CVE-2020-9381 (published 2020-02-24T22:15Z)

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/totaljs/cms
commit_details: repo_url: https://github.com/totaljs/cms
author: Peter Širka
author_date: 2020-02-19 12:51:13+01:00
msg: Fixed permissions.
repository: repo_url: https://github.com/totaljs/cms
repo_name: totaljs/cms
description: Node.js Content Management System
repo_language: HTML
owner: totaljs
file_changes: filename: cms.bundle
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOooytJALH9lgykGH579cvsuOEhJ1vRxUVWd1q9eujlsI00Uac9L/cnPYGR4dfRUc8i8HXs+6ucJLUqOHUES/ttbBi2zvung/qXEEsc1Nj2u/1/jrq3vTOBke90z5xahkWuTJT4NYmV6FxPDE2JkuTGOZMXsjZ8r3j494lrLpyWkGmWpHMZBLJJFRSt2AZz2bBCD6zXD4o+TibLrI4DaLZdxI8zD6GKi5FaBMYO4zVg5zxPKpoJCtSOkoL03KuK9UOTo5OL86PQTtgjyYqaTnttbWHIBcHBz0yFczAz0v8SIo4BvLhxem+z66EyWGRhEalifsQxIVsiue1hhoK97JPw8YsEL6ZZhIWEJ9QsH+QhDIdit7tnQyN+MQUZtvlj/a8hInUGhz1A0JKTgiQg0Iu+74Gt7szYU2Yfll7Ke1B6nJrwPTffhOlAJ5vzxZSttRXFlrmnkArPDHvE6SwrJlvKPtK1+BPe46wYPE8keR1BP74STCRi4YS18zO3qnrPCitTJpDOlT6prd3PxC1auXKkICcNz0NP2vyKUtzo30KXBzX3YYbrzVaLXGUGJknQbzWOO9dDLqu86U7EPjHGYqZzAOUu5SlSnRPrP5jnpqMs15/wDKgboAKcmxJrBRDXEtF0ML5Cl7+x3QP0IFHwLi1CX/XntjZ2t5stgW4ZEecfP6BTW4DLX9/v2Qvpt8wHfYqd9jefP+Bd9iu77DgzVeotcSM9b40RiUjLTY2Poo/6uwYJwrsSe+ge7wrWjocy0nQCtPJJE38O/3WvrdBeF9kuhXGMsiXbLy+T1J4V2a+Id43sqMu9xnT+6X1rKKX1j/JzSWEpzTmUt7qNLyXBgCi+7nf2/+rO3BLEC0xmDkwuHc6TZxrWnx4dNx1s7iA1CEER0VpzmlF6WNSpgvSaEsLNli9gNomT2NAnHoBz2a5hrCQZ3N+kce+Lm7xnEpG7qZXob4fy2Rkxk3xU6dTTTahhHNpijxBXRH6oyjVUKh4IFzVxKrs2rpiRwwDUDYSgTFykhnNKtC6j2KHEaW2MkTIjl20uz5txnn6+H5ziwmlDoAcsMk6i9zvnR765OIbk97LBMG0JiGX3/wxeEzm+sp52iAW51p0wLzFla+Uslja/9q/6HfP5zVYb1lXhGl6rxDr6tbQXF01nkErUOef7KK//xZ2WPkdVVjiVpBPvvvEP+/EFhxjW+0fciK2Dy7j4wahk/Pam2iJNfdk7+iUTNdXrNt1u3ZUdfjI/78pCrl1nkKFWEfSOacDDDoNc6RZZy5kAuT8fFZTYXAMSR88bHM8T2F2mObCRZKCWagPK7Hzepc2sPxbVON379g1JBf55tZcKSqQxrJ6VACOT72hi4y+SY/TR5nvAzq7Ta7GjS0ruVGpOwxiTSd8o3ELsHBPw5e1BnkKXbUXxyAmEmDumt2U1lrbV5tJDeo/WPiWEbQerF1UfanuNeVJe1Z/QV1avDyF3oCMWvaUniHpr6scf9rckZQoKmqI7AKQeCKX2hNKzzAVxlWGCsQacMLVFuOLc+OUeJkF5FVmUD5+2uaMnI9OAzJOVx50EPC3m5YFuUuOGXBve7yWzpD5WHLQqJbZilq+lhEkzYhYlr1lpTTlAPCMryIyCdWo5Td65rVWbA5UPkegZLQmnO0N/oRiSA1YaLdrOcBN5Hdw58iK21iFNIfLWAg43scvt5RUTpfBtXFFPpsB7zEDYA4RAw4ALQKhMxmqoQpZ8WGeTkQUmAB7IGQ7BA+qCd66hHuXjTwxUkNPZMmoKXSRUZcqMpmHMjFFEGMyqO9gsAjCMM0jHP38SXdOL04+d89/FkE+KibACiES3wqZTwX7R0h/5O8KH3YA7h2oOjv8sCncYamCGAWYndArNVE1KGDokqpeYN1fn2Vp1RVUOcr5SbkQ2bTTWawMZCYciFkchNJ1fPQwkuSTkYkGSdBFcy9D0Iok0tvXeFC5c6xU1g7o7SDKLiGB61aRwKFOk7OoDOtQuw6VGeS8ipai/n6hDcSLnVO6no2EsbR9R3+CV4gxNGcCXWnGkmMdBtBg+sRyCPoobTTcLqDm9auipIUh+BN7V4HdC6gEccTECeC2IwK4Fep7lUFGwV710GpxO50tdW9lGMAWoIXSpFPTZ9/WXMt+QAtsoOw8qJNrCfeesvVZUPI1mNQj65FPsJx8p9melQZ5b97ZtaaRqKwQDX24DGWFmY98pc4sqp16LvDKb1AgykzdDzvET9pURIqedEsVf+Vjnmlw9qvhlIx+4frFJhew+UGFcr7DLfBSWF1T7bf4VWztkEabTduh2CeLeWjnNpxumJxDMh5iAwChatP9vkNTMMYfPyhMGkmIcjp1YVHn4+z1g7WsBPMdcpVgEraqPcT6g/+NLUClKTmF2HMZqVyGprpKOK+3VMmqHQnkHyNrj3+bRlNIGa0fAbJ8PQ62d36va6Il5K8pj517ic857mxlidK7CB4othyTCF4MX2+saPrjQI+hqXlzc4xorREFPa5tz0LYdHbePWQSpItRkGvfZYTxbhBFQ2SdRTK4Fts7ArjGL/29/8DtqvsAhQ2EZ3pmwZe7qYaK56s+zKOMXTFvjCdI2fJJzxOnvd6ZR0yc62+HGEyBGG8JuEmaMWwx/5I4k6CLMJRacyUICc1SSVHJA1gUuY7M8zTfIDs3wHEEUtBVOdW5d0F3fOFOitioDM5SkakQYBXa5yp5+B3AXTgyrq7bS5LJJiSBh/8YKONW5YhznkgAFBhA8NunQ6liAXU9Om9tB4FwDXgK4FzkOR6UhNQqMSnh9p8HB8iF1+D+oHe+96VbwlYT34pkbmhTv+wIWHYNIWi/XA6rdjXyswJS7xlM3EWCR03HrlgQg7hkJ7ll8sSjiszYztHYE2OpRmNj5/jDs1lEU/zYB5rgDqe9S09MauMKPC137QwuD3nIxtrln87qISO67YxqCPxim11I/KPJBPAiMNKlYHDjy0nPP5CxjGAUS3yEcOHIXcwZfhdaTBP7XLQCa2zjMCsX6t/4gKv2spC55P5pXxXnl/u84z5UC6TIAFjcEpzAPErJR2XCsXBxub3CwxLh0HnSwmZjF30A3Phk6eMEOaW6dNTZ7zK5wI/n2mp+bHPm2HFinj2SwwDqj7iWuOG1HzCNV/lhkH4uhkOZu+UL0arSWERg6OAcFgE8ZafQ+q9/tbnxr2Dj+/W7X1qK+j9/Ejy57zebkGRgU1lUXEyQJ/OJs5ChKuJVlE3/Awg7gJ51GQAA
