https://blog.munz4u.de/ Recent content on Marc-Oliver Munz Hugo en-us <a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a> Wed, 15 Nov 2023 14:12:02 +0100 https://blog.munz4u.de/posts/2023/11/cve-2024-24230-rce-via-ssti-in-komm.one-cms-10.4.2.14/ Wed, 15 Nov 2023 14:12:02 +0100 https://blog.munz4u.de/posts/2023/11/cve-2024-24230-rce-via-ssti-in-komm.one-cms-10.4.2.14/ <h2 id="tldr">TL;DR<a class="heading-anchor" href="#tldr" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>I uncovered a critical Remote Code Execution vulnerability in Komm.One&rsquo;s Content Management System version <code>10.4.2.14</code>. Initially, I identified a Server-Side Template Injection (SSTI) flaw in the Velocity template engine, leading to the execution of arbitrary code and affecting several hundred sites. It is noteworthy that all vulnerable instances have now been fixed.</p> <h2 id="initial-finding">Initial Finding<a class="heading-anchor" href="#initial-finding" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>While examining a website, I discovered that the SSTI payload below is echoed processed in the response:</p> https://blog.munz4u.de/posts/2023/03/cve-2023-25295-ato-via-rxss-in-evewa3-community/ Wed, 08 Mar 2023 12:00:00 +0100 https://blog.munz4u.de/posts/2023/03/cve-2023-25295-ato-via-rxss-in-evewa3-community/ <h2 id="tldr">TL;DR<a class="heading-anchor" href="#tldr" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>The GRÜN eVEWA Community versions 31 to 53 were susceptible to a reflected Cross-Site Scripting (rXSS) vulnerability in the login form. This vulnerability enables attackers to acquire escalated privileges by submitting a crafted request to the login panel. To address this issue, a security patch labeled &ldquo;H1&rdquo; has been applied across versions 31 to 53.</p> <h2 id="initial-findings">Initial Findings<a class="heading-anchor" href="#initial-findings" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>During my investigation of a domain, I stumbled upon a GRÜN eVEWA site. During my examination of the endpoints, I identified vulnerable rXSS file parameters in the following locations:</p> https://blog.munz4u.de/datenschutz/ Mon, 01 Jan 0001 00:00:00 +0000 https://blog.munz4u.de/datenschutz/ <div class="lang-block" data-lang="de" lang="de"> <p>Diese Website ist eine statische Seite, die mit dem Generator Hugo erstellt wird. Sie verwendet <strong>keine Cookies</strong>, <strong>kein Tracking</strong>, <strong>keine Analyse- oder Werbedienste</strong> und bindet keine externen Inhalte (z. B. Schriftarten, Videos) nach, die beim Aufruf automatisch Daten an Dritte übertragen. Personenbezogene Daten werden durch den Betreiber nicht aktiv erhoben.</p> <h2 id="verantwortlicher">Verantwortlicher<a class="heading-anchor" href="#verantwortlicher" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>Marc-Oliver Munz<br> Muselgasse 1<br> 72639 Neuffen<br> Deutschland</p> <p>E-Mail: <a class="email-link" href="#" rel="nofollow" data-e="c2VjdXJpdHlAbXVuejR1LmRl">security [at] munz4u [dot] de</a></p> https://blog.munz4u.de/impressum/ Mon, 01 Jan 0001 00:00:00 +0000 https://blog.munz4u.de/impressum/ <div class="lang-block" data-lang="de" lang="de"> <p>Angaben gemäß § 5 DDG (Digitale-Dienste-Gesetz).</p> <h2 id="diensteanbieter">Diensteanbieter<a class="heading-anchor" href="#diensteanbieter" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>Marc-Oliver Munz<br> Muselgasse 1<br> 72639 Neuffen<br> Deutschland</p> <h2 id="kontakt">Kontakt<a class="heading-anchor" href="#kontakt" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>E-Mail: <a class="email-link" href="#" rel="nofollow" data-e="c2VjdXJpdHlAbXVuejR1LmRl">security [at] munz4u [dot] de</a></p> <h2 id="umsatzsteuer-identifikationsnummer">Umsatzsteuer-Identifikationsnummer<a class="heading-anchor" href="#umsatzsteuer-identifikationsnummer" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>Umsatzsteuer-Identifikationsnummer gemäß § 27a Umsatzsteuergesetz: <span class="obf" data-o="REUzNjQzOTQyOTI=">DE 364 394 292</span></p> <h2 id="verantwortlich-für-den-inhalt-nach--18-abs-2-mstv">Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV<a class="heading-anchor" href="#verantwortlich-f%c3%bcr-den-inhalt-nach--18-abs-2-mstv" aria-label="Copy link to this section" title="Copy link to this section">#</a></h2> <p>Marc-Oliver Munz<br> Muselgasse 1<br> 72639 Neuffen<br> Deutschland</p>