CVE-2017-5344

published 2017-02-17

CVE-2017-5344: An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs…

Priority P2 63 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dotcms	dotcms	<= 3.6.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /categoriesServlet↗

url /categoriesServlet?q=%5c%5c%27↗

url /categoriesServlet?q=%5c%5c%27)+OR%2f%2a%2a%2f(SELECT(SUBSTRING((SELECT(${column})FROM(${database}.user_)LIMIT%2f%2a%2a%2f${index},1),${offset},1)))LIKE+BINARY+${char}%2f%2a%2a%2fORDER+BY+category.sort_order%23↗

path main/java/com/dotmarketing/common/util/SQLUtil.java↗

• → Monitor HTTP requests to /categoriesServlet with q or inode parameters containing URL-encoded backslash-quote sequences (e.g., %5c%5c%27) indicative of SQL injection probing. ↗
• → Detect blind boolean SQL injection payloads in /categoriesServlet requests containing SQL keywords such as SELECT, SUBSTRING, LIKE BINARY, ORDER BY, and comment obfuscation patterns like %2f%2a%2a%2f (/**/) in the q or inode parameters. ↗
• → The exploit targets the dotcms or dotcms2 database schema and specifically queries the user_ table for userid and password_ columns; alert on SQL errors or anomalous query patterns referencing these table/column names. ↗
• → The endpoint /categoriesServlet requires no authentication; any unauthenticated access to this path with non-trivial query parameters should be treated as suspicious in a default dotCMS deployment. ↗

• · The SQLUtil blacklist/escaping controls introduced for CVE-2016-8902 are bypassable for the q and inode parameters of /categoriesServlet; patching to the fixed version is required as WAF-only mitigations may be insufficient. ↗
• · The exploit script is tuned for MySQL backends; the SQL injection vulnerability may also be exploitable against other DBMS backends with adapted payloads. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89