GitHub Advisoryadvisory · npm

GHSA-v287-9w3v-x5c5 Total.js CMS RCE Vulnerability

CRITICAL Published 2022-05-24 Modified 2023-07-17 Official page ↗
Aliases
CVE-2019-15954
Ecosystem
npm
Packages
total4
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-862
Reviewed
2023-07-17

Affected packages

• npm total4: 12.0.0 (no fix yet)

Description

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: `global.process.mainModule.require(child_process).exec(RCE);`

Related

Alias · CVE (1)

  • CVE-2019-15954 An issue was discovered in Total.js CMS 12.0.0. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-862 Missing Authorization weakness

References