CVE-2017-15012

published 2017-10-13

CVE-2017-15012: OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUT_FILE RPC-command, which…

Priority P2 63 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUT_FILE RPC-command, which allows any authenticated user to hijack an arbitrary file from the Content Server filesystem; because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
opentext	documentum_content_server	<= 7.3	—

Detection & IOCs extracted from sources · hover to see the quote

command PUT_FILE RPC-command with remote_path = "common=/../../../../../../../../../..%s=Directory"↗

path /config/dfc.keystore↗

path /u01/documentum/cs/product/7.2/bin/dm_set_server_env.sh↗

path /u01/documentum/cs/shared/config/dfc.keystore↗

filename dm_set_server_env.sh↗

filename dfc.keystore↗

port 10001↗

• → Detect path traversal in PUT_FILE RPC commands: look for the pattern 'common=/../' or sequences of '/../' in Documentum RPC traffic targeting the PUT_FILE command, which is the core exploit primitive. ↗
• → Monitor Documentum Content Server for PUT_FILE RPC calls that reference filesystem paths outside the docbase storage area, especially paths containing 'dfc.keystore' or shell scripts such as 'dm_set_server_env.sh'. ↗
• → Detect privilege escalation indicator: a session reconnecting as the 'r_install_owner' account using a trusted Identity with a keystore obtained via PUT_FILE path traversal. ↗
• → Monitor for DQL queries of the form 'SELECT FOR READ r_object_id FROM dm_sysobject WHERE r_content_size>0' immediately preceding a PUT_FILE call — the exploit uses this to obtain a valid object ID to attach hijacked content to. ↗
• → Flag use of the CIPHERS string 'ALL:aNULL:!eNULL' in TLS negotiation against Documentum port 10001, which is used by the exploit as a fallback cipher suite for the secure connection path. ↗

• · The exploit targets the default Documentum Content Server RPC port 10001; installations using non-default ports will not be detected by port-based signatures alone. ↗
• · The keystore path is dynamically derived from the DOCUMENTUM_SHARED environment variable read out of dm_set_server_env.sh; the hardcoded example path '/u01/documentum/cs/shared/config/dfc.keystore' may differ across installations. ↗
• · The exploit requires an already-authenticated Documentum session (any valid user); it does not exploit unauthenticated access, so network-layer blocking alone is insufficient if internal users are considered a threat. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20