nuclei-templates/http/misconfiguration/symfony-fragment.yaml

37 lines
1.4 KiB
YAML

id: symfony-fragment
info:
name: Symfony _fragment - Detect
author: Palanichamy_perumal,TechbrunchFR
severity: unknown
description: |
Symfony servers support a "/_fragment" command that allows clients to provide custom PHP commands and return the HTML output.
reference: |
- https://portswigger.net/daily-swig/symfony-based-websites-open-to-rce-attack-research-finds
- https://medium.com/@m4cddr/how-i-got-rce-in-10-websites-26dd87441f22
- https://al1z4deh.medium.com/how-i-hacked-28-sites-at-once-rce-5458211048d5
- https://github.com/ambionics/symfony-exploits
classification:
cpe: cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: sensiolabs
product: symfony
shodan-query: http.html:"symfony Profiler"
tags: config,exposure,symfony,misconfig
http:
- method: GET
path:
- '{{BaseURL}}/_fragment'
matchers-condition: and
matchers:
- type: dsl
dsl:
- "status_code == 403"
- "contains(body, 'Symfony') || contains(body, '403 Forbidden')"
- "(\"8b2f83102bc96e5068d36df80301a64d\" == md5(body)) || (\"4df206fbc337c398c3b669172934c8cb\" == md5(body))"
condition: and
# digest: 490a00463044022035a40118d7d4f7b36c99b9d705698a3ace40b835728ae8d1feb0b7d766b13c2402201632d6db29433692d2282cc141150b58ec325680279ae68202a08cc4df9c1870:922c64590222798bb761d5b6d8e72950