CVE-2020-3956
HIGHVMware Cloud Director 9.5.0.0-9.5.0.5 - Authenticated Remote Code Execution via Expression Language Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-3956. PoCs published by aaronsvk.
AI-analyzed exploit summary This exploit leverages an Expression Injection vulnerability in VMware vCloud Director to achieve Remote Code Execution (RCE) by injecting a malicious payload into the SMTP host name field. The payload uses Java reflection to execute arbitrary commands on the target system.
Description
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.
Exploits (2)
This exploit leverages an Expression Injection vulnerability in VMware vCloud Director to achieve Remote Code Execution (RCE) by injecting a malicious payload into the SMTP host name field. The payload uses Java reflection to execute arbitrary commands on the target system.
This repository contains a functional exploit for CVE-2020-3956, a remote code execution vulnerability in VMware Cloud Director. The exploit leverages an expression injection flaw in the SMTP host configuration to execute arbitrary commands on the target system.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H