CVE-2020-18646
📋 TL;DR
CVE-2020-18646 is an information disclosure vulnerability in NoneCMS v1.3 that allows remote attackers to access sensitive information through the /public/index.php component. This affects all users running the vulnerable version of NoneCMS, potentially exposing configuration details, database credentials, or other sensitive data.
💻 Affected Systems
- NoneCMS
📦 What is this software?
Nonecms by 5none
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain database credentials, configuration files, or sensitive user data leading to complete system compromise or data breach.
Likely Case
Attackers access configuration files revealing system paths, database settings, or other sensitive information that could facilitate further attacks.
If Mitigated
With proper access controls and network segmentation, impact is limited to information disclosure without direct system compromise.
🎯 Exploit Status
Simple HTTP request to vulnerable endpoint can trigger information disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.3.1 or later
Vendor Advisory: https://github.com/nangge/noneCms
Restart Required: No
Instructions:
1. Backup current installation. 2. Download latest version from official repository. 3. Replace vulnerable files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Restrict access to /public/index.php
allConfigure web server to block or restrict access to the vulnerable endpoint
# Apache: Add to .htaccess
<Files "index.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ ^/public/index\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the NoneCMS instance
- Deploy a web application firewall (WAF) with rules to block requests to /public/index.php
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[target]/public/index.php and check if sensitive information is returnedCheck Version:
Check NoneCMS version in admin panel or read version file if availableVerify Fix Applied:
Verify the same request now returns appropriate error or no sensitive data📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /public/index.php from single IP
- Unusual file access patterns in web server logs
Network Indicators:
- HTTP GET requests to /public/index.php with unusual parameters
- Traffic spikes to specific endpoint
SIEM Query:
source="web_server" AND uri="/public/index.php" AND status=200