Multiple vulnerabilities in October CMS

Published: 2020-11-22

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-15246 CVE-2020-15249
CWE-ID	CWE-98 CWE-79
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	October CMS Web applications / CMS
Vendor	OctoberCMS

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) PHP file inclusion

EUVDB-ID: #VU48588

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15246

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

Exploit availability: No

Description

The vulnerability allows a remote attacker to include and execute arbitrary PHP files on the server.

The vulnerability exists due to incorrect input validation when including PHP files. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected application and include arbitrary local PHP files from the server.

Successful exploitation of the vulnerability may result in system and application compromise.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

October CMS: 1.0.421 - 1.0.468

External links

http://github.com/octobercms/october/security/advisories/GHSA-xwjr-6fj7-fc6h/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stored cross-site scripting

EUVDB-ID: #VU48589

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15249

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to the application allows uploading of SVG files. A remote user can upload an SVG file with HTML code inside and execute it in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.