id: CVE-2020-0618

info:
  name: RCE in SQL Server Reporting Services
  author: joeldeleep
  description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
  severity: high
  reference: |
    - https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/
    - https://github.com/euphrat1ca/CVE-2020-0618
  tags: cve,cve2020,rce

  # THIS TEMPLATE IS ONLY FOR DETECTING
  # To carry out further attacks, please see reference[1] below.
  # This template works by guessing user ID.

requests:
  - method: GET
    path:
      - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "view report"
        part: body