dotCMS Privilege Escalation to RCE via OSGi Bundle Upload

Vulnerability Overview This vulnerability allows any authenticated backend user to achieve remote code execution by assigning the admin settings layout (which includes role ports) and subsequently uploading a malicious OSGi bundle. The attack chain is as follows: 1. PUT /api/v1/toolgroups/{id}/_addUser: Any backend user can assign the admin settings layout without any permission checks. 2. POST /api/v1/plaincall/RoleAjax.addUserToRole.do: Since the role port is now accessible, users can grant themselves the CMS administrator role. The only gating factor was port access, which was satisfied by step 1. 3. As CMS Administrator, attacker uploads malicious OSGi bundle: This allows for arbitrary OS command execution. Impact Scope Affected Versions: - First vulnerable version: 21.02 (committed December 2020, released February 2021) - Expanded attack surface (assignment by other users): 21.03 - 21.04 (committed March 2021) - All affected versions: 21.02 - v28.06.22-03 (current latest), including all LTS branches: - 23.10 LTS - 24.04 LTS - 24.12 LTS - 25.07 LTS - Partial mitigation: Starting from v25.11.07-1 (still exploitable via the chain until this PR is merged) - Full fix: Not yet released Remediation 1. ToolGroupResource.java: - Add check in the method for all layouts except (the onboarding layout is intentionally self-assignable). - Symmetrically apply the same admin guard in the method. 2. RoleAjax.java: - Add check in the method after the existing portlet-access check, and log unauthorized attempts via . - Symmetrically apply the same admin guard in the method. POC Code Test Plan Verify that low-privilege backend users receive a 403 error when calling PUT /api/v1/toolgroups/{id}/_addUser (for non-gettingstarted layouts). Verify that self-assignment of the layout still works for non-admin users (the onboarding process should not be disrupted). Verify that low-privilege backend users throw a when attempting to use the Role port to invoke . Verify that CMS administrators can still assign layouts and manage roles normally. Run the researcher's POC script—it should fail at step 1 and never reach remote code execution. References Closes dotCMS/private-issues#642 CWE-269: Improper Privilege Management Generated by Claude Code Version Impact Vulnerable Range: v21.02 - v28.06.22-03 (current latest) Commits Introducing the Vulnerability: - ToolGroupResource._addUser (enables step): December 2020 - RoleAjax.addUserToRole (port-gated only): March 2012 Vulnerability Introduction Timeline ToolGroupResource._addToolGroupToUser: Never had an admin check - 2020-12-16: Method created without admin check - 2021-03-22: Added userId parameter, expanding the attack surface for self-assignment - 2025-11-04: Partial port-level mitigation (private-issues#482), insufficient - PR #36344: Full fix, gates addition only, not yet released in any version Red Team Review Security: Changes required Performance: Minor improvements Test Coverage: Improvements needed Security Details Critical: lacked an admin guard High: / used port checks instead of role-based checks High: coverage was removed Low: Removal of the self-assignment exception Performance Net positive change guard triggers in , before any layout/user DB reads—correct fast-fail ordering and both resolve on , which is on the hot path—negligible overhead Pre-existing anti-pattern in : triggers before admin check—not introduced by this PR Slight redundancy: calls the same CMS Admin role check—both are cache hits, pre-existing Test Coverage Non-admins blocked on Admins succeed on Non-admins blocked on (using port access) non-admin self-assignment allowed Non-admins blocked on Admins succeed on Non-admins blocked on Admins succeed on / Cross-user assignment blocked for non-admins called on unauthorized attempts Recommended Additions

Goal Reached Thanks to every supporter — we hit 100%!

dotCMS Privilege Escalation to RCE via OSGi Bundle Upload

More from this source