CVE-2022-26352: DotCMS ContentResource API RCE Vulnerability

CVE-2022-26352 Overview

A critical directory traversal vulnerability exists in the ContentResource API in dotCMS versions 3.0 through 22.02. This vulnerability allows attackers to craft a malicious multipart form request to upload a file with an unsanitized filename, enabling arbitrary file placement outside the intended storage location. When anonymous content creation is enabled, an unauthenticated attacker can exploit this flaw to upload executable files such as .jsp files, leading to remote code execution on the target server.

Critical Impact

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Unauthenticated attackers can achieve full remote code execution on vulnerable dotCMS installations.

Affected Products

• dotCMS versions 3.0 through 22.02
• dotCMS ContentResource API
• All dotCMS installations with anonymous content creation enabled

Discovery Timeline

• 2022-07-17 - CVE-2022-26352 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2022-26352

Vulnerability Analysis

This directory traversal vulnerability resides in the ContentResource API, which handles multipart form data for file uploads. The core issue stems from the API's failure to properly sanitize the filename parameter in multipart form requests before using it to determine the file storage path. An attacker can include directory traversal sequences (such as ../) in the filename to write files outside the intended upload directory.

The vulnerability is particularly dangerous because it enables arbitrary file upload combined with directory traversal. When anonymous content creation is enabled on the dotCMS instance, no authentication is required to exploit this flaw. An attacker can upload a malicious JSP webshell to a web-accessible directory, then execute it to gain command execution on the underlying server.

Root Cause

The root cause is improper input validation and missing sanitization of user-supplied filenames in the ContentResource API. When processing multipart form data, the API directly uses the attacker-controlled filename without stripping path traversal characters or validating that the resulting path remains within the designated upload directory. This violation of secure coding practices allows attackers to escape the intended storage location and place files in arbitrary directories on the file system.

Attack Vector

The attack is network-based and requires no user interaction or authentication when anonymous content creation is enabled. An attacker crafts a specially formatted multipart form request to the ContentResource API endpoint with a malicious filename containing directory traversal sequences.

The exploitation flow involves:

1. Identifying a vulnerable dotCMS instance with anonymous content creation enabled
2. Crafting a multipart POST request to the ContentResource API
3. Including a filename parameter with directory traversal sequences (e.g., ../../../webapps/ROOT/shell.jsp)
4. Embedding malicious JSP code as the file content
5. The server writes the file outside the intended directory to a web-accessible location
6. Accessing the uploaded webshell to execute arbitrary commands

A public exploit demonstrating this technique is available through Packet Storm Security.

Detection Methods for CVE-2022-26352

Indicators of Compromise

• Unexpected .jsp, .jspx, or other executable files appearing in web-accessible directories
• Multipart POST requests to ContentResource API endpoints containing ../ sequences in filenames
• New or modified files in directories outside the normal dotCMS upload locations
• Web server access logs showing requests to unexpected JSP files
• System process spawning from the Java/dotCMS application server process

Detection Strategies

• Monitor ContentResource API endpoints for multipart form submissions with suspicious filename parameters containing path traversal characters
• Implement file integrity monitoring on web-accessible directories to detect unauthorized file creation
• Deploy web application firewall (WAF) rules to block requests containing directory traversal patterns in multipart form data
• Analyze web server logs for POST requests to /api/content/ endpoints followed by GET requests to unusual file paths

Monitoring Recommendations

• Enable detailed logging for the ContentResource API and file upload operations
• Set up alerts for file creation events in sensitive directories such as webapps/ and document roots
• Monitor for outbound connections from the dotCMS server that may indicate webshell activity
• Review authentication logs for patterns indicating exploitation attempts on anonymous content creation endpoints

How to Mitigate CVE-2022-26352

Immediate Actions Required

• Upgrade dotCMS to a patched version beyond 22.02 immediately
• Disable anonymous content creation if not strictly required for business operations
• Implement WAF rules to block multipart requests containing directory traversal sequences
• Audit the file system for unauthorized files, particularly .jsp files in web-accessible directories
• Review access logs for evidence of prior exploitation attempts

Patch Information

Organizations should upgrade to a patched version of dotCMS that addresses the filename sanitization issue in the ContentResource API. Check the dotCMS Google Group for official security announcements and patch information. This vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, which mandates federal agencies remediate within specified timeframes.

Workarounds

• Disable anonymous content creation to require authentication for file uploads
• Implement network-level restrictions to limit access to the ContentResource API to trusted IP addresses only
• Deploy a reverse proxy or WAF configured to sanitize or block multipart requests with path traversal patterns
• Use file system permissions to prevent the dotCMS application from writing to sensitive directories

# Configuration example - Restrict API access via reverse proxy (nginx)
# Add to your dotCMS site configuration
location /api/content/ {
    # Deny anonymous access - require authentication
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    # Block directory traversal patterns
    if ($request_body ~* "\.\.\/") {
        return 403;
    }
    
    proxy_pass http://dotcms_backend;
}