+/controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOohxbTgSO7bFkIMPy36+7Jb/lhZ1vRxUVWd1q9eujlvwkloqdDb/cnQ9GJ8dfWY+9sNHXi/4+s+JEiXBusdfuhl+yHZz2L0d1Li/imaoxHQ4Gf5307wYXo5PB+ZA4JffzTKg5cEuVCV9ZDpsqlSZxBHMqy3m1/OD0dHBNq770R/vsxup4qegEPOVxwGNfcNmB1Xo29SbwmWb8UfCnajr2HquPUETFEqk8ZYaReOQVz5MIJrwkJZMkV/VNMiTdOuxiMKw0ytMo8YJltpolR2cn51eXp2AMsAQzEXes7sbGo5exo6MBeQZ48fMaP+I8ioB8fHV+6GrPw2SYx74SSWw/elHO2+xloyVCZl8Padiq4uaqecphAfExAft7sc+TkA3G99xX7JOmaLZ9/dFtSphxKcGhPyCk4IR4WijkeuhKCI9dCWvD9OvGa2EPUldbA6b/9hsrBOj5brWQkqu+Mpc8cxha4bCmT5CiZVW+oWQtXIM/3QZhweImkeT1GP64sTfji4YSV2Xn4Ny2HoUUKskgJ0p9k/H9D0StXLk2JCDnTU/DzwZ/ThNIQpcCF0V1t+HGG61Oh53EimexF220LgdXo75tQZUx/NMZiumsByh3JUutQNb/aZ6aDKwdLQNqBaggx5TEWjHEtVIELWwW4eo/TXegZvUIGHe24Q+KeW9nd7vdZeCSPXb2+Qc2GXuS//5+xV6afqfpsFexw+72+w96h936DgveXEK3FWZsDrlSIp5ItrX1kf1RZ8c4UWDPBkf9033Wkf6Uz7yOn8xmSezey7f2HXv+Q57Kjh9xL1ux8eYhSdG7auY74n0jO+pyXzC9XzsvInjt/JPcjEN4CmOu+Vgm/gNXABD9z8PB4V/9kV2AaIHdmgODey+T2Lqlxccnp307jXJIHUJ+VJTmrE6QPMVFuiCNtjRgg9ULqK2yJALEqRdwNatrCAu5mnPzLHJlPsZjLZ7Y206J+m7E44mattlPvV452YYSzrjKsxh1RegPgkRCoeKBcFMTK9Jb44o9FnqgbMA8pfgsVVKrQOs+sj2NKLWVPkJ2ZKPd9Wk1zZKn99s7mlDoAMgBm2xqkYeD82OXXHynkgceI5jWJGT8mzsFj/FM3ljPW8QCx10PzFtcuaSUwdLh1+HVsH/Z1GCzY1zhJ8mDQKyrW0NzddX0DFqBOv9kFv39NzPD0u+owgq3gnzy3Sf9847twDG20/0hJ2KbYWt83CJ0spa9iZYYc88OTs7JdHmjdbvt1o6qnj7y/2+KQm5dJlAhxpF0zkkPg07DDGnGmQuZADnfzGoqDB1D0gcP2wzPU5gNk4zZSBIwC/VhJPaWd+kCy79ZOX73TruG5CJfY82NoAJprapHAeD4PAhtZHRVcpo88ewQ0Nlu62rc2jGSW6W6oRdJOuFbrTHAwgMNXzda5Cl01UEUgZiAgbkbZlNaa2wnJT3kAWHUwt4slM6Mq2kSGKXXOoVE/IM/3jKZ1oNvFg1daWnNVLJVG7tgHC1enXBvAEwt1wo/kvRlTMCfru5fCsxlNfy2wXcOy7h0mJAVAsO4zGeG7gUn3OxoNLLurAJdU4+8qhmEi5+mlSPno9OAjNOlBy08HnbbhgW5C44K5ncdvZZOnGYsddCo8rUVtewuIkiaEbEACcNKSa0DoGdcEZBJqEatGtAzy1ppcwAndAQKRmPCxcHoTyidRIGFZruOBdxEfgc3lDQfR8KnOVymhYDjXfyyC0nFdBFcE1fkMxnwHjMA5hBf4LiQzGMy5b4Iha8VD7NkxgJPedgxIdsxeFDM8C7H7Pt04rCJCB2WxpM2k3lKPS1LeebzWOVehMkgvoPBzPP9JAtw9PMn2Tu/Ovvcv/yZedkknwErhIh9y3k2Z9o/jLsTd5+5sANw70HVmeGHbWaHhQps4mF2QmfVRtWg3KGnKjuHTXezytKyhyhzVOcn5UJg0k6mkVCQmYABaeT53LZc9DCS+LPisQRJ0HPrzoeAGEmktyvxWLMbrFTWFuhtISavIIHr1pHAoVZbZ1ER1lDaFpUZ5LwIVp4Rh7lUEC/tnML12kgYc9OlDGd44ZhCK8fQlWrKdax9D9pRl1iOQR8hlYS7CNS8XCpKWuiDP7HTZdjrgEoQR0wcD+5GzIM7pHwQqUSUbIRWsvG8WmqPue/BFqCFkKRT29W+rblW+wEtMIEy86BOJjnckopGaUHJZTCpR9Yhn2A5uVa7W5UGea/p7FqLSVStEA1duDqluWpGvlSnimqvngt65TcoEKHm9oc94idtSiJFj9uFir/qpkDToFMQ4ZyMftX1iy0xYPOj8HmzH87xClleas03+5Xt7JFG223Tz5gHjia066ad7qM6h3gUYrsAoerSa0CPpmCMP66XqyTgEOVkbsOi3sfqrURrWQrWN851gknYumYS6w/+t3YAlebkFGLPeCAy7qvy4mEtbynidTsSyD8Fxh53nARzSBkpnwCyXDn1dvd+r2siOeSvKo6dB46PP3a1skDpfQQPFFuMSYReDF9vrGi7U09OoQV6c3OMaK1tBT1uTYdD2HRx2T/WJEgXJSDXvvMA490iioTIWotkcC02gwRwrV+GB/+Bu1j/EQobCC/0KIPPgnMJFa8fBmAeZeyzpjEOI2WL90KHnQ8GFw4x6Vx/O8RgCsR4h8G9U01hi+YzZSVB5r7PpdSVwDg0SwVFxI9gUWBbPMuSbIvs3ALHEUhBV2WV594VvQgwe5ZHSqRwlrJU+ACr0GyXyaNfDeyFI+PmtrsimUxCEni4T55QdlmOOOewGEBBAwh+u3QolSygrkPnrekgEK4BTwGc8yzDg5KQWsQqIdz+8+gIufDSPBwNLg++9AvYauPLEs8UbeoWHYGWXUMI2i/jYdmuBm6aQ+q9gIn7SHCo6dhnC2IQl8ykbpkc9iQCNTVzNHbYlIvJVJk5/eGYLKIp/TQImuAO54Nrh81q4xI8DXftDC4OecjG2lMBndWhRnTTGdUQ+NU0u5D4J7MZ4IWnuE3B0I2vTnr9AxmrEYxiiU8WNhy5izmjX5EW08Q8Lq3BGtM4VOVC/Zs+4Mq9DGSuuK2aN8jmclfveAjVAikyAha7ACcwj1LySSh/ymxcbi78sIRZdJ50sNnYRx8ANz5wujhBTikvHXX2+5Qv8OO5tp4f25wGO0402QMeelB/xLXCDct+wDRe54dR8jkPQ57ZxXvSutJYRGDo4CwtAniKTqHzX/dme+tf3tb323e/dAT1f+7Me7bfb7chycCmoqh0MUGeNBNnIUNFoFdRNv0PuzGhcdIZAAA=
 /controllers/cms-default.js                                                                                             :H4sIAAAAAAAAE0utKMgvKinWy8wrLknMyVGwVUgrzUsuyczP09BUqObiDPIPDXHVUNfXUtdBk+Esycgs1nP2DS5ITE/V0LTm4qwFErXWXADBad8VUwAAAA==
 /controllers/default.js                                                                                                 :H4sIAAAAAAAAE0utKMgvKinWy8wrLknMyVGwVUgrzUsuyczP09BUqObi1NdXcM1LTMpJVXD2DwpWSMsvUnAM8OTiBPE0NK25OIP8Q0NcNdT1tdR1FMoyU8vjk3OLgeK11lxcMJPg4hAjSzIyi/WcfYMLEtNTQUbUAgCGmQ8khAAAAA==
