CVE-2021-46386: Mingsoft MCMS Remote Code Execution via File Upload
Summary
CVE-2021-46386: Mingsoft MCMS vulnerable to Remote Code Execution via file upload. Affects net.mingsoft:ms-mcms versions < 5.2.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mingsoft MCMS is a Java CMS (Content Management System) that allows users to create and manage websites. It is built using the Maven ecosystem and is identified by the package name 'net.mingsoft:ms-mcms'. This CMS provides various features and functionalities for website development and content management. However, versions prior to and including 5.2.5 of Mingsoft MCMS are vulnerable to a critical remote code execution vulnerability through a file upload mechanism.
Vulnerability Detail
The vulnerability in Mingsoft MCMS arises from a file upload flaw in the 'net.mingsoft.basic.action.web.FileAction#upload' function. Attackers can exploit this vulnerability by uploading a malicious jspx webshell, which can then be executed remotely. This allows the attacker to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system. It is important to note that it is unclear if this vulnerability has been patched in the latest version of Mingsoft MCMS.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the file upload functionality in Mingsoft MCMS until a patch is available. This can be done by modifying the configuration or access control settings to prevent unauthorized file uploads. However, this workaround may limit certain functionalities of the CMS, so it is advised to apply the official patch as soon as it becomes available.
Conclusion
Mingsoft MCMS versions prior to and including 5.2.5 are vulnerable to remote code execution through a file upload vulnerability. It is crucial for users of Mingsoft MCMS to update to a patched version as soon as it becomes available. Regularly checking for updates and applying them promptly is essential to ensure the security and integrity of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.mingsoft:ms-mcms →
FAQ
Mingsoft MCMS is a Java-based Content Management System (CMS) used for website development and content management.
This vulnerability allows remote attackers to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, it is recommended to update Mingsoft MCMS to a version that includes the necessary security patches.
As a temporary workaround, users can disable the file upload functionality in Mingsoft MCMS until a patch is available.
It is unclear if this vulnerability has been patched in the latest version of Mingsoft MCMS. Users should regularly check for updates and apply them promptly.
Related vulnerabilities
Recent vulnerabilities recorded for net.mingsoft:ms-mcms.
