The version of Ektron CMS is vulnerable to multiple security vulnerabilities, such as
Unauthenticated code execution and Local File Read.
1. CVE-5357 - Unauthenticated code execution in the context of web server
The root cause of this is that Ektron processed user-controlled XSL from a page that required no auth. They used the XslCompiledTransform class with enablescript set to true. This scripting allows the user to execute code.
2. CVE-5358 Local File Read
Ektron had configured the xsl with enableDocumentFunction set to true. This vulnerability allows an unauthenticated attacker to read arbitrary files, such as web.config and machine.config. This would allow an attacker to perform several attacks, like bypassing authentication, modifying viewstate, bringing down the server, etc.
- Upgrade to latest version of Ektron CMS.
- Drupal Core 4.6.x Arbitrary Code Execution (4.6.0 - 4.6.7)
- WordPress Plugin Analytics Remote Code Execution (1.7)
- Drupal Core 8.4.x Remote Code Execution (8.4.0 - 8.4.5)
- WordPress 2.0.2 Username Remote PHP Code Injection Vulnerability (0.6.2 - 2.0.2)
- IBM WebSphere RCE Java Deserialization Vulnerability