50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
id: CVE-2020-16952
|
|
|
|
info:
|
|
name: Microsoft SharePoint - Remote Code Execution
|
|
author: dwisiswant0
|
|
severity: high
|
|
description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
|
|
reference:
|
|
- https://srcincite.io/pocs/cve-2020-16952.py.txt
|
|
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
|
|
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
cvss-score: 7.8
|
|
cve-id: CVE-2020-16952
|
|
cwe-id: CWE-346
|
|
epss-score: 0.23324
|
|
tags: msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce
|
|
metadata:
|
|
max-request: 1
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
|
|
- "16\\.0\\.0\\.(10337|10364|10366)"
|
|
# - "16.0.10364.20001"
|
|
condition: or
|
|
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- "(?i)(Microsoftsharepointteamservices:)"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
- 201
|
|
condition: or
|
|
|
|
# Enhanced by mp on 2022/07/13
|