 /definitions/database.js                                                                                                :H4sIAAAAAAAAE6VUwW7aQBA946+YU2yrllF7BKGKkESqFAGKUuVQ9WB7x2GV9S7aXUIp5d87Y8fYUHJpLtZ6ZvbNvDfPHg7hcSUdlFIhFBYzjw4ycLJaU2CFao0WSmPBeWOlfobCaI/aQ2lNBcvsGV0CS+M83dIC5rh1Cr1H64LhEB5QbAoCdPI3gimhyqSGm+saUEnnGTDilz5Q0keJa1ipeTRHSH6FQCPRnSrTBQbc5eZ2dj99mD5+W8yD2WJ+9yP0Wa4wXTOoyHwW/oQJhFKMnGcOf3Ijdu2Z8tjwFiM+h+MzDOs/jMGsPoihO0n+Ayl4nF7f30Zhp0icVlgZu4s+x+Mu23K9mD2yuJQ9n++khpd0uuEltzpzDGwcpFsrPUbN1lMiIehcbnThpdEuuPs+nzUlRL8NR363xgSkSFpz0iFTKs+KlwTwF/mMbLQPgoEsoS42ZdQWxDCZkJK5MQozHXLdYNDcoRZt1ZiC7ZnCeqMUhQ4E+ZpZEDnFGh0YHT5B2Ggwblp2IwwGIk8rI2S5i/ZQL+34QR0S8HaDMbEmqaVn8WjDITOL0+0KLfbepXZofXTUQJgige5m02xA0VQKmq7L0Pu4TfWcQjXzxRNnDnHaUu1UYraAymFD4a37nkYZ1cKfUEmgb0HGhXdAD+SNeqe86XdWelwUMbokcmo0fonitJTW+ehfpUqJSrgo5BHD3hjHXmgtTWyKRrNjnpdcx+ErP1O+DyMI67UeToevzOtFR9aQZH5yAa+hcQ7/wywC/XQ1kvDeQEHes0CNWwUbX+UbqQR9F5fN9dY2ql0m4OqqrU+VfOkJwIP+BVDo3HzmBQAA

programming_language: CSS
filename: admin.js
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 const MSG_NOTIFY = { TYPE: 'notify' };
 const MSG_ALERT = { TYPE: 'alert' };
 const COOKIE_OPTIONS = { security: 'strict', httponly: true };
-const ALLOW = ['/api/dependencies/', '/api/pages/preview/', '/api/upload/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/'];
+const ALLOW = { GET: ['/api/dependencies/', '/api/pages/preview/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/', '/api/parts/'], POST: ['/api/upload/', '/api/parts/'] };
 const ADMINURL = '/admin/';
 
 var DDOS = {};
@@ -110,8 +110,10 @@ ON('controller', function(controller) {
 		// Allowed URL
 		if (cancel) {
 
-			for (var i = 0, length = ALLOW.length; i < length; i++) {
-				if (controller.url.indexOf(ALLOW[i]) !== -1) {
+			var allow = ALLOW[controller.req.method];
+
+			for (var i = 0, length = allow.length; i < length; i++) {
+				if (controller.url.indexOf(allow[i]) !== -1) {
 					cancel = false;
 					break;
 				}

programming_language: JavaScript