2021-01-02 04:56:15 +00:00
id : CVE-2020-16952
2020-10-14 08:49:48 +00:00
info :
2022-07-26 13:45:11 +00:00
name : Microsoft SharePoint - Remote Code Execution
2020-10-14 08:49:48 +00:00
author : dwisiswant0
2021-09-10 11:26:40 +00:00
severity : high
2022-07-26 13:45:11 +00:00
description : Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
2023-09-06 12:22:36 +00:00
remediation : |
Apply the latest security updates provided by Microsoft to address this vulnerability.
2021-08-18 11:37:49 +00:00
reference :
2021-03-11 15:06:39 +00:00
- https://srcincite.io/pocs/cve-2020-16952.py.txt
2022-04-25 23:43:33 +00:00
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
2021-03-11 15:06:39 +00:00
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
2022-07-26 13:45:11 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 7.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-16952
cwe-id : CWE-346
2023-11-20 05:10:39 +00:00
epss-score : 0.46024
epss-percentile : 0.97063
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-15 16:29:17 +00:00
vendor : microsoft
product : sharepoint_enterprise_server
tags : msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce
2020-10-14 08:49:48 +00:00
2023-04-27 04:28:59 +00:00
http :
2020-10-15 10:27:52 +00:00
- method : GET
2020-10-14 08:49:48 +00:00
path :
2021-01-13 07:31:46 +00:00
- "{{BaseURL}}"
2022-04-25 23:43:33 +00:00
2020-10-14 08:49:48 +00:00
matchers-condition : and
matchers :
2020-10-15 10:27:52 +00:00
- type : regex
2022-04-25 23:43:33 +00:00
part : body
2020-10-15 10:27:52 +00:00
regex :
2020-10-15 11:21:25 +00:00
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
- "16\\.0\\.0\\.(10337|10364|10366)"
2020-10-15 10:27:52 +00:00
# - "16.0.10364.20001"
condition : or
2022-04-25 23:43:33 +00:00
- type : regex
2020-10-15 10:27:52 +00:00
part : header
2022-04-25 23:43:33 +00:00
regex :
- "(?i)(Microsoftsharepointteamservices:)"
2020-10-14 08:49:48 +00:00
- type : status
status :
2020-10-15 10:27:52 +00:00
- 200
- 201
2022-01-04 19:34:16 +00:00
condition : or
2023-11-20 06:35:10 +00:00
# digest: 4b0a004830460221008ea49a67151a6198c623d7163b70afbe8b51b593d75e548d3007e777d50650dc022100a525c7bd59f1543774aac4e97b5f98a3fe59bbc851ff161e0f192cd64b155f72:922c64590222798bb761d5b6d8e72950
