nuclei-templates/http/cves/2017/CVE-2017-7269.yaml

56 lines
1.9 KiB
YAML
Raw Normal View History

2021-02-24 18:11:44 +00:00
id: CVE-2017-7269
2021-02-24 13:29:23 +00:00
info:
name: Windows Server 2003 & IIS 6.0 - Remote Code Execution
2021-06-09 12:20:56 +00:00
author: thomas_from_offensity,geeknik
2021-02-24 13:29:23 +00:00
severity: critical
description: |
Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
2023-09-06 13:22:34 +00:00
remediation: |
Upgrade to a supported version of Windows Server and IIS, or apply the necessary security patches.
2021-05-09 15:43:32 +00:00
reference:
2021-05-09 15:16:07 +00:00
- https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
- https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
- https://nvd.nist.gov/vuln/detail/CVE-2017-7269
- https://github.com/edwardz246003/IIS_exploit
2023-07-15 16:29:17 +00:00
- http://www.securitytracker.com/id/1038168
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2017-7269
cwe-id: CWE-119
epss-score: 0.97121
epss-percentile: 0.99732
2023-09-06 13:22:34 +00:00
cpe: cpe:2.3:a:microsoft:internet_information_server:6.0:*:*:*:*:*:*:*
metadata:
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: microsoft
product: internet_information_server
tags: cve,cve2017,rce,windows,iis,kev
2021-02-24 13:29:23 +00:00
http:
2021-02-24 13:29:23 +00:00
- method: OPTIONS
path:
- "{{BaseURL}}"
2021-05-09 17:20:07 +00:00
2021-02-24 13:29:23 +00:00
matchers-condition: and
matchers:
2023-07-11 19:49:27 +00:00
- type: dsl
dsl:
- regex("<DAV:sql>", dasl)
- regex("[\d]+(,\s+[\d]+)?", dav)
- regex(".*?PROPFIND", public)
- regex(".*?PROPFIND", allow)
condition: or
2021-02-24 13:29:23 +00:00
- type: word
part: header
2021-02-24 13:29:23 +00:00
words:
- "IIS/6.0"
2021-05-09 17:20:07 +00:00
- type: status
status:
- 200
# digest: 4b0a00483046022100d832f21e28b2fd2896fbac2a34906a47f973ad0a92cdc3b4c7140b603957a4120221008f1a7607a67b82eb944bd6e63ec7dcc038ea27a6934ae7dff2e04198aed194db:922c64590222798bb761d5b6d8e72950