Sitefinity CMS Arbitrary File Upload - Nessus

High   Plugin ID: 51119

This page contains detailed information about the Sitefinity CMS Arbitrary File Upload Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Table Of Contents
hide

Plugin Overview

ID: 51119
Name: Sitefinity CMS Arbitrary File Upload
Filename: sitefinity_3_7_2057.nasl
Vulnerability Published: 2010-11-17
This Plugin Published: 2010-12-10
Last Modification Time: 2021-01-19
Plugin Version: 1.6
Plugin Type: remote
Plugin Family: CGI abuses
Dependencies: sitefinity_detect.nasl
Required KB Items [?]: www/sitefinity
Excluded KB Items: Settings/disable_cgi_scanning

Vulnerability Information

Severity: High
Vulnerability Published: 2010-11-17
Patch Published: 2010-11-17
CVE [?]: N/A
CPE [?]: N/A

Synopsis

An ASP.NET application hosted on the remote web server may be affected by an arbitrary file upload vulnerability.

Description

The Sitefinity ASP.NET CMS install hosted on the remote web server may be affected by an arbitrary file upload vulnerability because it does not properly sanitize input data.

Note that Nessus did not actually test for the flaw but instead has relied on the version in Sitefinity's banner.

Solution

Upgrade to Sitefinity 3.7.2057 or later.

Public Exploits

Target Network Port(s): 80
Target Asset(s): Services/www
Exploit Available: True (Exploit-DB)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Sitefinity CMS Arbitrary File Upload vulnerability:

  1. Exploit-DB: exploits/asp/webapps/15563.txt
    [EDB-15563: Sitefinity CMS - 'ASP.NET' Arbitrary File Upload]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:U/RC:ND
CVSS Base Score:7.5 (High)
Impact Subscore:6.4
Exploitability Subscore:10.0
CVSS Temporal Score:7.1 (High)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:7.1 (High)

Go back to menu.

Plugin Source

This is the sitefinity_3_7_2057.nasl nessus plugin source code. This script is Copyright (C) 2010-2021 Tenable Network Security, Inc. 

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#


if (NASL_LEVEL < 3000) exit(1);


include('deprecated_nasl_level.inc');
include('compat.inc');


if (description)
{
  script_id(51119);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/19");

  script_bugtraq_id(44911);
  script_xref(name:"EDB-ID", value:"15563");

  script_name(english:"Sitefinity CMS Arbitrary File Upload");
  script_summary(english:"Checks version of Sitefinity CMS");

  script_set_attribute(
    attribute:"synopsis",
    value:
"An ASP.NET application hosted on the remote web server may be
affected by an arbitrary file upload vulnerability."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The Sitefinity ASP.NET CMS install hosted on the remote web server
may be affected by an arbitrary file upload vulnerability because it
does not properly sanitize input data.

Note that Nessus did not actually test for the flaw but instead has
relied on the version in Sitefinity's banner."
  );
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5061bc33");
  script_set_attribute(attribute:"solution", value:"Upgrade to Sitefinity 3.7.2057 or later.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:U/RC:ND");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/11/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/11/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/12/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.");

  script_dependencies("sitefinity_detect.nasl");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);
  script_require_keys("www/sitefinity");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");

port = get_http_port(default:80, asp:TRUE);
install = get_install_from_kb(appname:'sitefinity', port:port, exit_on_fail:TRUE);
dir = install['dir'];

if (install['ver'] == UNKNOWN_VER)
  exit(1, "Sitefinity was detected on port "+port+" but the version could not be determined.");

# Remove ':{num}' from the end of the version string
version = install['ver'] - strstr(install['ver'], ":");

if (ver_compare(ver:version, fix:'3.7.2057', strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Install location  : ' + build_url(port:port, qs:dir+'/sitefinity/login.aspx') +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 3.7.2057.0\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
}
else exit(0, "The Sitefinity CMS install at "+build_url(port:port, qs:dir+'/sitefinity/login.aspx')+" is version "+version+" and thus not affected.");

The latest version of this script can be found in these locations depending on your platform:

  • Linux / Unix:
    /opt/nessus/lib/nessus/plugins/sitefinity_3_7_2057.nasl
  • Windows:
    C:\ProgramData\Tenable\Nessus\nessus\plugins\sitefinity_3_7_2057.nasl
  • Mac OS X:
    /Library/Nessus/run/lib/nessus/plugins/sitefinity_3_7_2057.nasl

Go back to menu.

