-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Added jolokia templates * lint fixes * Rename jolokia-write-to-rce-vmLog.yaml to jolokia-write-to-rce-vmlog.yaml * more strict matchers * Added version extractor * template id update * misc matcher update * template matcher update * template id template * misc update --------- Co-authored-by: sandeep <sandeep@projectdiscovery.io> Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
- Loading branch information
3 people
authored
Dec 27, 2024
1 parent
26b42a9
commit 2ab76bf
Showing
8 changed files
with
121 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
27 changes: 27 additions & 0 deletions
27
http/vulnerabilities/jolokia/jolokia-acceslogvalve-rce.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| id: jolokia-acceslogvalve-rce | ||
|
|
||
| info: | ||
| name: Jolokia write to RCE valve | ||
| author: pathtaga | ||
| severity: critical | ||
| description: RCE in Jolokia < 1.7.1 using AccesLogValve | ||
| tags: jolokia,rce | ||
| reference: | ||
| - https://github.com/laluka/jolokia-exploitation-toolkit | ||
| - https://therealcoiffeur.github.io/c11011 | ||
|
|
||
| http: | ||
| - method: GET | ||
| path: | ||
| - "{{BaseURL}}/jolokia/list" | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| - type: word | ||
| part: body | ||
| words: | ||
| - "\"host=localhost,name=AccessLogValve,type=Valve\"" |
29 changes: 29 additions & 0 deletions
29
http/vulnerabilities/jolokia/jolokia-createstandardhost-rce.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| id: jolokia-createstandardhost-rce | ||
|
|
||
| info: | ||
| name: Jolokia file write to RCE jfr | ||
| author: laluka,pathtaga | ||
| severity: critical | ||
| description: File read and file write to RCE by deploying a vhost with MBeanFactory/createStandardHost and DiagnosticCommand/jfrStart | ||
| tags: jolokia,rce | ||
| reference: | ||
| - https://github.com/laluka/jolokia-exploitation-toolkit | ||
|
|
||
| http: | ||
| - method: GET | ||
| path: | ||
| - "{{BaseURL}}/jolokia/list" | ||
| - "{{BaseURL}}/jolokia/list" | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| - type: word | ||
| part: body | ||
| words: | ||
| - "\"desc\":\"Create a new StandardHost\"" | ||
| - "\"desc\":\"Array of Diagnostic Commands Arguments and Options\"" | ||
| condition: and |
4 changes: 2 additions & 2 deletions
4
.../jolokia/jolokia-unauthenticated-lfi.yaml → ...okia-file-read-compilerdirectivesadd.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 37 additions & 0 deletions
37
http/vulnerabilities/jolokia/jolokia-tomcat-creds-leak.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| id: jolokia-tomcat-creds-leak | ||
|
|
||
| info: | ||
| name: Jolokia <= 1.7.1 Information Leakage | ||
| author: pathtaga | ||
| severity: critical | ||
| description: Tomcat's credential disclosure leading to Remote Code Execution via WAR upload. | ||
| tags: jolokia,tomcat,exposure | ||
| reference: | ||
| - https://github.com/laluka/jolokia-exploitation-toolkit/blob/main/exploits/info-leak-tomcat-creds.py | ||
| - https://therealcoiffeur.github.io/c11011 | ||
|
|
||
| requests: | ||
| - method: GET | ||
| path: | ||
| - "{{BaseURL}}/jolokia/read/Users:database=UserDatabase,type=UserDatabase" | ||
| - "{{BaseURL}}/actuator/jolokia/read/Users:database=UserDatabase,type=UserDatabase" | ||
|
|
||
| stop-at-first-match: true | ||
| matchers-condition: and | ||
| matchers: | ||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| - type: word | ||
| part: body | ||
| words: | ||
| - '"mbean":"Users:database=UserDatabase,type=UserDatabase"' | ||
| - '"users":' | ||
| condition: and | ||
|
|
||
| - type: word | ||
| part: body | ||
| words: | ||
| - '"users":[]' | ||
| negative: true |