CVE-2020-9381 (Other, published 2020-02-24T22:15Z)
Description: value: controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/totaljs/cms
Files changed:
cms.bundle
controllers/admin.js
Commit message: Fixed permissions.


Vulnerable code:
/controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOooytJALH9lgykGH579cvsuOEhJ1vRxUVWd1q9eujlsI00Uac9L/cnPYGR4dfRUc8i8HXs+6ucJLUqOHUES/ttbBi2zvung/qXEEsc1Nj2u/1/jrq3vTOBke90z5xahkWuTJT4NYmV6FxPDE2JkuTGOZMXsjZ8r3j494lrLpyWkGmWpHMZBLJJFRSt2AZz2bBCD6zXD4o+TibLrI4DaLZdxI8zD6GKi5FaBMYO4zVg5zxPKpoJCtSOkoL03KuK9UOTo5OL86PQTtgjyYqaTnttbWHIBcHBz0yFczAz0v8SIo4BvLhxem+z66EyWGRhEalifsQxIVsiue1hhoK97JPw8YsEL6ZZhIWEJ9QsH+QhDIdit7tnQyN+MQUZtvlj/a8hInUGhz1A0JKTgiQg0Iu+74Gt7szYU2Yfll7Ke1B6nJrwPTffhOlAJ5vzxZSttRXFlrmnkArPDHvE6SwrJlvKPtK1+BPe46wYPE8keR1BP74STCRi4YS18zO3qnrPCitTJpDOlT6prd3PxC1auXKkICcNz0NP2vyKUtzo30KXBzX3YYbrzVaLXGUGJknQbzWOO9dDLqu86U7EPjHGYqZzAOUu5SlSnRPrP5jnpqMs15/wDKgboAKcmxJrBRDXEtF0ML5Cl7+x3QP0IFHwLi1CX/XntjZ2t5stgW4ZEecfP6BTW4DLX9/v2Qvpt8wHfYqd9jefP+Bd9iu77DgzVeotcSM9b40RiUjLTY2Poo/6uwYJwrsSe+ge7wrWjocy0nQCtPJJE38O/3WvrdBeF9kuhXGMsiXbLy+T1J4V2a+Id43sqMu9xnT+6X1rKKX1j/JzSWEpzTmUt7qNLyXBgCi+7nf2/+rO3BLEC0xmDkwuHc6TZxrWnx4dNx1s7iA1CEER0VpzmlF6WNSpgvSaEsLNli9gNomT2NAnHoBz2a5hrCQZ3N+kce+Lm7xnEpG7qZXob4fy2Rkxk3xU6dTTTahhHNpijxBXRH6oyjVUKh4IFzVxKrs2rpiRwwDUDYSgTFykhnNKtC6j2KHEaW2MkTIjl20uz5txnn6+H5ziwmlDoAcsMk6i9zvnR765OIbk97LBMG0JiGX3/wxeEzm+sp52iAW51p0wLzFla+Uslja/9q/6HfP5zVYb1lXhGl6rxDr6tbQXF01nkErUOef7KK//xZ2WPkdVVjiVpBPvvvEP+/EFhxjW+0fciK2Dy7j4wahk/Pam2iJNfdk7+iUTNdXrNt1u3ZUdfjI/78pCrl1nkKFWEfSOacDDDoNc6RZZy5kAuT8fFZTYXAMSR88bHM8T2F2mObCRZKCWagPK7Hzepc2sPxbVON379g1JBf55tZcKSqQxrJ6VACOT72hi4y+SY/TR5nvAzq7Ta7GjS0ruVGpOwxiTSd8o3ELsHBPw5e1BnkKXbUXxyAmEmDumt2U1lrbV5tJDeo/WPiWEbQerF1UfanuNeVJe1Z/QV1avDyF3oCMWvaUniHpr6scf9rckZQoKmqI7AKQeCKX2hNKzzAVxlWGCsQacMLVFuOLc+OUeJkF5FVmUD5+2uaMnI9OAzJOVx50EPC3