Kentico - Installer Privilege Escalation

criticalseverity

9.8CVSS score

68.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.

Impact

An attacker can gain administrative privileges on the Kentico CMS system.

Fix

Upgrade to the latest version of Kentico CMS to fix the privilege escalation vulnerability.

How to confirm it

Send: GET {{BaseURL}}/CMSInstall/install.aspx
Positive when: contains "Kentico" and "Database Setup" and "SQLServer" OR contains "Database Setup" and "SQLServer"

Run it with nuclei: nuclei -id CVE-2017-17736 -u <target>

The full check

id: CVE-2017-17736

info:
  name: Kentico - Installer Privilege Escalation
  author: shiar
  severity: critical
  description: |
    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
  impact: |
    An attacker can gain administrative privileges on the Kentico CMS system.
  remediation: |
    Upgrade to the latest version of Kentico CMS to fix the privilege escalation vulnerability.
  reference:
    - https://www.exploit-db.com/ghdb/5694
    - https://nvd.nist.gov/vuln/detail/CVE-2017-17736
    - https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b
    - https://github.com/0xSojalSec/Nuclei-TemplatesNuclei-Templates-CVE-2017-17736
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-17736
    cwe-id: CWE-425
    epss-score: 0.68457
    epss-percentile: 0.99342
    cpe: cpe:2.3:a:kentico:kentico_cms:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: kentico
    product: kentico_cms
    shodan-query:
      - cpe:"cpe:2.3:a:kentico:kentico_cms"
      - http.title:"kentico database setup"
    fofa-query: title="kentico database setup"
    google-query: intitle:"kentico database setup"
  tags: cve2017,cve,kentico,cms,install,unauth,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/CMSInstall/install.aspx"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "Kentico"
          - "Database Setup"
          - "SQLServer"
        condition: and

      - type: word
        words:
          - "Database Setup"
          - "SQLServer"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from