CVE-2017-17736
published 2018-03-23CVE-2017-17736: Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then…
PriorityP182critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
69.36%
99.3th percentile
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kentico | xperience | >= 10.0 < 10.0.48 | 10.0.48 |
| kentico | xperience | >= 9.0 < 9.0.51 | 9.0.51 |
Detection & IOCsextracted from sources · hover to see the quote
othertitle="kentico database setup"
otherintitle:"kentico database setup"
- →HTTP GET request to /CMSInstall/install.aspx; response containing all three strings 'Kentico', 'Database Setup', and 'SQLServer' indicates a vulnerable exposed installer endpoint.
- →Shodan query for exposed Kentico CMS instances: search for CPE 'cpe:2.3:a:kentico:kentico_cms' or HTTP title 'kentico database setup'.
- →Exploitation path: unauthenticated attacker visits /CMSInstall/install.aspx then navigates to the CMS Administration Dashboard to obtain Global Administrator access (CWE-425 forced browsing). ↗
- ·Vulnerability affects Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 only; patched versions are not exploitable via this path. ↗
- ·The Nuclei template uses an OR matcher condition — a response containing only 'Database Setup' and 'SQLServer' (without 'Kentico') is also flagged as a match, which may increase false-positive rate.
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Kentico - Installer Privilege Escalation
nuclei·CVSS 9.8
CVE-2017-17736 [CRITICAL] Kentico - Installer Privilege Escalation
Kentico - Installer Privilege Escalation
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
Template:
id: CVE-2017-17736
info:
name: Kentico - Installer Privilege Escalation
author: shiar
severity: critical
description: |
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
impact: |
An attacker can gain administrative privileges on the Kentico CMS system.
remediation: |
Upgrade to the latest version of Kenti
No writeups or analysis indexed.
2018-03-23
Published