m5YFuUuOGXBve7yWzpD5WHLQqJbZilq+lhEkzYhYlr1lpTTlAPCMryIyCdWo5Td65rVWbA5UPkegZLQmnO0N/oRiSA1YaLdrOcBN5Hdw58iK21iFNIfLWAg43scvt5RUTpfBtXFFPpsB7zEDYA4RAw4ALQKhMxmqoQpZ8WGeTkQUmAB7IGQ7BA+qCd66hHuXjTwxUkNPZMmoKXSRUZcqMpmHMjFFEGMyqO9gsAjCMM0jHP38SXdOL04+d89/FkE+KibACiES3wqZTwX7R0h/5O8KH3YA7h2oOjv8sCncYamCGAWYndArNVE1KGDokqpeYN1fn2Vp1RVUOcr5SbkQ2bTTWawMZCYciFkchNJ1fPQwkuSTkYkGSdBFcy9D0Iok0tvXeFC5c6xU1g7o7SDKLiGB61aRwKFOk7OoDOtQuw6VGeS8ipai/n6hDcSLnVO6no2EsbR9R3+CV4gxNGcCXWnGkmMdBtBg+sRyCPoobTTcLqDm9auipIUh+BN7V4HdC6gEccTECeC2IwK4Fep7lUFGwV710GpxO50tdW9lGMAWoIXSpFPTZ9/WXMt+QAtsoOw8qJNrCfeesvVZUPI1mNQj65FPsJx8p9melQZ5b97ZtaaRqKwQDX24DGWFmY98pc4sqp16LvDKb1AgykzdDzvET9pURIqedEsVf+Vjnmlw9qvhlIx+4frFJhew+UGFcr7DLfBSWF1T7bf4VWztkEabTduh2CeLeWjnNpxumJxDMh5iAwChatP9vkNTMMYfPyhMGkmIcjp1YVHn4+z1g7WsBPMdcpVgEraqPcT6g/+NLUClKTmF2HMZqVyGprpKOK+3VMmqHQnkHyNrj3+bRlNIGa0fAbJ8PQ62d36va6Il5K8pj517ic857mxlidK7CB4othyTCF4MX2+saPrjQI+hqXlzc4xorREFPa5tz0LYdHbePWQSpItRkGvfZYTxbhBFQ2SdRTK4Fts7ArjGL/29/8DtqvsAhQ2EZ3pmwZe7qYaK56s+zKOMXTFvjCdI2fJJzxOnvd6ZR0yc62+HGEyBGG8JuEmaMWwx/5I4k6CLMJRacyUICc1SSVHJA1gUuY7M8zTfIDs3wHEEUtBVOdW5d0F3fOFOitioDM5SkakQYBXa5yp5+B3AXTgyrq7bS5LJJiSBh/8YKONW5YhznkgAFBhA8NunQ6liAXU9Om9tB4FwDXgK4FzkOR6UhNQqMSnh9p8HB8iF1+D+oHe+96VbwlYT34pkbmhTv+wIWHYNIWi/XA6rdjXyswJS7xlM3EWCR03HrlgQg7hkJ7ll8sSjiszYztHYE2OpRmNj5/jDs1lEU/zYB5rgDqe9S09MauMKPC137QwuD3nIxtrln87qISO67YxqCPxim11I/KPJBPAiMNKlYHDjy0nPP5CxjGAUS3yEcOHIXcwZfhdaTBP7XLQCa2zjMCsX6t/4gKv2spC55P5pXxXnl/u84z5UC6TIAFjcEpzAPErJR2XCsXBxub3CwxLh0HnSwmZjF30A3Phk6eMEOaW6dNTZ7zK5wI/n2mp+bHPm2HFinj2SwwDqj7iWuOG1HzCNV/lhkH4uhkOZu+UL0arSWERg6OAcFgE8ZafQ+q9/tbnxr2Dj+/W7X1qK+j9/Ejy57zebkGRgU1lUXEyQJ/OJs5ChKuJVlE3/Awg7gJ51GQAA
const ALLOW = ['/api/dependencies/', '/api/pages/preview/', '/api/upload/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/'];
			for (var i = 0, length = ALLOW.length; i < length; i++) {