How to Run

Here is how to run the Sitefinity CMS Arbitrary File Upload as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

  1. Click to start a New Scan.
  2. Select Advanced Scan.
  3. Navigate to the Plugins tab.
  4. On the top right corner click to Disable All plugins.
  5. On the left side table select CGI abuses plugin family.
  6. On the right side table select Sitefinity CMS Arbitrary File Upload plugin ID 51119.
  7. Specify the target on the Settings tab and click to Save the scan.
  8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl sitefinity_3_7_2057.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a sitefinity_3_7_2057.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - sitefinity_3_7_2057.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state sitefinity_3_7_2057.nasl -t <IP/HOST>

Go back to menu.

References

BID | SecurityFocus Bugtraq ID: See also: Similar and related Nessus plugins:
  • 130263 - Adobe ColdFusion File Upload (APSB18-33) (CVE-2018-15961)
  • 39790 - Adobe ColdFusion FCKeditor 'CurrentFolder' File Upload
  • 16061 - e107 Image Manager Unauthorized File Upload
  • 39806 - FCKeditor 'CurrentFolder' Arbitrary File Upload
  • 21780 - FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
  • 69273 - Joomla! 2.5.x < 2.5.14 / 3.x < 3.1.5 .php. File Upload RCE
  • 64470 - Collector Component for Joomla! File Upload RCE
  • 79420 - Creative Contact Form Component for Joomla! File Upload RCE
  • 25736 - Expose for Joomla! File Upload RCE
  • 118310 - jQuery-File-Upload Arbitrary File Upload Vulnerability (Remote Check)
  • 58654 - Lenovo ThinkManagement Console RunAMTCommand Operation -PutUpdateFileCore Command Parsing Arbitrary File Upload
  • 22367 - Limbo Contact Component (com_contact) contact.html.php contact_attach Unrestricted File Upload
  • 82078 - ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)
  • 82079 - ManageEngine Desktop Central Arbitrary File Upload and RCE (Safe Check)
  • 71217 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)
  • 71218 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload
  • 143600 - ManageEngine ServiceDesk Plus < 10.0 Build 10012 Arbitrary File Upload
  • 63638 - MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite
  • 47581 - Novell 'modulemanager' Servlet Arbitrary File Upload (intrusive check)
  • 47582 - Novell 'modulemanager' Servlet Arbitrary File Upload (safe check)
  • 66914 - Novell ZENworks Control Center File Upload Remote Code Execution (intrusive check)
  • 35261 - OneOrZero Helpdesk tinfo.php Arbitrary File Upload
  • 49271 - OpenX Open Flash Chart ofc_upload_image.php File Upload Arbitrary Code Execution
  • 22303 - TikiWiki jhot.php Arbitrary File Upload
  • 56735 - TimThumb Cache Directory 'src' Parameter Arbitrary PHP File Upload
  • 61517 - Umbraco codeEditorSave.asmx SaveDLRScript Operation Traversal File Upload Arbitrary Command Execution
  • 80083 - Visual Mining NetCharts Server Arbitrary File Upload
  • 105732 - Western Digital MyCloud Unauthenticated File Upload
  • 79421 - Creative Contact Form Plugin for WordPress File Upload RCE
  • 76526 - MailPoet Newsletters for WordPress Arbitrary File Upload
  • 105372 - WP Symposium Plugin Arbitrary File Upload
  • 160208 - WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464)

Version

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file sitefinity_3_7_2057.nasl version 1.6. For more plugins, visit the Nessus Plugin Library.

Go back to menu.