diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 6e1811823b..bd73ae24b0 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -137594,7 +137594,7 @@ "Windows Dropper", "PowerShell Stager" ], - "mod_time": "2021-03-31 12:07:57 +0000", + "mod_time": "2021-06-14 10:15:27 +0000", "path": "/modules/exploits/windows/http/sharepoint_ssi_viewstate.rb", "is_install_path": true, "ref_name": "windows/http/sharepoint_ssi_viewstate", @@ -137617,6 +137617,71 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/http/sharepoint_unsafe_control": { + "name": "Microsoft SharePoint Unsafe Control and ViewState RCE", + "fullname": "exploit/windows/http/sharepoint_unsafe_control", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2021-05-11", + "type": "exploit", + "author": [ + "Unknown", + "Spencer McIntyre", + "wvu " + ], + "description": "The EditingPageParser.VerifyControlOnSafeList method fails to properly validate user supplied data. This\n can be leveraged by an attacker to leak sensitive information in rendered-preview content. This module will\n leak the ViewState validation key and then use it to sign a crafted object that will trigger code execution\n when deserialized.\n\n Tested against SharePoint 2019 and SharePoint 2016, both on Windows Server 2016.", + "references": [ + "CVE-2021-31181", + "ZDI-21-573", + "URL-https://www.zerodayinitiative.com/blog/2021/6/1/cve-2021-31181-microsoft-sharepoint-webpart-interpretation-conflict-remote-code-execution-vulnerability" + ], + "platform": "Windows", + "arch": "cmd, x86, x64", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Windows Command", + "Windows Dropper", + "PowerShell Stager" + ], + "mod_time": "2021-06-14 10:15:27 +0000", + "path": "/modules/exploits/windows/http/sharepoint_unsafe_control.rb", + "is_install_path": true, + "ref_name": "windows/http/sharepoint_unsafe_control", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_windows/http/sharepoint_workflows_xoml": { "name": "SharePoint Workflows XOML Injection", "fullname": "exploit/windows/http/sharepoint_workflows_xoml",