Executive brief
Total.js CMS is a content management system used to build and manage web applications. An authenticated user with widget creation privileges can execute arbitrary code on the server by injecting malicious JavaScript into widget definitions, potentially leading to complete server compromise and data theft.
Technical details
The vulnerability is a code injection / sandbox escape in Total.js CMS versions 12.0.0 and related 12.x releases. Authenticated users with widget privileges can create malicious widgets containing specially crafted `<script total>` tags that are evaluated server-side. The tag evaluation mechanism fails to properly sandbox the execution context, allowing attackers to break out using payloads that access the global `process` object (e.g., `global.process.mainModule.require('child_process').exec()`). This enables remote command execution with the privileges of the application server. The vulnerability requires prior authentication and the widgets privilege, but no additional user interaction. Patches are available in newer versions of the total4 package.
Affected products
- Total.js CMS 12.0.0 and 12.x
Timeline
- 2019-09-05: disclosed
- 2022-05-24: advisory