CVE-2019-15954

Vulnerability

Overview

CVE-2019-15954 is a server-side code injection vulnerability in Total.js CMS version 12.0.0. The issue stems from the way the CMS processes widgets. An authenticated user who has been granted the 'widgets' privilege can create a malicious widget containing a specially crafted ` tag. When the backend evaluates this tag, it does so in a server-side context that allows JavaScript code execution. The attacker can escape the intended sandbox by using the payload global.process.mainModule.require(child_process).exec(RCE)`, enabling arbitrary command execution on the server. [1] [2]

Exploitation and

Impact

To exploit this vulnerability, an attacker must first have an authenticated session in the CMS and possess the 'widgets' privilege. No other special network access is required beyond being able to reach the application. The attacker creates a new widget and includes the malicious `` tag with the JavaScript payload. Once the widget is rendered or processed server-side, the injected code runs with the privileges of the Node.js process, leading to full remote code execution (RCE). [2] [4]

Mitigation

Users of Total.js CMS 12.0.0 are advised to upgrade to a patched version as soon as possible. As of the publication date, a fix has been issued by the vendor. No workarounds are documented for this specific vulnerability, and given its severity (RCE via authenticated low-privileged user), upgrading is strongly recommended. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. [3]