CVE-2023-3042 Information

Oct 18, 2023 cve

Description

In dotCMS versions mentioned a flaw in the NormalizationFilter does not strip double slashes (//) from URLs potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp which should return a 404 response but didn’t.

The oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.javaL37 . 

To mitigate users can block URLs with double slashes at firewalls or utilize dotCMS config variables.

Specifically they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings.

Additionally the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control for instance to block //html. URLs.

Fix Version:23.06+ LTS 22.03.7+ LTS 23.01.4+

Reference

https://auth.dotcms.com/security/SI-68

Share on: