search

zema1 / watchvuln

一个高价值漏洞采集与推送服务 | collect valueable vulnerability and push it
MIT License
1.37k stars 151 forks source link

Feat: add grabber for cwiki struts2 - "把 structs 的爬一下 " #60

Closed hi-unc1e closed 9 months ago

hi-unc1e commented 9 months ago

简单写了一下Security+Bulletins的 parser，K师看下有无问题

解析细节

image image

自测情况

单元测试没啥问题。就这样，先睡了 image

 confluence_test.go:21: get vuln info S2-062 — Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to remote code execution - same as S2-061. (https://cwiki.apache.org/confluence/display/WW/S2-062)
    confluence_test.go:21: get vuln info S2-063 — DoS via OOM owing to not properly checking of list bounds. (https://cwiki.apache.org/confluence/display/WW/S2-063)
    confluence_test.go:21: get vuln info S2-064 — DoS via OOM owing to no sanity limit on normal form fields in multipart forms. (https://cwiki.apache.org/confluence/display/WW/S2-064)
    confluence_test.go:21: get vuln info S2-065 — Excessive disk usage during file upload (https://cwiki.apache.org/confluence/display/WW/S2-065)
    confluence_test.go:21: get vuln info S2-066 — File upload logic is flawed, and allows an attacker to enable paths with traversals (https://cwiki.apache.org/confluence/display/WW/S2-066)
zema1 commented 9 months ago

感谢师傅贡献，我先合了，没发现大的问题~