56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
id: CVE-2020-16952
|
|
|
|
info:
|
|
name: Microsoft SharePoint - Remote Code Execution
|
|
author: dwisiswant0
|
|
severity: high
|
|
description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
|
|
remediation: |
|
|
Apply the latest security updates provided by Microsoft to address this vulnerability.
|
|
reference:
|
|
- https://srcincite.io/pocs/cve-2020-16952.py.txt
|
|
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
|
|
- https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-16952
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
cvss-score: 7.8
|
|
cve-id: CVE-2020-16952
|
|
cwe-id: CWE-346
|
|
epss-score: 0.46024
|
|
epss-percentile: 0.97063
|
|
cpe: cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: microsoft
|
|
product: sharepoint_enterprise_server
|
|
tags: msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "15\\.0\\.0\\.(4571|5275|4351|5056)"
|
|
- "16\\.0\\.0\\.(10337|10364|10366)"
|
|
# - "16.0.10364.20001"
|
|
condition: or
|
|
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- "(?i)(Microsoftsharepointteamservices:)"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
- 201
|
|
condition: or
|
|
|
|
# digest: 4b0a004830460221008ea49a67151a6198c623d7163b70afbe8b51b593d75e548d3007e777d50650dc022100a525c7bd59f1543774aac4e97b5f98a3fe59bbc851ff161e0f192cd64b155f72:922c64590222798bb761d5b6d8e72950
|