Consul CVE-2020-25864 and version detection through API

projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

https://github.com/projectdiscovery/nuclei

MIT License

9.1k stars 2.6k forks source link

Consul CVE-2020-25864 and version detection through API #3718

Closed c-sh0 closed 2 years ago

c-sh0 commented 2 years ago

Template Information:

CVE-2020-25864.yaml: CVE-2020-25864: HashiCorp Consul XSS (This will work when there is No or misconfigured ACL in place)
hashicorp-consul-version.yaml: Hashicorp Consul Version Detection (through API, This will work when there is No or misconfigured ACL in place)
hashicorp-consul-webgui.yaml: Detection of HashiCorp Consul WebGUI (This will also grab CONSUL_VERSION) Note: I saw that there is a Consul web UI detection already (fingerprinthub-web-fingerprints.yaml) but, wasn't sure how to add the version extraction without possibly trampling other parts of that template.

These were tested against Consul Versions: 0.8.4, 1.4.0, 1.4.3, 1.8.3, 1.9.15

Tested with running a "Deny ALL" ACL and with defaults no ACL config

Nuclei Templates:

https://github.com/c-sh0/nuclei_templates/tree/main/consul

Sample run (no acl, v1.8.3) no-acl

Sample run (deny all acl, v1.8.3) acl-run

ehsandeep commented 2 years ago

thanks again @c-sh0 for sharing this, I've updated CVE template a bit using request condition to avoid cases where server returns back everything included in the request, using req-condition we can map the matcher to specific response.

c-sh0 commented 2 years ago

Hmm, Yeah. So the fix for that CVE was that they changed the response header to text/plain, so even though the payload will still be there, it won;t render. vs the txt/html response header, when requesting data on a vulnerable server (that has an tag in the data) when using the "?raw" param. Also, I didn't go for the alert() script tags because, my line of thinking was to avoid triggering any WAFs :)

c-sh0 commented 2 years ago

As an example: This version 1.9.15 is not vulnerable: (Note the Content Type: Header)

curl -v 'http://192.168.1.229:8500/v1/kv/25Fb8mswQp1N2fEf9TO3mvRFGUm?raw'

About to connect() to 192.168.1.229 port 8500 (#0) Trying 192.168.1.229... Connected to 192.168.1.229 (192.168.1.229) port 8500 (#0) GET /v1/kv/25Fb8mswQp1N2fEf9TO3mvRFGUm?raw HTTP/1.1 User-Agent: curl/7.29.0 Host: 192.168.1.229:8500 Accept: /

HTTP/1.1 200 OK Content-Length: 54 Content-Security-Policy: sandbox Content-Type: text/plain Vary: Accept-Encoding X-Consul-Default-Acl-Policy: allow X-Consul-Index: 15 X-Consul-Knownleader: true X-Consul-Lastcontact: 0 X-Content-Type-Options: nosniff Date: Thu, 17 Feb 2022 19:31:09 GMT

Connection #0 to host 192.168.1.229 left intact \<!DOCTYPE html>

ehsandeep commented 2 years ago

@c-sh0 updated here - https://github.com/projectdiscovery/nuclei-templates/commit/159e94d0c208003cb104eda30fac3b3ceaf3de47

c-sh0 commented 2 years ago

right on. :)