57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: CVE-2020-16952
|
|
|
|
info:
|
|
name: Microsoft SharePoint - Remote Code Execution
|
|
author: dwisiswant0
|
|
severity: high
|
|
description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the SharePoint server.
|
|
remediation: |
|
|
Apply the latest security updates provided by Microsoft to address this vulnerability.
|
|
reference:
|
|
- https://srcincite.io/pocs/cve-2020-16952.py.txt
|
|
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
|
|
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
|
|
cvss-score: 8.6
|
|
cve-id: CVE-2020-16952
|
|
cwe-id: CWE-346
|
|
epss-score: 0.90937
|
|
epss-percentile: 0.98837
|
|
cpe: cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: microsoft
|
|
product: sharepoint_enterprise_server
|
|
tags: cve,cve2020,msf,sharepoint,iis,microsoft,ssi,rce
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
|
|
- "16\\.0\\.0\\.(10337|10364|10366)"
|
|
# - "16.0.10364.20001"
|
|
condition: or
|
|
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- "(?i)(Microsoftsharepointteamservices:)"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
- 201
|
|
condition: or
|
|
# digest: 4a0a00473045022100b7dadb5d3fb54a11dbd6440a48bb5cae9db0bfd08dcbec32a08eb7591c6d334e0220357176c8b9439ea772505c04b0752ca005c6da89011edc68685ff5e07be0e38f:922c64590222798bb761d5b6d8e72950 |