				if (controller.url.indexOf(ALLOW[i]) !== -1) {

Fixed code:
/controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOohxbTgSO7bFkIMPy36+7Jb/lhZ1vRxUVWd1q9eujlvwkloqdDb/cnQ9GJ8dfWY+9sNHXi/4+s+JEiXBusdfuhl+yHZz2L0d1Li/imaoxHQ4Gf5307wYXo5PB+ZA4JffzTKg5cEuVCV9ZDpsqlSZxBHMqy3m1/OD0dHBNq770R/vsxup4qegEPOVxwGNfcNmB1Xo29SbwmWb8UfCnajr2HquPUETFEqk8ZYaReOQVz5MIJrwkJZMkV/VNMiTdOuxiMKw0ytMo8YJltpolR2cn51eXp2AMsAQzEXes7sbGo5exo6MBeQZ48fMaP+I8ioB8fHV+6GrPw2SYx74SSWw/elHO2+xloyVCZl8Padiq4uaqecphAfExAft7sc+TkA3G99xX7JOmaLZ9/dFtSphxKcGhPyCk4IR4WijkeuhKCI9dCWvD9OvGa2EPUldbA6b/9hsrBOj5brWQkqu+Mpc8cxha4bCmT5CiZVW+oWQtXIM/3QZhweImkeT1GP64sTfji4YSV2Xn4Ny2HoUUKskgJ0p9k/H9D0StXLk2JCDnTU/DzwZ/ThNIQpcCF0V1t+HGG61Oh53EimexF220LgdXo75tQZUx/NMZiumsByh3JUutQNb/aZ6aDKwdLQNqBaggx5TEWjHEtVIELWwW4eo/TXegZvUIGHe24Q+KeW9nd7vdZeCSPXb2+Qc2GXuS//5+xV6afqfpsFexw+72+w96h936DgveXEK3FWZsDrlSIp5ItrX1kf1RZ8c4UWDPBkf9033Wkf6Uz7yOn8xmSezey7f2HXv+Q57Kjh9xL1ux8eYhSdG7auY74n0jO+pyXzC9XzsvInjt/JPcjEN4CmOu+Vgm/gNXABD9z8PB4V/9kV2AaIHdmgODey+T2Lqlxccnp307jXJIHUJ+VJTmrE6QPMVFuiCNtjRgg9ULqK2yJALEqRdwNatrCAu5mnPzLHJlPsZjLZ7Y206J+m7E44mattlPvV452YYSzrjKsxh1RegPgkRCoeKBcFMTK9Jb44o9FnqgbMA8pfgsVVKrQOs+sj2NKLWVPkJ2ZKPd9Wk1zZKn99s7mlDoAMgBm2xqkYeD82OXXHynkgceI5jWJGT8mzsFj/FM3ljPW8QCx10PzFtcuaSUwdLh1+HVsH/Z1GCzY1zhJ8mDQKyrW0NzddX0DFqBOv9kFv39NzPD0u+owgq3gnzy3Sf9847twDG20/0hJ2KbYWt83CJ0spa9iZYYc88OTs7JdHmjdbvt1o6qnj7y/2+KQm5dJlAhxpF0zkkPg07DDGnGmQuZADnfzGoqDB1D0gcP2wzPU5gNk4zZSBIwC/VhJPaWd+kCy79ZOX73TruG5CJfY82NoAJprapHAeD4PAhtZHRVcpo88ewQ0Nlu62rc2jGSW6W6oRdJOuFbrTHAwgMNXzda5Cl01UEUgZiAgbkbZlNaa2wnJT3kAWHUwt4slM6Mq2kSGKXXOoVE/IM/3jKZ1oNvFg1daWnNVLJVG7tgHC1enXBvAEwt1wo/kvRlTMCfru5fCsxlNfy2wXcOy7h0mJAVAsO4zGeG7gUn3OxoNLLurAJdU4+8qhmEi5+mlSPno9OAjNOlBy08HnbbhgW5C44K5ncdvZZOnGYsddCo8rUVtewuIkiaEbEACcNKSa0DoGdcEZBJqEatGtAzy1ppcwAndAQKRmPCxcHoTyidRIGFZruOBdxEfgc3lDQfR8KnOVymhYDjXfyyC0nFdBFcE1fkMxnwHjMA5hBf4LiQzGMy5b4Iha8VD7NkxgJPedgxIdsxeFDM8C7H7Pt04rCJCB2WxpM2k3lKPS1LeebzWOVehMkgvoPBzPP9JAtw9PMn2Tu/Ovvcv/yZedkknwErhIh9y3k2Z9o/jLsTd5+5sANw70HVmeGHbWaHhQps4mF2QmfVRtWg3KGnKjuHTXezytKyhyhzVOcn5UJg0k6mkVCQmYABaeT53LZc9DCS+LPisQRJ0HPrzoeAGEmktyvxWLMbrFTWFuhtISavIIHr1pHAoVZbZ1ER1lDaFpUZ5LwIVp4Rh7lUEC/tnML12kgYc9OlDGd44ZhCK8fQlWrKdax9D9pRl1iOQR8hlYS7CNS8XCpKWuiDP7HTZdjrgEoQR0wcD+5GzIM7pHwQqUSUbIRWsvG8WmqPue/BFqCFkKRT29W+rblW+wEtMIEy86BOJjnckopGaUHJZTCpR9Yhn2A5uVa7W5UGea/p7FqLSVStEA1duDqluWpGvlSnimqvngt65TcoEKHm9oc94idtSiJFj9uFir/qpkDToFMQ4ZyMftX1iy0xYPOj8HmzH87xClleas03+5Xt7JFG223Tz5gHjia066ad7qM6h3gUYrsAoerSa0CPpmCMP66XqyTgEOVkbsOi3sfqrURrWQrWN851gknYumYS6w/+t3YAlebkFGLPeCAy7qvy4mEtbynidTsSyD8Fxh53nARzSBkpnwCyXDn1dvd+r2siOeSvKo6dB46PP3a1skDpfQQPFFuMSYReDF9vrGi7U09OoQV6c3OMaK1tBT1uTYdD2HRx2T/WJEgXJSDXvvMA490iioTIWotkcC02gwRwrV+GB/+Bu1j/EQobCC/0KIPPgnMJFa8fBmAeZeyzpjEOI2WL90KHnQ8GFw4x6Vx/O8RgCsR4h8G9U01hi+YzZSVB5r7PpdSVwDg0SwVFxI9gUWBbPMuSbIvs3ALHEUhBV2WV594VvQgwe5ZHSqRwlrJU+ACr0GyXyaNfDeyFI+PmtrsimUxCEni4T55QdlmOOOewGEBBAwh+u3QolSygrkPnrekgEK4BTwGc8yzDg5KQWsQqIdz+8+gIufDSPBwNLg++9AvYauPLEs8UbeoWHYGWXUMI2i/jYdmuBm6aQ+q9gIn7SHCo6dhnC2IQl8ykbpkc9iQCNTVzNHbYlIvJVJk5/eGYLKIp/TQImuAO54Nrh81q4xI8DXftDC4OecjG2lMBndWhRnTTGdUQ+NU0u5D4J7MZ4IWnuE3B0I2vTnr9AxmrEYxiiU8WNhy5izmjX5EW08Q8Lq3BGtM4VOVC/Zs+4Mq9DGSuuK2aN8jmclfveAjVAikyAha7ACcwj1LySSh/ymxcbi78sIRZdJ50sNnYRx8ANz5wujhBTikvHXX2+5Qv8OO5tp4f25wGO0402QMeelB/xLXCDct+wDRe54dR8jkPQ57ZxXvSutJYRGDo4CwtAniKTqHzX/dme+tf3tb323e/dAT1f+7Me7bfb7chycCmoqh0MUGeNBNnIUNFoFdRNv0PuzGhcdIZAAA=
const ALLOW = { GET: ['/api/dependencies/', '/api/pages/preview/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/', '/api/parts/'], POST: ['/api/upload/', '/api/parts/'] };
			var allow = ALLOW[controller.req.method];

			for (var i = 0, length = allow.length; i < length; i++) {
				if (controller.url.indexOf(allow[i]) !== -1) {