Camaleon-CMS Vulnerability Analysis: Authenticated RCE, SSTI, and Privilege Escalation Chain

Here is a summary of the key vulnerability information from the webpage screenshot: --- Vulnerability Overview In the HackTheBox "Facts" machine (based on camaleon-cms), the author discovered multiple undisclosed vulnerabilities. By chaining these vulnerabilities, a complete attack chain was established to escalate privileges from a regular user to an administrator. Furthermore, additional high-severity vulnerabilities were identified in a local reproduction environment. --- Scope of Impact Target System: camaleon-cms (version 2.9.1) Impact Levels: - Regular User → Administrator Privileges (via vulnerability chain) - Administrator → Remote Code Execution (RCE), SQL Injection, SSTI, Stored XSS, etc. CVSS Score: Some vulnerabilities score 6.5 (e.g., SQL Injection); when combined with other vulnerabilities, they can escalate to high or critical severity. --- Remediation Steps 1. Fix Custom Field: Prohibit non-administrators from using the field. 2. Fix Broken Access Control: Restrict low-privilege users from accessing administrative endpoints such as . 3. Fix Stored XSS: Cleanse the Before HTML text box in the plugin and filter out script tags. 4. Fix SQL Injection: Implement strict input filtering and parameterized queries for input. 5. Fix SSTI via : Disable template rendering functionality in the setting, or restrict SMTP server configuration. 6. Fix Stored XSS via Draft Post Title: Escape or filter malicious payloads such as within draft titles. 7. Fix RCE: Prevent strings starting with from being parsed as ERB templates. --- POC / Exploit Code 1. Authenticated RCE Exploit (Python) > See the author's GitHub repository for the full script: Authenticated RCE Exploit --- 2. Stored XSS Payload (Draft Post Title) > Injected when creating a draft post via POST request; triggers cookie theft when an administrator views the draft. --- 3. SSTI + SMTP Configuration Exploitation > When SMTP returns an error containing , it triggers ERB template rendering, allowing the reading of . --- 4. RCE Exploit (Python) > See the author's GitHub repository for the full script: Second RCE Exploit --- Summary This research reveals multiple vulnerabilities in camaleon-cms, including unauthorized access, injection flaws, XSS, and RCE. A carefully constructed attack chain can achieve complete penetration from low-privilege to high-privilege access. It is recommended to immediately upgrade to a patched version or apply the remediation measures listed above. --- Note: All vulnerabilities were independently discovered by the author and submitted to DEF CON Group Prishtina. Do not use for illegal purposes before public disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Camaleon-CMS Vulnerability Analysis: Authenticated RCE, SSTI, and Privilege Escalation Chain