CVE-2018-18830 Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

Critical 9.8 Published 30 Oct 2018 Updated 5 Aug 2024

Unauthenticated attackers can upload malicious JSP files by bypassing filename checks, leading to arbitrary code execution on the server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-18830?

CVE-2018-18830 is a critical vulnerability in n/a, published on 30 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.

Weakness: CWE-434

Which versions are affected by CVE-2018-18830?

2 open source packages ship an affected version, including net.mingsoft:ms-mcms. It affects 1 product.

Package	Affected	Fixed in
`net.mingsoft:ms-mcms` Maven	All versions to `4.6.5`	None
`net.mingsoft:ms-mcms` Maven	All versions to `4.6.5`	None

Products include Mingsoft Mcms.

How do I fix CVE-2018-18830?

No fix has been published for CVE-2018-18830 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-18830 being exploited?

There is no known exploitation of CVE-2018-18830 in the wild and no public exploit code.

Sources

Also known as GHSA-c7c7-xm8g-xm36.