daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/misconfiguration/caddy-open-redirect.yaml

28 lines
896 B
YAML
Raw Normal View History

New Templates & Workflow (#3556) * Create secure-login-panel.yaml * Create geo-webserver.yaml * Create hp-virtual-connect-manager.yaml * Create microsoft-azure-error.yaml * Create microsoft-iis-8.yaml * Create veeam-backup-azure-panel.yaml * Create user-control-panel.yaml * Create kafka-consumer-monitor.yaml * Update kafka-consumer-monitor.yaml * Create kafka-connect-ui-exposure.yaml * misc updates * duplicate template existing one - `exposed-panels/kafka-connect-ui.yaml` * Create kafka-cruise-control.yaml * Create kafka-center-default-login.yaml * Create kafka-center-login.yaml * minor update * Create azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Create barracuda-panel.yaml * Update barracuda-panel.yaml * Update barracuda-panel.yaml * Create CVE-2021-24891.yaml * template meta info update * Delete CVE-2021-24891.yaml * Create caddy-open-redirect.yaml * Create concrete5-panel.yaml * Create concrete-workflow.yaml * updated matcher to avoid false negative results * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-01-19 07:51:15 +00:00
id: caddy-open-redirect
info:
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements
2022-10-19 21:11:27 +00:00
name: Caddy 2.4.6 Open Redirect
New Templates & Workflow (#3556) * Create secure-login-panel.yaml * Create geo-webserver.yaml * Create hp-virtual-connect-manager.yaml * Create microsoft-azure-error.yaml * Create microsoft-iis-8.yaml * Create veeam-backup-azure-panel.yaml * Create user-control-panel.yaml * Create kafka-consumer-monitor.yaml * Update kafka-consumer-monitor.yaml * Create kafka-connect-ui-exposure.yaml * misc updates * duplicate template existing one - `exposed-panels/kafka-connect-ui.yaml` * Create kafka-cruise-control.yaml * Create kafka-center-default-login.yaml * Create kafka-center-login.yaml * minor update * Create azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Create barracuda-panel.yaml * Update barracuda-panel.yaml * Update barracuda-panel.yaml * Create CVE-2021-24891.yaml * template meta info update * Delete CVE-2021-24891.yaml * Create caddy-open-redirect.yaml * Create concrete5-panel.yaml * Create concrete-workflow.yaml * updated matcher to avoid false negative results * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-01-19 07:51:15 +00:00
author: dhiyaneshDK
severity: medium
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements
2022-10-19 21:11:27 +00:00
description: Caddy 2.4.6 contains an open redirect vulnerability via php_fastcgi. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://github.com/caddyserver/caddy/issues/4502
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements
2022-10-19 21:11:27 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cwe-id: CWE-601
New Templates & Workflow (#3556) * Create secure-login-panel.yaml * Create geo-webserver.yaml * Create hp-virtual-connect-manager.yaml * Create microsoft-azure-error.yaml * Create microsoft-iis-8.yaml * Create veeam-backup-azure-panel.yaml * Create user-control-panel.yaml * Create kafka-consumer-monitor.yaml * Update kafka-consumer-monitor.yaml * Create kafka-connect-ui-exposure.yaml * misc updates * duplicate template existing one - `exposed-panels/kafka-connect-ui.yaml` * Create kafka-cruise-control.yaml * Create kafka-center-default-login.yaml * Create kafka-center-login.yaml * minor update * Create azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Create barracuda-panel.yaml * Update barracuda-panel.yaml * Update barracuda-panel.yaml * Create CVE-2021-24891.yaml * template meta info update * Delete CVE-2021-24891.yaml * Create caddy-open-redirect.yaml * Create concrete5-panel.yaml * Create concrete-workflow.yaml * updated matcher to avoid false negative results * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-01-19 07:51:15 +00:00
tags: redirect,caddy,server
requests:
- method: GET
path:
Fixed possible FPs in open redirect templates (#4544) * Fixed possible FPs in open redirect templates We have replaced example.com with interact.sh since few domains redirect to example.com, which results in FP results. * updated example domain Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-06-06 10:40:15 +00:00
- '{{BaseURL}}//interact.sh/%2F..'
New Templates & Workflow (#3556) * Create secure-login-panel.yaml * Create geo-webserver.yaml * Create hp-virtual-connect-manager.yaml * Create microsoft-azure-error.yaml * Create microsoft-iis-8.yaml * Create veeam-backup-azure-panel.yaml * Create user-control-panel.yaml * Create kafka-consumer-monitor.yaml * Update kafka-consumer-monitor.yaml * Create kafka-connect-ui-exposure.yaml * misc updates * duplicate template existing one - `exposed-panels/kafka-connect-ui.yaml` * Create kafka-cruise-control.yaml * Create kafka-center-default-login.yaml * Create kafka-center-login.yaml * minor update * Create azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Update azure-kubernetes-service.yaml * Create barracuda-panel.yaml * Update barracuda-panel.yaml * Update barracuda-panel.yaml * Create CVE-2021-24891.yaml * template meta info update * Delete CVE-2021-24891.yaml * Create caddy-open-redirect.yaml * Create concrete5-panel.yaml * Create concrete-workflow.yaml * updated matcher to avoid false negative results * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-01-19 07:51:15 +00:00
matchers:
- type: regex
part: header
regex:
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements
2022-10-19 21:11:27 +00:00
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
# Enhanced by md on 2022/10/14