Headline

CVE-2022-35740: Matrix URI parameters can expose private assets

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS’s path-based XSS prevention (such as “require login” filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.

2 years ago

CVE

Open in Source

#xss #vulnerability #js #git #java

Issues » Matrix URI parameters can expose private assets

Issue:

SI-63

Date:

Jun 14, 2022, 1:45:00 PM

Severity:

Moderate

Requires Admin Access:

Fix Version:

22.06, 22.03.2, 21.06.9, 5.3.8.12

Credit:

Fortinet (https://www.fortinet.com/)

Description:

Some Java Application frameworks, including those used by Spring or Tomcat, allow the use of “matrix parameters” — URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS’s path-based XSS prevention/require login filters and access restricted resources.

For example, the semicolon in the URL below would reveal to anyone a text file ordinarily only visible to signed-in users:
https://demo.dotcms.com/html;/js/dojo/README-Building-dojo-for-dotCMS.txt

The ability to circumvent these filters can be chained with other code to expolit dotCMS using XSS attacks.

Mitigation:

Upgrade

dotCMS recommends upgrading to one of the versions of dotCMS patched against this vulnerability, which include the following, as well as subsequent versions:

Agile:
22.06+
LTS:
22.03.2+
21.06.9+
5.3.8.12+

WAF Rule

It is possible to create a WAF rule that disallows ; (semi-colons) specifically in the the URI portion of a request URL. This would effectivily block any exploit of the vunerability.

Hotfix Plugin****dotCMS 5.1.6+

The following OSGi plugin, designed to work with versions dotCMS 5.1.6 and later, can be used to mitigate the issue in running dotCMS instances: