nuclei-templates/cves/2020/CVE-2020-0618.yaml

id: CVE-2020-0618

info:
  name: RCE in SQL Server Reporting Services
  author: joeldeleep
  description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
  severity: high
  # THIS TEMPLATE IS ONLY FOR DETECTING
  # To carry out further attacks, please see reference[1] below.
  # This template works by guessing user ID.
  reference:
    - https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/
    - https://github.com/euphrat1ca/CVE-2020-0618
  tags: cve,cve2020,rce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.80
    cve-id: CVE-2020-0618
    cwe-id: CWE-502

requests:
  - method: GET
    path:
      - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "view report"
        part: body
misc changes 2021-01-02 04:56:15 +00:00			`id: CVE-2020-0618`
Update cve-2020-0618.yaml 2020-09-28 19:32:19 +00:00
Create cve-2020-0618.yaml The template only scans for the respective vulnerable url , it has to be manually verified . 2020-09-28 01:52:37 +00:00			`info:`
Update cve-2020-0618.yaml 2020-09-28 02:01:06 +00:00			`name: RCE in SQL Server Reporting Services`
Create cve-2020-0618.yaml The template only scans for the respective vulnerable url , it has to be manually verified . 2020-09-28 01:52:37 +00:00			`author: joeldeleep`
Add description 2021-03-10 10:54:13 +00:00			`description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.`
Create cve-2020-0618.yaml The template only scans for the respective vulnerable url , it has to be manually verified . 2020-09-28 01:52:37 +00:00			`severity: high`
Added comments with URLs under the "references" field Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:15:35 +00:00			`# THIS TEMPLATE IS ONLY FOR DETECTING`
			`# To carry out further attacks, please see reference[1] below.`
			`# This template works by guessing user ID.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
References 2021-03-24 07:01:00 +00:00			`- https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/`
			`- https://github.com/euphrat1ca/CVE-2020-0618`
Added tags to cves :sunglasses: (#813) * Added tags to cves :sunglasses: 2021-02-05 19:44:41 +00:00			`tags: cve,cve2020,rce`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
			`cvss-score: 8.80`
			`cve-id: CVE-2020-0618`
			`cwe-id: CWE-502`
Create cve-2020-0618.yaml The template only scans for the respective vulnerable url , it has to be manually verified . 2020-09-28 01:52:37 +00:00
			`requests:`
			`- method: GET`
			`path:`
Update cve-2020-0618.yaml 2020-09-28 02:01:06 +00:00			`- "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx"`
Create cve-2020-0618.yaml The template only scans for the respective vulnerable url , it has to be manually verified . 2020-09-28 01:52:37 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 200`
			`- type: word`
			`words:`
			`- "view report"`
Update cve-2020-0618.yaml 2020-09-28 19:32:19 +00:00			`part: body`