Multiple Vulnerabilities in WonderCMS

Project Description

WonderCMS suffers from multiple vulnerabilities including persistent cross site scripting, arbitrary file upload, and directory traversal. The file upload functionality of WonderCMS allows authenticated users to upload whitelisted file types but it doesn’t sanitize the file name which leads to persistent cross site scripting. Additionally, arbitrary files such as web shells can be uploaded to the server due to the insufficient file upload validation which leads to a full system compromise. Furthermore, an authenticated attacker can also delete arbitrary files via directory traversal with the access rights of the web server.


Vendor description

“WonderCMS is a free simple website builder. Aimed to be extremely easy to install (1 step), light and simple to use.It’s an open source flat file CMS (Content Management System), built with PHP and developed since 2008.”

Source: https://www.wondercms.com/

Business recommendation

Update 2020/07/21: After announcing the publication of the advisory on Twitter, the vendor did respond immediately and released a patch.

An in-depth security analysis performed by security professionals is highly advised, as the software may be affected from further security issues.

Vulnerability overview/description

1. Stored Cross Site Scripting via Filename (Authenticated user)

This vulnerability allows an authenticated user (admin) to upload files with a malicious client side script as filename. It will be executed in the browser of a user if he visits the manipulated URL.

2. Directory Traversal (Authenticated user)

This vulnerability allows an authenticated user (admin) to delete arbitrary files via directory traversal on the operating system with the access rights of the web server.

3. Upload of arbitrary files (Authenticated user)

It was identified that an authenticated user (admin) can bypass file type checks and upload malicious files. In this specific case, arbitrary server side PHP code such as web shells can be uploaded. As a result the attacker can run arbitrary code on the server side with the privileges of the web server. This could lead to a full system compromise.

Proof of concept

1. Stored Cross Site Scripting via Filename (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

2. Directory Traversal (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

3. Upload of arbitrary files (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

Vulnerable / tested versions

WonderCMS version 3.0.7 has been tested, which was the latest version available at the time of the test. Previous versions may also be affected. On 18-05-2020, the vendor released a newer version 3.1.0. However, the latest version are still vulnerable to the above vulnerabilities.

Update: The vendor released a patch, please update to version 3.1.1. to fix mentioned vulnerabilities.

Vendor contact timeline

2020-05-06Contacting vendor through report@wondercms.com; no response.
2020-05-13Follow-up with vendor; no response.
2020-05-21Follow-up with vendor; no response.
2020-06-02Follow-up with vendor; no response.
2020-06-19Follow-up with vendor; no response.
2020-06-19Follow-up with vendor; no response.
2020-06-30Tested the vulnerabilities in the latest version (3.1.0) that is available on vendor’s webpage, still affected.
2020-07-17Public release of security advisory.
2020-07-17Vendor responded to our Twitter announcement.
2020-07-21Vendor provides a patch.
2020-07-21Update of security advisory.

Solution

The vendor provides a patch:

https://www.wondercms.com/whatsnew

https://github.com/robiso/wondercms/releases/tag/3.1.1

Workaround

No workaround available.

Advisory URL

https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html

EOF C. Phang / @2020

Interested to work with the experts of SEC Consult? Send us your application
Want to improve your own cyber security with the experts of SEC Consult? Contact our local offices.

Project Details

  • TitleMultiple Vulnerabilities
  • ProductWonderCMS
  • Vulnerable version<=3.1.0
  • Fixed version3.1.1
  • ImpactHigh
  • Homepagehttps://www.wondercms.com/
  • Found2020-04-30
  • ByCalvin Phang (Office Singapore) | SEC Consult Vulnerability Lab