CVE-2021-46384
📋 TL;DR
MCMS versions up to 5.2.5 contain a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands on the server. This affects all systems running vulnerable MCMS versions with network access to the application. Successful exploitation can lead to complete system compromise.
💻 Affected Systems
- MCMS (MingSoft Content Management System)
📦 What is this software?
Mcms by Mingsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing attacker to install malware, exfiltrate data, pivot to other systems, or deploy ransomware.
Likely Case
Initial foothold leading to web shell installation, credential theft, and lateral movement within the network.
If Mitigated
Attack blocked at network perimeter or application firewall; no impact if proper segmentation and access controls are in place.
🎯 Exploit Status
Exploit uses FreeMarker template injection with payload: ${'freemarker.template.utility.Execute'?new()('calc')}
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 5.2.5
Vendor Advisory: https://gitee.com/mingSoft/MCMS/issues/I4QZ1O
Restart Required: Yes
Instructions:
1. Backup current installation and data. 2. Download latest MCMS version from official repository. 3. Replace vulnerable files with patched version. 4. Restart web application server. 5. Verify functionality.
🔧 Temporary Workarounds
WAF Rule Implementation
allBlock FreeMarker template injection patterns at web application firewall
Add WAF rule to block requests containing: ${'freemarker.template.utility.Execute'?new()
Block patterns: ?new() and Execute in FreeMarker context
Network Access Restriction
linuxRestrict access to MCMS administration interfaces
iptables -A INPUT -p tcp --dport [MCMS_PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [MCMS_PORT] -j DROP
🧯 If You Can't Patch
- Isolate MCMS system in separate network segment with strict firewall rules
- Implement application-level input validation to filter FreeMarker template expressions
🔍 How to Verify
Check if Vulnerable:
Check MCMS version in admin panel or by examining version files; if version <= 5.2.5, system is vulnerable.Check Version:
Check /WEB-INF/classes/version.properties or admin interface for version numberVerify Fix Applied:
Confirm version is > 5.2.5 and test with safe payload: ${7*7} should not execute as 49.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing FreeMarker template injection patterns
- Unusual process execution from web server user
- Multiple failed exploit attempts
Network Indicators:
- HTTP POST requests with FreeMarker payloads to MCMS endpoints
- Outbound connections from web server to unknown IPs
SIEM Query:
source='web_logs' AND (uri CONTAINS 'freemarker.template.utility.Execute' OR uri CONTAINS '?new()')