2023-05-17 19:03:29 +00:00
|
|
|
id: symfony-fragment
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Symfony _fragment - Detect
|
2023-05-31 03:39:58 +00:00
|
|
|
author: Palanichamy_perumal,TechbrunchFR
|
2023-05-17 19:03:29 +00:00
|
|
|
severity: unknown
|
|
|
|
|
description: |
|
2023-05-30 10:05:10 +00:00
|
|
|
Symfony servers support a "/_fragment" command that allows clients to provide custom PHP commands and return the HTML output.
|
2023-05-17 19:03:29 +00:00
|
|
|
reference: |
|
|
|
|
|
- https://portswigger.net/daily-swig/symfony-based-websites-open-to-rce-attack-research-finds
|
|
|
|
|
- https://medium.com/@m4cddr/how-i-got-rce-in-10-websites-26dd87441f22
|
|
|
|
|
- https://al1z4deh.medium.com/how-i-hacked-28-sites-at-once-rce-5458211048d5
|
|
|
|
|
- https://github.com/ambionics/symfony-exploits
|
|
|
|
|
metadata:
|
2023-10-14 11:27:55 +00:00
|
|
|
verified: true
|
2023-06-21 21:03:53 +00:00
|
|
|
max-request: 1
|
2023-05-17 19:03:29 +00:00
|
|
|
shodan-query: http.html:"symfony Profiler"
|
2023-06-30 22:52:16 +00:00
|
|
|
tags: config,exposure,symfony,misconfig
|
2023-05-17 19:03:29 +00:00
|
|
|
|
2023-06-21 03:34:22 +00:00
|
|
|
http:
|
2023-05-17 19:03:29 +00:00
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- '{{BaseURL}}/_fragment'
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
2023-05-30 10:05:10 +00:00
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- "status_code == 403"
|
|
|
|
|
- "contains(body, 'Symfony') || contains(body, '403 Forbidden')"
|
|
|
|
|
- "(\"8b2f83102bc96e5068d36df80301a64d\" == md5(body)) || (\"4df206fbc337c398c3b669172934c8cb\" == md5(body))"
|
|
|
|
|
condition: and
|
2023-10-20 11:41:13 +00:00
|
|
|
|
|
|
|
|
# digest: 490a0046304402202aae05b954b4e09d833cb11b5a201d4e5ecd6580bb6d79385fc3affcd8fae7fd022046c21c2cf4d84f67373859c47a19d36990e10c35abf35b91232125584d1591cd:922c64590222798bb761d5b6d8e72950
|
