PCRE in Sitecore CMS CSRFTOKEN Deserialization sid:2061119 for CVE-2019-9874

Rule Signatures
, ,
1

Hi, Friends!

The PoC payload snippet disclosed in https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf is a base64 encoded string.
“__CSRFTOKEN=/wEysRIAAQAAAP////8BAAAAAAAAAAwCAAAASVN5c3RlbSwgVmVyc2lvbj00[…]”

However, the alphanumeric section of the pcre:"/^[a-fA-F0-9\x2f\x2b\x3d]{32}/R" in the newly created sid:2061119 is limited to HEX characters and will not alert on the payload in its reference.

I was able to trigger an alert against the PoC payload, and newly generated ysoserialdotnet payloads, using the b64 character set with pcre:"/^[a-zA-Z0-9\x2f\x2b\x3d]{32}/R".

Yours, always and forever.
Rampage

2 Likes
2

Hey, this is Tony. Yeah, that’s definitely a problem. I got some lines crossed with some other work I was doing, and I didn’t use the same payload as what was listed in the reference document when I reproduced it, but it managed to trigger anyway, oddly enough. But I’ve since fixed it, and that should go live to tonight.

Thanks,

Tony

3 Likes