Sitecore 8.x – Deserialization Remote Code Execution

Exploit Database
141 阅读

作者： Jarad Kopf

日期： 2019-06-13
类别：
- webapps
平台：
- aspx
来源：https://www.exploit-db.com/exploits/46987/

# Exploit Title: Sitecore v 8.x Deserialization RCE

# Date: Reported to vendor October 2018, fix released April 2019.

# Exploit Author: Jarad Kopf

# Vendor Homepage: https://www.sitecore.com/

# Software Link: Sitecore downloads: https://dev.sitecore.net/Downloads.aspx

# Version: Sitecore 8.0 Revision 150802

# Tested on: Windows

# CVE : CVE-2019-11080

Exploit:

Authentication is needed for this exploit. An attacker needs to login to Sitecore 8.0 revision 150802's Admin section.

When choosing to Serializeusers or domains in the admin UI, calls to /sitecore/shell/~/xaml/Sitecore.Shell.Applications.Dialogs.Progress.aspx will include a CSRFTOKEN parameter.

By replacing this parameter with a URL-encoded, base64-encoded crafted payload from ysoserial.net, an RCE is successful.

last Exploits
Sitecore 8.x – Deserialization Remote Code Execution的更多信息

ContaoCMS (aka TYPOlight) 2.11 – Cross-Site Request Forgery (Delete Admin / Delete Article)：
JE Ajax Event Calendar – Local File Inclusion：
Zyncro 3.0.1.20 – Social Network Message Menu SQL Injection：
Joomla! Component FocalPoint 1.2.3 – SQL Injection：
Wing FTP Server Admin 4.4.5 – Multiple Vulnerabilities：
NASdeluxe NDL-2400r 2.01.09 – OS Command Injection：
Belkin F9K1122v1 1.00.30 – Buffer Overflow (via Cross-Site Request Forgery)：
Manage Engine Asset Explorer 6.1.0 Build: 6110 – Cross-Site Request Forgery：