2021-01-02 04:56:15 +00:00
id : CVE-2020-16952
2020-10-14 08:49:48 +00:00
info :
2022-07-26 13:45:11 +00:00
name : Microsoft SharePoint - Remote Code Execution
2020-10-14 08:49:48 +00:00
author : dwisiswant0
2021-09-10 11:26:40 +00:00
severity : high
2022-07-26 13:45:11 +00:00
description : Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
2021-08-18 11:37:49 +00:00
reference :
2021-03-11 15:06:39 +00:00
- https://srcincite.io/pocs/cve-2020-16952.py.txt
2022-04-25 23:43:33 +00:00
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
2021-03-11 15:06:39 +00:00
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
2022-07-26 13:45:11 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 7.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-16952
cwe-id : CWE-346
2023-04-12 10:55:48 +00:00
epss-score : 0.23324
2022-08-27 04:41:18 +00:00
tags : msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2020-10-14 08:49:48 +00:00
2023-04-27 04:28:59 +00:00
http :
2020-10-15 10:27:52 +00:00
- method : GET
2020-10-14 08:49:48 +00:00
path :
2021-01-13 07:31:46 +00:00
- "{{BaseURL}}"
2022-04-25 23:43:33 +00:00
2020-10-14 08:49:48 +00:00
matchers-condition : and
matchers :
2020-10-15 10:27:52 +00:00
- type : regex
2022-04-25 23:43:33 +00:00
part : body
2020-10-15 10:27:52 +00:00
regex :
2020-10-15 11:21:25 +00:00
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
- "16\\.0\\.0\\.(10337|10364|10366)"
2020-10-15 10:27:52 +00:00
# - "16.0.10364.20001"
condition : or
2022-04-25 23:43:33 +00:00
- type : regex
2020-10-15 10:27:52 +00:00
part : header
2022-04-25 23:43:33 +00:00
regex :
- "(?i)(Microsoftsharepointteamservices:)"
2020-10-14 08:49:48 +00:00
- type : status
status :
2020-10-15 10:27:52 +00:00
- 200
- 201
2022-01-04 19:34:16 +00:00
condition : or
2022-07-26 13:45:11 +00:00
# Enhanced by mp on 2022/07/13
