CMS 12.0.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Exploit-Db
| id | EDB-ID:47531 |
| last seen | 2019-10-22 |
| modified | 2019-10-22 |
| published | 2019-10-22 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/47531 |
| title | Total.js CMS 12 - Widget JavaScript Code Injection (Metasploit) |
Metasploit
| description | This module exploits a vulnerability in Total.js CMS. The issue is that a user with admin permission can embed a malicious JavaScript payload in a widget, which is evaluated server side, and gain remote code execution. |
| id | MSF:EXPLOIT/MULTI/HTTP/TOTALJS_CMS_WIDGET_EXEC |
| last seen | 2020-06-12 |
| modified | 2019-10-15 |
| published | 2019-10-15 |
| references | |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/totaljs_cms_widget_exec.rb |
| title | Total.js CMS 12 Widget JavaScript Code Injection |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/154924/totaljs_cms_widget_exec.rb.txt |
| id | PACKETSTORM:154924 |
| last seen | 2019-10-22 |
| published | 2019-10-21 |
| reporter | sinn3r |
| source | https://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html |
| title | Total.js CMS 12 Widget JavaScript Code Injection |
References
- http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html
- http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html
- https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
- https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
- https://seclists.org/fulldisclosure/2019/Sep/5
- https://seclists.org/fulldisclosure/2019/Sep/5