nuclei-templates/network/detection/dropbear-cbc-ciphers.yaml

id: dropbear-cbc-ciphers

info:
  name: Dropbear sshd CBC Mode Ciphers Detection
  author: pussycat0x
  severity: low
  description: |
    The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.
  reference: |
    https://www.tenable.com/plugins/nessus/70658
  remediation: |
    Disable CBC Ciphers.
  metadata:
    max-request: 1
    shodan-query: product:"Dropbear sshd"
    verified: true
  tags: network,ssh,dropbear,detect

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "cbc"
          - "SSH-"
        condition: and
# digest: 4a0a00473045022002fae16b256b4653ad2b98f85511cd26f00c12b388af06a773784c5a84485c17022100e96053936cf02101d8c3295bc5c5797df04c9fc0e666e5fda59f09208ff75826:922c64590222798bb761d5b6d8e72950
Add files via upload 2022-11-22 18:28:08 +00:00			`id: dropbear-cbc-ciphers`

			`info:`
			`name: Dropbear sshd CBC Mode Ciphers Detection`
			`author: pussycat0x`
			`severity: low`
			`description: \|`
			`The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.`
Update dropbear-cbc-ciphers.yaml 2022-11-23 07:02:38 +00:00			`reference: \|`
			`https://www.tenable.com/plugins/nessus/70658`
TemplateMan Update [Wed Sep 27 13:29:58 UTC 2023] :robot: 2023-09-27 13:29:58 +00:00			`remediation: \|`
			`Disable CBC Ciphers.`
Add files via upload 2022-11-22 18:28:08 +00:00			`metadata:`
TemplateMan Update [Wed Sep 27 13:29:58 UTC 2023] :robot: 2023-09-27 13:29:58 +00:00			`max-request: 1`
			`shodan-query: product:"Dropbear sshd"`
Add files via upload 2022-11-22 18:28:08 +00:00			`verified: true`
standardize network template tags 2023-07-24 18:27:05 +00:00			`tags: network,ssh,dropbear,detect`
Add files via upload 2022-11-22 18:28:08 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`tcp:`
Add files via upload 2022-11-22 18:28:08 +00:00			`- inputs:`
			`- data: "\n"`
Update dropbear-cbc-ciphers.yaml 2022-11-24 18:35:59 +00:00
Add files via upload 2022-11-22 18:28:08 +00:00			`host:`
			`- "{{Hostname}}"`
removed duplicate network request 2023-09-16 19:35:21 +00:00			`port: 22`
Update dropbear-cbc-ciphers.yaml 2022-11-24 18:35:59 +00:00
Add files via upload 2022-11-22 18:28:08 +00:00			`matchers:`
			`- type: word`
			`words:`
			`- "cbc"`
Update dropbear-cbc-ciphers.yaml 2022-12-02 11:49:56 +00:00			`- "SSH-"`
Update dropbear-cbc-ciphers.yaml 2022-12-02 11:50:59 +00:00			`condition: and`
Auto Template Signing [Thu Oct 19 13:13:50 UTC 2023] :robot: 2023-10-19 13:13:52 +00:00			`# digest: 4a0a00473045022002fae16b256b4653ad2b98f85511cd26f00c12b388af06a773784c5a84485c17022100e96053936cf02101d8c3295bc5c5797df04c9fc0e666e5fda59f09208ff75826:922c64590222798bb761d5b6d8e72950`