Create sitecore_xp_cve_2025_27218.rb #19947
Conversation
| ]) | ||
| end | ||
|
|
||
| def exploit |
There was a problem hiding this comment.
For a def check method, we could have:
- A sleep command, then checking if the response from the server comes back after the
sleeptime. This would only work if the server execution is synchronous. - If we can make sure the website is
Sitecoreand perform a version check from the response/page body, we could have areturns CheckCode::Detectedas a check result.
|
|
||
|
|
||
| # Build HTTP request with malicious header | ||
| res = send_request_cgi({ |
There was a problem hiding this comment.
The indentation here is a little off.
Seeing how the linting workflow is also currently failing, we can run rubocop on the module in the metasploit-framework directory (might need to prefix the rubocop command with bundle exec):
1 file inspected, 41 offenses detected, 40 offenses autocorrectable
modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb - [ERROR] Rubocop failed. Please run rubocop -a modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb and verify all issues are resolved
| { | ||
| 'Arch' => ARCH_CMD, | ||
| 'Type' => :windows_command, | ||
| 'Space' => 3000, |
There was a problem hiding this comment.
| 'Space' => 3000, |
| 'Platform' => 'win', | ||
| 'Arch' => [ARCH_X86, ARCH_X64], | ||
| #I don't know why these are the only payloads that worked. | ||
| 'Targets' => [ |
There was a problem hiding this comment.
Would a Windows Fetch payload work here, with the default curl option?
| 'DisclosureDate' => '2025-01-06', | ||
| 'DefaultTarget' => 0, | ||
| 'Platform' => 'win', | ||
| 'Arch' => [ARCH_X86, ARCH_X64], |
There was a problem hiding this comment.
We use ARCH_CMD as a Windows Command target, so we can add it here:
| 'Arch' => [ARCH_X86, ARCH_X64], | |
| 'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD], |
|
|
||
|
|
||
| 'DefaultOptions' => { | ||
| 'RPORT' => 443, |
There was a problem hiding this comment.
| 'RPORT' => 443, |
bwatters-r7
added
module
rn-modules
|
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
Module exploits CVE-2025-27217, a .NET deserialization vulnerability for Sitecore.
Couldn't figure out any checks.
All it does is generate a serialized .NET object with the payload in it, then sends it in a HTTP header.
The exploit works when browsing to Sitecore pages, so any HTTP status code other than 200 in the response most likely means the request failed.