Exploit matérialisé

CVE-2020-16952

CRITICAL

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei high Vérifié

Source

Microsoft SharePoint - Remote Code Execution

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2020-16952 -u https://your-target

Template yaml

id: CVE-2020-16952

info:
  name: Microsoft SharePoint - Remote Code Execution
  author: dwisiswant0
  severity: high
  description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the SharePoint server.
  remediation: |
    Apply the latest security updates provided by Microsoft to address this vulnerability.
  reference:
    - https://srcincite.io/pocs/cve-2020-16952.py.txt
    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
    - https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
    - https://nvd.nist.gov/vuln/detail/CVE-2020-16952
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
    cvss-score: 8.6
    cve-id: CVE-2020-16952
    cwe-id: CWE-346
    epss-score: 0.71095
    epss-percentile: 0.99359
    cpe: cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: microsoft
    product: sharepoint_enterprise_server
  tags: cve,cve2020,msf,sharepoint,iis,microsoft,ssi,rce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "15\\.0\\.0\\.(4571|5275|4351|5056)"
          - "16\\.0\\.0\\.(10337|10364|10366)"
          # - "16.0.10364.20001"
        condition: or

      - type: regex
        part: header
        regex:
          - "(?i)(Microsoftsharepointteamservices:)"

      - type: status
        status:
          - 200
          - 201
        condition: or
# digest: 4b0a00483046022100e222eddce87aa8a7d9eb027c5744004608da33f516a66a319514bcbb2a2b115c02210088bcfb57658c8293c71a4d17b3d7a195382a8eea010cb98d5ca3482374476a4c:922c64590222798bb761d5b6d8e72950