55 lines
1.8 KiB
YAML
55 lines
1.8 KiB
YAML
id: CVE-2020-16952
|
|
|
|
info:
|
|
name: Microsoft SharePoint - Remote Code Execution
|
|
author: dwisiswant0
|
|
severity: high
|
|
description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
|
|
remediation: |
|
|
Apply the latest security updates provided by Microsoft to address this vulnerability.
|
|
reference:
|
|
- https://srcincite.io/pocs/cve-2020-16952.py.txt
|
|
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
|
|
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
cvss-score: 7.8
|
|
cve-id: CVE-2020-16952
|
|
cwe-id: CWE-346
|
|
epss-score: 0.40267
|
|
epss-percentile: 0.96914
|
|
cpe: cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: microsoft
|
|
product: sharepoint_enterprise_server
|
|
tags: msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
|
|
- "16\\.0\\.0\\.(10337|10364|10366)"
|
|
# - "16.0.10364.20001"
|
|
condition: or
|
|
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- "(?i)(Microsoftsharepointteamservices:)"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
- 201
|
|
condition: or
|
|
|
|
# digest: 490a00463044022017ba9e589c740c802be68f3265e1c35af123ded29966d85800ce3965fd7cfae802206e8714badb33bf4706250b3f55d0a875ecf5a59f64b46f0936b56f9293e97478:922c64590222798bb761d5b6d8e72950 |