CVE-2021-37770
📋 TL;DR
Nucleus CMS v3.71 has a file upload vulnerability that allows attackers to bypass .htaccess restrictions and upload malicious files disguised as images. Attackers can execute arbitrary PHP code on the server, potentially compromising the entire website. This affects all installations running the vulnerable version.
💻 Affected Systems
- Nucleus CMS
📦 What is this software?
Nucleus Cms by Nucleuscms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, defacement, malware distribution, or use as part of a botnet.
Likely Case
Website defacement, data exfiltration, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper file upload validation and web server hardening are implemented.
🎯 Exploit Status
Exploitation requires authenticated access to upload functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.72 or later
Vendor Advisory: https://github.com/NucleusCMS/NucleusCMS/issues/96
Restart Required: No
Instructions:
1. Backup your database and files. 2. Download the latest version from the official repository. 3. Replace all files except config.php and media folder. 4. Verify functionality.
🔧 Temporary Workarounds
Disable file uploads
allTemporarily disable file upload functionality in Nucleus CMS configuration.
Restrict .htaccess modifications
linuxSet proper permissions on .htaccess files to prevent modification.
chmod 644 .htaccess
chown root:root .htaccess
🧯 If You Can't Patch
- Implement strict file type validation for uploads (allow only specific extensions)
- Configure web server to ignore .htaccess files in upload directories
🔍 How to Verify
Check if Vulnerable:
Check if running Nucleus CMS v3.71 by examining version in admin panel or checking files.Check Version:
Check includes/constants.php for NUCLEUS_VERSION constantVerify Fix Applied:
Verify version is v3.72 or later and test file upload functionality with malicious files.📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload attempts
- Uploads of files with double extensions (.php.jpg)
- Modifications to .htaccess files
Network Indicators:
- Unusual outbound connections from web server
- HTTP requests executing PHP from image directories
SIEM Query:
source="web_logs" AND (uri="*.php.jpg" OR uri="*/upload/*.php")