added gitlab metadata

cves/2021/CVE-2021-22214.yaml

@@ -1,6 +1,7 @@
 id: CVE-2021-22214
+
 info:
-  author: Suman_Kar (modified by GitLab Red Team)
+  author: Suman_Kar,GitLab Red Team
   name: Unauthenticated Gitlab SSRF - CI Lint API
   severity: high
   description: |
@@ -19,26 +20,30 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2021-22175
     - https://vin01.github.io/piptagole/gitlab/ssrf/security/2021/06/15/gitlab-ssrf.html
     - https://docs.gitlab.com/ee/api/lint.html
+  metadata:
+    shodan-query: http.title:"GitLab"
   tags: cve,cve2021,gitlab,ssrf
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
     cvss-score: 8.60
-    cve-id: CVE-2021-22214
+    cve-id: CVE-2021-22214,CVE-2021-39935,CVE-2021-22175
     cwe-id: CWE-918
+
 requests:
   - method: POST
     path:
       - "{{BaseURL}}/api/v4/ci/lint?include_merged_yaml=true"
-    body: |
-      {"content": "include:\n  remote: http://127.0.0.1:9100/test.yml"}
+
     headers:
       Content-Type: application/json
+
+    body: |
+      {"content": "include:\n  remote: http://127.0.0.1:9100/test.yml"}
+
     redirects: true
     max-redirects: 3
-    matchers-condition: and
-    # Check for strictly known-vulnerable replies in the body
     matchers:
       - type: word
         part: body
         words:
-          - "does not have valid YAML syntax"
+          - "does not have valid YAML syntax"

misconfiguration/gitlab/gitlab-uninitialized-password.yaml

@@ -8,11 +8,13 @@ info:
     Prior to version 14, GitLab installations required a root password to be
     set via the web UI. If the administrator skipped this step, any visitor
     could set a password and control the instance.
-  tags: gitlab,misconfig,unauth
+  metadata:
+    shodan-query: http.title:"GitLab"
   reference:
     - https://gitlab.com/gitlab-org/gitlab/-/issues/211328
     - https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/5331
     - https://docs.gitlab.com/omnibus/installation/#set-up-the-initial-password
+  tags: gitlab,misconfig,unauth
 
 requests:
   - method: GET