CVE-2020-19138
📋 TL;DR
This vulnerability allows remote attackers to upload malicious files to DotCMS servers, leading to arbitrary code execution. Attackers can exploit this by uploading dangerous file types through the CMSFilter component. All DotCMS installations running version 5.2.3 or earlier are affected.
💻 Affected Systems
- DotCMS
📦 What is this software?
Dotcms by Dotcms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data theft, and persistent backdoor installation.
Likely Case
Webshell deployment leading to data exfiltration, lateral movement, and service disruption.
If Mitigated
File upload attempts blocked at WAF or detected by file integrity monitoring.
🎯 Exploit Status
Exploitation requires only HTTP file upload capability; GitHub issues contain technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.4 and later
Vendor Advisory: https://github.com/dotCMS/core/issues/17796
Restart Required: Yes
Instructions:
1. Backup your DotCMS installation and database. 2. Download DotCMS 5.2.4 or later from official sources. 3. Replace the vulnerable CMSFilter.java component. 4. Restart the DotCMS service. 5. Verify the fix by checking the version.
🔧 Temporary Workarounds
WAF File Upload Filtering
allConfigure web application firewall to block file uploads to vulnerable endpoints.
WAF-specific configuration required
File Upload Restriction
allImplement server-side file type validation and restrict upload directories.
Configure server to reject uploads to /src/main/java/com/dotmarketing/filters/
🧯 If You Can't Patch
- Isolate DotCMS servers from internet and restrict internal access
- Implement strict file integrity monitoring on upload directories
🔍 How to Verify
Check if Vulnerable:
Check DotCMS version via admin interface or by examining the installation directory for version files.Check Version:
Check /dotserver/tomcat-X.X.XX/webapps/ROOT/META-INF/MANIFEST.MF or admin panelVerify Fix Applied:
Verify version is 5.2.4 or later and test file upload functionality with restricted file types.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to CMSFilter endpoints
- Java class file uploads
- POST requests with file uploads to admin paths
Network Indicators:
- HTTP POST requests with file uploads to /src/main/java/com/dotmarketing/filters/
- Unusual outbound connections from DotCMS server
SIEM Query:
source="dotcms" AND (url="*CMSFilter*" OR method="POST") AND (file_upload="true" OR content_type="application/java-archive")