98346529ea
2 changes to exploits/shellcodes Pronestor Health Monitoring < 8.1.11.0 - Privilege Escalation Sitecore 8.x - Deserialization Remote Code Execution
14 lines
No EOL
798 B
Text
14 lines
No EOL
798 B
Text
# Exploit Title: Sitecore v 8.x Deserialization RCE
|
|
# Date: Reported to vendor October 2018, fix released April 2019.
|
|
# Exploit Author: Jarad Kopf
|
|
# Vendor Homepage: https://www.sitecore.com/
|
|
# Software Link: Sitecore downloads: https://dev.sitecore.net/Downloads.aspx
|
|
# Version: Sitecore 8.0 Revision 150802
|
|
# Tested on: Windows
|
|
# CVE : CVE-2019-11080
|
|
|
|
Exploit:
|
|
|
|
Authentication is needed for this exploit. An attacker needs to login to Sitecore 8.0 revision 150802's Admin section.
|
|
When choosing to Serializeusers or domains in the admin UI, calls to /sitecore/shell/~/xaml/Sitecore.Shell.Applications.Dialogs.Progress.aspx will include a CSRFTOKEN parameter.
|
|
By replacing this parameter with a URL-encoded, base64-encoded crafted payload from ysoserial.net, an RCE is successful. |