CVE-2020-21474
📋 TL;DR
CVE-2020-21474 is a critical file upload vulnerability in NucleusCMS v3.71 that allows remote attackers to upload malicious files and execute arbitrary code on the server. This affects all installations running the vulnerable version of this content management system.
💻 Affected Systems
- NucleusCMS
📦 What is this software?
Nucleuscms by Nucleuscms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or use as a foothold for lateral movement within the network.
Likely Case
Webshell installation allowing persistent backdoor access, data exfiltration, and further exploitation of the server.
If Mitigated
Limited impact if file uploads are disabled or proper file type validation is implemented at the web application firewall level.
🎯 Exploit Status
Exploitation requires direct access to the vulnerable endpoint with no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.72 or later
Vendor Advisory: https://github.com/NucleusCMS/NucleusCMS/issues/95
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download the latest version from the official repository. 3. Replace all files except configuration and upload directories. 4. Verify the fix by checking the version number.
🔧 Temporary Workarounds
Block vulnerable endpoint
allAdd web server rules to block access to the vulnerable plugin directory
# Apache: RewriteRule ^/nucleus/plugins/skinfiles/ - [F,L]
# Nginx: location ~ ^/nucleus/plugins/skinfiles/ { deny all; }
Disable file uploads
allModify CMS configuration to disable file upload functionality
# Edit nucleus/config.php and set $CONF['AllowUpload'] = 0;
🧯 If You Can't Patch
- Implement strict file upload validation at the web application firewall level
- Restrict network access to the CMS administration interface
🔍 How to Verify
Check if Vulnerable:
Check if accessing /nucleus/plugins/skinfiles/?dir=rsd returns a file upload interface without authenticationCheck Version:
Check the VERSION file in the nucleus directory or view the admin dashboardVerify Fix Applied:
Verify the version is 3.72+ and the vulnerable endpoint no longer allows arbitrary file uploads📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /nucleus/plugins/skinfiles/ with file uploads
- Unusual file creation in web-accessible directories
Network Indicators:
- POST requests to the vulnerable endpoint with executable file extensions
- Outbound connections from the web server to unknown IPs
SIEM Query:
source="web_server" AND (uri="/nucleus/plugins/skinfiles/" OR uri="/nucleus/plugins/skinfiles/?dir=rsd")