Masa CMS Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6. The issue arises in the addParam function, which processes user input through the criteria parameter. This input is then evaluated by setDynamicContent, enabling an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is present in versions 7.4.5 and earlier.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Masa CMS is hosted.

Reproduction

To reproduce this vulnerability, send a GET request to the Masa CMS JSON API v1 default endpoint. Include a payload in the ids parameter that uses the m tag to execute a command, such as sleep for 5 seconds. The server's delayed response will indicate successful exploitation.

Remediation

Users can upgrade to Masa CMS versions 7.4.6, 7.3.13, or 7.2.8 to address this vulnerability.