From 1f818669d9997814fa9b26194e9e590d918ebed1 Mon Sep 17 00:00:00 2001
From: For3stCo1d <57119052+For3stCo1d@users.noreply.github.com>
Date: Thu, 18 May 2023 14:24:18 +0800
Subject: [PATCH 1/4] Create CVE-2023-29857.yaml

---
 http/cves/2023/CVE-2023-29857.yaml | 33 ++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 http/cves/2023/CVE-2023-29857.yaml

diff --git a/http/cves/2023/CVE-2023-29857.yaml b/http/cves/2023/CVE-2023-29857.yaml
new file mode 100644
index 0000000000..6f5b31d56e
--- /dev/null
+++ b/http/cves/2023/CVE-2023-29857.yaml
@@ -0,0 +1,33 @@
+id: CVE-2023-29857
+
+info:
+  name: TeslaMate - Unauthenticated Access
+  author: For3stCo1d
+  severity: high
+  description: |
+    An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link.
+  reference:
+    - https://github.com/Langangago/Cve-number/blob/main/README.md
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29857
+  metadata:
+    fofa-query: title="teslamate"
+  tags: cve,cve2023,teslamate,unauth
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/settings"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'TeslaMate'
+          - 'href="/settings"'
+          - "docs.teslamate.org"
+        condition: and
+
+      - type: status
+        status:
+          - 200

From b36fc6a71bd83d67688e2af195206be5d1100da0 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Thu, 18 May 2023 12:51:30 +0530
Subject: [PATCH 2/4] updated matcher and info

---
 http/cves/2023/CVE-2023-29857.yaml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/http/cves/2023/CVE-2023-29857.yaml b/http/cves/2023/CVE-2023-29857.yaml
index 6f5b31d56e..d3e482d00c 100644
--- a/http/cves/2023/CVE-2023-29857.yaml
+++ b/http/cves/2023/CVE-2023-29857.yaml
@@ -1,7 +1,7 @@
 id: CVE-2023-29857
 
 info:
-  name: TeslaMate - Unauthenticated Access
+  name: TeslaMate v1.27.1 - Unauthenticated Access
   author: For3stCo1d
   severity: high
   description: |
@@ -10,6 +10,9 @@ info:
     - https://github.com/Langangago/Cve-number/blob/main/README.md
     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29857
   metadata:
+    max-req: 1
+    verified: "true"
+    shodan-query: title:"TeslaMate"
     fofa-query: title="teslamate"
   tags: cve,cve2023,teslamate,unauth
 
@@ -23,9 +26,8 @@ http:
       - type: word
         part: body
         words:
-          - 'TeslaMate'
-          - 'href="/settings"'
-          - "docs.teslamate.org"
+          - "Settings · TeslaMate"
+          - "URLs</h2>"
         condition: and
 
       - type: status

From 76a9dfce33fec59eb74d0e6eae1961e49d430bf5 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Thu, 18 May 2023 14:38:41 +0530
Subject: [PATCH 3/4] updated path & name

---
 .../teslamate-unauth-access.yaml}             | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)
 rename http/{cves/2023/CVE-2023-29857.yaml => misconfiguration/teslamate-unauth-access.yaml} (53%)

diff --git a/http/cves/2023/CVE-2023-29857.yaml b/http/misconfiguration/teslamate-unauth-access.yaml
similarity index 53%
rename from http/cves/2023/CVE-2023-29857.yaml
rename to http/misconfiguration/teslamate-unauth-access.yaml
index d3e482d00c..bea0d6ea9c 100644
--- a/http/cves/2023/CVE-2023-29857.yaml
+++ b/http/misconfiguration/teslamate-unauth-access.yaml
@@ -1,20 +1,17 @@
-id: CVE-2023-29857
+id: teslamate-unauth-access
 
 info:
-  name: TeslaMate v1.27.1 - Unauthenticated Access
+  name: TeslaMate - Unauthenticated Access
   author: For3stCo1d
-  severity: high
+  severity: medium
   description: |
-    An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link.
-  reference:
-    - https://github.com/Langangago/Cve-number/blob/main/README.md
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29857
+    A misconfig in Teslamate allows unauthorized access to /settings endpoint.
   metadata:
     max-req: 1
     verified: "true"
     shodan-query: title:"TeslaMate"
     fofa-query: title="teslamate"
-  tags: cve,cve2023,teslamate,unauth
+  tags: misconfig,teslamate,unauth
 
 http:
   - method: GET
@@ -33,3 +30,10 @@ http:
       - type: status
         status:
           - 200
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - "<td>([0-9.]+)<strong>"

From 9a29b00f3f2bc02b79176dfad6b588c4dc50e4b1 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Thu, 18 May 2023 16:13:10 +0530
Subject: [PATCH 4/4] update shodan query

---
 http/misconfiguration/teslamate-unauth-access.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/http/misconfiguration/teslamate-unauth-access.yaml b/http/misconfiguration/teslamate-unauth-access.yaml
index bea0d6ea9c..413060ea6a 100644
--- a/http/misconfiguration/teslamate-unauth-access.yaml
+++ b/http/misconfiguration/teslamate-unauth-access.yaml
@@ -9,7 +9,7 @@ info:
   metadata:
     max-req: 1
     verified: "true"
-    shodan-query: title:"TeslaMate"
+    shodan-query: http.favicon.hash:-1478287554
     fofa-query: title="teslamate"
   tags: misconfig,teslamate,unauth