BlogEngine.NET versions 3.3.7 and earlier are vulnerable to two separate directory traversal issues that can lead to remote code execution.
896d2eb6faeb95a5da1424a1b59ebe54BlogEngine.NET, versions 3.3.7 and earlier, is vulnerable to two separate
Directory Traversal issues that can lead to Remote Code Execution.
CVE-2019-10719 exploits a directory traversal in /api/upload, allowing
users to write files to any location within the web root. This bypasses
the protection added in version 3.3.7 to prevent CVE-2019-6714. A user,
with the ability to add images or files to posts, can upload a malicious
PostView.ascx file to the Themes folder. The code could then be triggered
by setting the theme parameter to the newly create folder.
CVE-2019-10720 exploits a directory traversal in the theme cookie to
trigger a remote code execution. A user, with the ability to add images or
files to posts, can upload a malicious PostView.ascx file, then trigger the
RCE by setting the theme cookie to ../../App_Data/files.
Disclosure at:
https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720