CVE-2019-15954 Total.js CMS RCE Vulnerability
Authenticated users with widget privileges can execute arbitrary code on the server by injecting JavaScript into widget tags, bypassing sandbox restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15954?
CVE-2019-15954 is a critical code injection vulnerability in n/a, published on 5 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
Weakness: CWE-862
Which versions are affected by CVE-2019-15954?
2 open source packages ship an affected version, including total4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
total4 npm | All versions | None |
total4 npm | All versions | None |
Products include Totaljs Total.js Cms.
How do I fix CVE-2019-15954?
No fix has been published for CVE-2019-15954 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-15954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-15954 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v287-9w3v-x5c5.