diff --git a/http/cves/2022/CVE-2022-22733.yaml b/http/cves/2022/CVE-2022-22733.yaml new file mode 100644 index 0000000000..e918f4cd8e --- /dev/null +++ b/http/cves/2022/CVE-2022-22733.yaml @@ -0,0 +1,31 @@ +id: CVE-2022-22733 + +info: + name: CVE-2022-22733 Apache ShardingSphere ElasticJob-UI privilege escalation + author: Zeyad Azima + severity: medium + description: CVE-2022-22733 is an Apache ShardingSphere ElasticJob-UI privilege escalation vulnerability and you could achieve Remote Code Execution checkout the Reference URL for full analysis of the vulnerability. + reference: https://www.vicarius.io/vsociety/blog/cve-2022-22733-apache-shardingsphere-elasticjob-ui-privilege-escalation + +requests: + - method: POST + path: + - "{{BaseURL}}/api/login" + headers: + Host: "192.168.0.162:8888" + User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0" + Accept: "application/json, text/plain, */*" + Accept-Language: "en-US,en;q=0.5" + Accept-Encoding: "gzip, deflate" + Content-Type: "application/json;charset=utf-8" + Access-Token: "" + Content-Length: "39" + Origin: "http://192.168.0.162:8888" + DNT: "1" + Connection: "close" + Referer: "http://192.168.0.162:8888/" + body: '{"username":"guest","password":"guest"}' + matchers: + - type: word + words: + - '"accessToken":'