cbcvebase.
CVE-2021-38147
published 2021-11-29

CVE-2021-38147: Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information…

PriorityP274high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
53.01%
98.8th percentile
Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.

Affected

1 ranges
VendorProductVersion rangeFixed in
wiproholmes——

Detection & IOCsextracted from sources · hover to see the quote

path/processexecution/DownloadExcelFile/Domain_Credential_Report_Excel↗
path/processexecution/DownloadExcelFile/User_Report_Excel↗
path/processexecution/DownloadExcelFile/Process_Report_Excel↗
path/processexecution/DownloadExcelFile/Infrastructure_Report_Excel↗
path/processexecution/DownloadExcelFile/Resolver_Report_Excel↗
yara
rule CVE_2021_38147_Holmes_InfoDisc { strings: $path1 = "/processexecution/DownloadExcelFile/" $ct = "application/vnd.openxml" $cd = "attachment; filename=" condition: $path1 and $ct and $cd }
  • →Response body containing '<?xml version=' alongside the OOXML content-type header confirms a valid Excel report was returned without authentication.
  • →FOFA/Shodan fingerprint for exposed instances: search for title="Holmes Orchestrator" to identify targets.
  • →The vulnerability affects exactly version 20.4.1 (build 20.4.1_02_11_2020); version strings in HTTP responses or banners can confirm a vulnerable target. ↗
  • ·The Nuclei template uses stop-at-first-match across 4 paths, meaning only the first successful endpoint is confirmed; all five paths (including User_Report_Excel) should be tested independently for full coverage.
  • ·The template probes only 4 of the 5 vulnerable endpoints (User_Report_Excel is omitted from the path list despite being listed in the CVE description).

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.