CVE-2017-7322
HighSummary
MODX Revolution versions 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers in the update and package-installation features, allowing man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.
Risk Assessment
The lack of SSL certificate verification poses a serious security risk, enabling attackers to potentially take control of the system and execute malicious code.
Recommendation
It is recommended to upgrade to a newer version of MODX Revolution that improves SSL certificate verification and to implement additional security measures to protect against man-in-the-middle attacks.
Other vulnerabilities in MODX Revolution
See all- CVE-2017-1000067High
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method, allowing authenticated users to access the database and possibly escalate privileges.
- CVE-2017-9069High
In MODX Revolution before version 2.5.7, a user with file upload permissions can execute arbitrary code by uploading a file named .htaccess.
- CVE-2017-9067High
In MODX Revolution before version 2.5.7, when using PHP 5.3.3, an attacker can include and execute arbitrary files on the web server due to insufficient validation of the action parameter in setup/index.php, leading to a directory traversal attack.
- CVE-2016-10039High
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted dir parameter.
- CVE-2016-10038High
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted dir parameter.
- CVE-2016-10037High
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted id (also known as dir) parameter.
- CVE-2014-2736High
Multiple SQL injection vulnerabilities in MODX Revolution before version 2.2.14 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit the session ID (PHPSESSID) in index.php or user parameters in connectors/security/message.php and id in manager/index.php.
- CVE-2014-2311High
SQL injection vulnerability in modx.class.php in MODX Revolution versions 2.0.0 to 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2017-7324Critical
The findcore.php file in MODX Revolution version 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.
- CVE-2017-7321Critical
In MODX Revolution version 2.5.4-pl and earlier, the setup/controllers/welcome.php file allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.
Original NVD description (English source)
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.