Description
OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Openkm OpenKM Community Edition
Default version status: unknown
0 to ≤ 6.3.12affected
Openkm OpenKM Professional Edition
Default version status: unknown
0 to ≤ 7.1.47affected
References
- https://www.exploit-db.com/exploits/52520 ↗
- https://www.openkm.com/ ↗
- https://hub.docker.com/r/openkm/openkm-ce ↗
- https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs ↗
- https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits ↗
- https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-local-file-execution ↗
- https://www.vulncheck.com/advisories/openkm-local-file-inclusion-via-admin-scripting ↗