Remote Code Execution in Wolf CMS via FileManagerController

Executive Summary

Wolf CMS through 0.8.3.1 has a remote code execution vulnerability in the FileManagerController. Authenticated attackers with the file_manager_mkfile capability can exploit missing file extension validation in the create_file() and save() functions to create arbitrary PHP files. These files are written to the web-accessible FILES_DIR directory and can be executed by requesting them over HTTP.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the web-accessible FILES_DIR directory of Wolf CMS. Look for files with unexpected names or content that were recently created by users with file_manager_mkfile capability. Review server access logs for suspicious HTTP requests to newly created PHP files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server hosting Wolf CMS. This could lead to full system compromise, data theft, unauthorized access, or further attacks within the network. Attackers need authentication but can leverage this to gain deeper control over the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this issue.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wolf CMS to a version that fixes the missing file extension validation in FileManagerController. Temporarily restrict the file_manager_mkfile capability to trusted users only. Monitor FILES_DIR for unauthorized PHP files and remove any suspicious files immediately.

Useful 0 Not Useful 0