56 lines
2.0 KiB
YAML
56 lines
2.0 KiB
YAML
id: CVE-2020-16952
|
|
|
|
info:
|
|
name: Microsoft SharePoint - Remote Code Execution
|
|
author: dwisiswant0
|
|
severity: high
|
|
description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the SharePoint server.
|
|
remediation: |
|
|
Apply the latest security updates provided by Microsoft to address this vulnerability.
|
|
reference:
|
|
- https://srcincite.io/pocs/cve-2020-16952.py.txt
|
|
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
|
|
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
|
|
cvss-score: 8.6
|
|
cve-id: CVE-2020-16952
|
|
cwe-id: CWE-346
|
|
epss-score: 0.92144
|
|
epss-percentile: 0.9874
|
|
cpe: cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: microsoft
|
|
product: sharepoint_enterprise_server
|
|
tags: cve,cve2020,msf,sharepoint,iis,microsoft,ssi,rce
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
|
|
- "16\\.0\\.0\\.(10337|10364|10366)"
|
|
# - "16.0.10364.20001"
|
|
condition: or
|
|
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- "(?i)(Microsoftsharepointteamservices:)"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
- 201
|
|
condition: or
|
|
# digest: 490a00463044022044b5ecb2f32f150e6c8595313aa01995843b62add770f9e037fbf7e8546d7d82022026787cd3d789bcfb8164e79cac9be79ff3f7405299029bf5ee4d2a8278f6e0ef:922c64590222798bb761d5b6d8e72950 |