Attack Chain

1. Attacker gains valid editor credentials for the Redaxo CMS.
2. Attacker logs into the Redaxo CMS administration panel.
3. Attacker navigates to the Mediapool section.
4. Attacker attempts to upload a malicious PHP file (e.g., webshell.php) through the Mediapool upload functionality.
5. The CMS checks the file extension against a blacklist.
6. To bypass the blacklist, the attacker renames the file with an obfuscated extension like “webshell.php71” or “webshell.php53”.
7. The server accepts the file due to the bypassed extension check.
8. The attacker accesses the uploaded file through a direct HTTP request (e.g., http://example.com/redaxo/media/webshell.php71), triggering the execution of the malicious PHP code on the server.

Impact

Successful exploitation of this vulnerability grants the attacker the ability to execute arbitrary PHP code on the Redaxo CMS web server. This can lead to complete compromise of the server, including data theft, website defacement, or further lateral movement within the network. Given that the vulnerable versions are relatively old, systems that have not been regularly updated are most at risk.

Recommendation

• Upgrade the Redaxo CMS Mediapool Addon to a version greater than 5.5.1 to patch CVE-2018-25353.
• Implement stricter file extension validation on the server side, using a whitelist approach instead of a blacklist.
• Monitor web server logs for requests to unusual file extensions in the Mediapool directory using the Sigma rule provided.
• Implement the second Sigma rule to detect file uploads with suspicious extensions to the Mediapool.